UDP Port 53

[fantum0000]

We get a lot of messages on our PIX for outbound
requests from clients originating on various ports
to remote IP addresses with port 53

IE: port 1851 -----> 192.175.48.42/53

IE: port 1853 -----> 192.175.48.42/53

IE: port 1854 -----> 192.175.48.42/53

what on the client side would originate such requests besides
DNS lookups?

i'm a neewbie at this so any help or pointers would
be appreciated.

 

[themut]

Well looks like DNS querries from hosts, syslogs from PIX would provide a better picture

 

[fantum0000]

but why would they outbound request be generated with all these weird port numbers.

 

[themut]

ALL clients use random ports above 1023 and servers listen on well defined ports. DNS servers for instance, will listen for DNS querries on UDP port 53 and clients will send the querries using random UDP ports above 1023. That behaviour is normal!

 

[fantum0000]

ok....not trying to be dumb but if noone is doing anything on the pc why would there be outbound dns queries to servers not on our network.

the reason i'm bringing this up is because our firewall guy has blocked port 53 outbound and we get thousands of entries everyday on the logs.

 

[themut]

If DNS querries shouldn't go to servers outside your network, then use the logs you are receiving to pinpoint the machines querrying outside DNS servers, and look into those machines to try to determine why they are doing these querries. Maybe they have misconfigured DNS server entries on the TCP/IP stack, try to look throuroughly into these hosts

 

[LloydSev]

DNS requests can occur due to services running on the machine even when no one is logged on.. normal networking environment.

As far as the machine trying to send DNS requests outbound.. do you have an internal DNS server that is defined in the DHCP server?

Computer/Network Technician
CCNA

 

[fantum0000]

yes we do have an internal 2003 server running DNS. it is the primary (and only) DNS server setup in DHCP for the clients.

i do understand that DNS lookups are normal. I just dont see why any services would try to send them to external servers. (im being thick)

by the way..thanks for the fast responses

 

[themut]

Like I said, use the logs to determine which machines are sending DNS querries to external DNS servers. Then look into those machines to determine the reason for this behaviour. Check the TCP/IP properties maybe it has external DNS servers statically defined.