ps3cheats

I am using Webshield... were having to reboot it more and more often to maintain good internet connectivity. Now we are looking into the logs and seeing several DNS errors. I'm trying to figure out if the errors are with the Webshield, or if the PC's involved (doing the requests) have a virus or worm on them. Or are the errors with my ISP. We also have two DNS servers here locally. I am including one of my logs so you might be able to see a pattern here.




1,2006-12-29 14.00.00,2006-12-29 20.00.00,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.25.149,1741,63.236.94.153,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.236.94.153#delta =0#error code =1
1,2006-12-29 14.00.00,2006-12-29 20.00.00,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.25.149,1742,63.236.94.153,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.236.94.153#delta =0#error code =1
1,2006-12-29 14.00.00,2006-12-29 20.00.00,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.25.149,1743,63.236.94.153,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.236.94.153#delta =0#error code =1
1,2006-12-29 14.00.00,2006-12-29 20.00.00,webshield,http-gw,5,eventSvcLookupError,,,,,,,10.65.27.131,1776,,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =10.65.27.131#delta =0#error code =1
1,2006-12-29 14.00.00,2006-12-29 20.00.00,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.27.131,1776,207.138.126.185,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =207.138.126.185#delta =0#error code =1
1,2006-12-29 14.00.00,2006-12-29 20.00.00,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.25.149,1744,63.236.94.153,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.236.94.153#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29 20.00.01,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.64.2.114,2233,205.161.6.152,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =205.161.6.152#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29 20.00.01,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.64.2.114,2234,205.161.6.152,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =205.161.6.152#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29 20.00.01,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.45.53,1631,72.14.207.99,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =72.14.207.99#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29 20.00.01,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.45.53,1642,63.215.202.6,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.215.202.6#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29 20.00.01,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.25.149,1746,63.236.94.153,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.236.94.153#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29 20.00.01,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.25.149,1745,63.236.94.153,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.236.94.153#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29 20.00.01,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.25.149,1747,63.236.94.153,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.236.94.153#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29 20.00.01,webshield,http-gw,5,eventSvcLookupError,,n/a,,,,,10.65.25.149,1748,63.236.94.153,80,,,,A DNS lookup had an error#Resource was not found (or not known)#code location =GetHostByAddr#host =63.236.94.153#delta =0#error code =1
1,2006-12-29 14.00.01,2006-12-29

ps3cheats

It looks like some of your inside hosts are trying to get to webserver ip addresses that don't resolve back to a host name (reverse lookup). They don't resolve from here either. that isn't necessarily a problem, but Webshield seems to be trying to resolve the IPs before allowing the traffic.

If you're having a lot of that, I would look around for spyware on your PCs. Most of the time a legitimate web server has a public host name, not just an IP address.

that's how it looks to me, anyway. If everything else seems legit, there may be some extra-paranoid feature in Webshield that you simply need to turn off.