Event ID 5504

I get repeated DNS Event 5504 in my event log:

"The DNS server encountered an invalid domain name in a packet from
216.73.86.10. The packet will be rejected. The event data contains the DNS
packet."

The ip address is resolved to anyone of the following:
ns1.doubleclick.net - 216.73.86.10
ns2.doubleclick.net - 216.73.87.10
ns3.doubleclick.net - 216.73.85.10
ns4.doubleclick.net - 216.73.81.10

What does this event mean? Is there a way to find out where this is coming
from.

Mike

You might also want to post in one of the Windows dns newsgroups but it
might mean that your dns server is configured to protect against "cache
pollution" and is rejecting these entries because of that in that they are
not from the same domain as the dns host name request. Doubleclick is an
advertisement service. --- Steve

http://support.microsoft.com/default...316786&sd=tech --
description of dns cache pollution protection.

"Mike" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
>I get repeated DNS Event 5504 in my event log:
>
> "The DNS server encountered an invalid domain name in a packet from
> 216.73.86.10. The packet will be rejected. The event data contains the
> DNS packet."
>
> The ip address is resolved to anyone of the following:
> ns1.doubleclick.net - 216.73.86.10
> ns2.doubleclick.net - 216.73.87.10
> ns3.doubleclick.net - 216.73.85.10
> ns4.doubleclick.net - 216.73.81.10
>
> What does this event mean? Is there a way to find out where this is
> coming from.
>
> Mike
>

I got same errors. Someone here suggested blocking at router, which I did
and that stopped the errors. However, a few days later and now I am getting
same errors from 69.44.60.245 and 66.139.75.83. I did a lookup and shot off
an email to the block owner's email address abuse@..

I'm not hopeful about stopping these errors at the source, though.

"Mike" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
>I get repeated DNS Event 5504 in my event log:
>
> "The DNS server encountered an invalid domain name in a packet from
> 216.73.86.10. The packet will be rejected. The event data contains the
> DNS packet."
>
> The ip address is resolved to anyone of the following:
> ns1.doubleclick.net - 216.73.86.10
> ns2.doubleclick.net - 216.73.87.10
> ns3.doubleclick.net - 216.73.85.10
> ns4.doubleclick.net - 216.73.81.10
>
> What does this event mean? Is there a way to find out where this is
> coming from.
>
> Mike
>

Does this mean the packets are coming into the network, or going out?

Mike

"Joan" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>I got same errors. Someone here suggested blocking at router, which I did
>and that stopped the errors. However, a few days later and now I am getting
>same errors from 69.44.60.245 and 66.139.75.83. I did a lookup and shot off
>an email to the block owner's email address abuse@..
>
> I'm not hopeful about stopping these errors at the source, though.
>
> "Mike" <(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
>>I get repeated DNS Event 5504 in my event log:
>>
>> "The DNS server encountered an invalid domain name in a packet from
>> 216.73.86.10. The packet will be rejected. The event data contains the
>> DNS packet."
>>
>> The ip address is resolved to anyone of the following:
>> ns1.doubleclick.net - 216.73.86.10
>> ns2.doubleclick.net - 216.73.87.10
>> ns3.doubleclick.net - 216.73.85.10
>> ns4.doubleclick.net - 216.73.81.10
>>
>> What does this event mean? Is there a way to find out where this is
>> coming from.
>>
>> Mike
>>
>
>

Coming in. Packets contain invalid characters. But, see Eventid.net for 5504
for more info.

I still don't feel comfortable about the errors caused by doubleclick and
the IPs mentioned below. But today we also got 5504 for IPs registered to a
very major northeast regional bank.

One solution mentioned is to turn off forwarding but we can't do that
because our DNS servers are AD private, our ISP hosts our public DNS and so
we forward all non-local (non-AD Domain) DNS requests to our ISP DNS
servers.

Wish we could see the actual domain names causing the 5504, then I'd
understand more.


"Mike" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Does this mean the packets are coming into the network, or going out?
>
> Mike
>
> "Joan" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>>I got same errors. Someone here suggested blocking at router, which I did
>>and that stopped the errors. However, a few days later and now I am
>>getting same errors from 69.44.60.245 and 66.139.75.83. I did a lookup and
>>shot off an email to the block owner's email address abuse@..
>>
>> I'm not hopeful about stopping these errors at the source, though.
>>
>> "Mike" <(E-Mail Removed)> wrote in message
>> news:%(E-Mail Removed)...
>>>I get repeated DNS Event 5504 in my event log:
>>>
>>> "The DNS server encountered an invalid domain name in a packet from
>>> 216.73.86.10. The packet will be rejected. The event data contains the
>>> DNS packet."
>>>
>>> The ip address is resolved to anyone of the following:
>>> ns1.doubleclick.net - 216.73.86.10
>>> ns2.doubleclick.net - 216.73.87.10
>>> ns3.doubleclick.net - 216.73.85.10
>>> ns4.doubleclick.net - 216.73.81.10
>>>
>>> What does this event mean? Is there a way to find out where this is
>>> coming from.
>>>
>>> Mike
>>>
>>
>>
>
>