Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!usc!ucsd!ucbvax!SAYSHELL.UMD.EDU!louie
From: louie@SAYSHELL.UMD.EDU ("Louis A. Mamakos")
Newsgroups: comp.protocols.tcp-ip.domains
Subject: Bogus address for TERP.UMD.EDU root nameserver floating about
Message-ID: <9011061638.AA19042@sayshell.umd.edu>
Date: 6 Nov 90 16:38:29 GMT
Sender: daemon@ucbvax.BERKELEY.EDU
Distribution: inet
Organization: The Internet
Lines: 22


I've noticed a bunch of errors being reported by our Proteon router
which connected UMDNET to SURANET, and thus the rest of the Internet.
There is a packet flux for packets being transmitted to 128.8.26.90.

Hmm.. I think, this is pretty strange.  TERP.UMD.EDU, which is one of
the root name servers, has an address which is fairly similar:
128.8.10.90.  I guess that the bogus address is the "MILNET" version
of TERP's "ARPANET" flavored address..  Really weird.

Bouncing name server queries to the hosts in question indicate that
they have an incorrect idea of what TERP.UMD.EDU's IP address is.
Will you all please take a look at your root name server cache
infomormation, and make sure that you have correct information?  I
suspect that these bogus packets and the associated ICMP destination
unreachable messages are using a non-trivial amount of bandwidth
between the US and Europe.

Let's try to track this down before it spreads very far.  I'm seeing a few
packets per second being transmitted to the bogus address.

louie