Re: [tor-relays] EventDNS error

Subject: Re: [tor-relays] EventDNS error

From: Tim Wilson-Brown - teor <teor2345@xxxxxxxxx>

Date: Tue, 26 Jan 2016 10:41:29 +1100

Delivery-date: Mon, 25 Jan 2016 18:41:48 -0500

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:message-id :references:to; bh=Ncj/DA3IZqo9RkKnne/GmAiKVNoEkqU2LZ+5qkgE7WU=; b=Ls8ljMx8D8fZM/ZTgGZgrYEqvD5DtMnDjfjIQ5U9YfFGryhEEq7tfab+sZBoU3leSn 0cHQdhqPFtlnvkhaOh8kyDq7Q3+eYUS8wT4Tfs4RnIoQnMtdF+CQhQo/XS3t2KOKrUfa oLOvSu5bUP3wuJcnXbe/FCkHGU9KvKnPXtFRJ4TKFWpQ6GJp49qGz1gZk/XNKHqV8bzT JYGDwPh+KddqLPlQJ8OaE/BeEaPl12Cxm5Y/paQFKDE2bwD8pgQ0Gh7wwLtE9cP/KCu9 9U5/bLGsxwdjbo1tq1k51D8E+VFaxA0JdyVbJz5ozJH/gZecrPAYvYy0ni/N8sebYygN bP2A==

In-reply-to: <56A62D4C.6010004@xxxxxxxxxxxxx>

List-archive: <http://lists.torproject.org/pipermail/tor-relays/>

List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>

List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>

List-post: <mailto:tor-relays@lists.torproject.org>

List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>

List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>

References: <56A62D4C.6010004@xxxxxxxxxxxxx>

Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx

Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

On 26 Jan 2016, at 01:12, TorOp AnonymizedDotIo1 <torrelay@xxxxxxxxxxxxx> wrote:

Hi,

Over the weekend I started having those kind of error popping on my log at a very high rate (a few per seconds):

Jan 25 09:00:00.000 [warn] eventdns: Address mismatch on received DNS packet. Apparent source was xxx.237.192.xxx:61083

Apparent source is not my IP and is different at every error message. I restarted my relay and I have stopped happening. I am running my own local unbound DNS server.

Is it some kind of attack or simply an error that happened over the weekend? I have never seen it before.

This error is logged when Tor sends a DNS query to an address, but gets a reply back from a different address.

This could be an attack, or a misconfigured DNS server, or simply a multihomed DNS server.

Tim

Tim Wilson-Brown (teor)

teor2345 at gmail dot com
PGP 968F094B

teor at blah dot im
OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

References:

[tor-relays] EventDNS error
- From: TorOp AnonymizedDotIo1