attack info :illegal resource record format

[925305]

In SmartTracker , some DNS requests are dropped by " attack info :illegal resource record format ". How can I solve it ?

[chillyjim]

Is there any more info? Src/Dest? is it one of your DNS servers?

[Sergej]

This is result of smartdefense inspecting DNS packets. You can disable it or just ignore.
The exact error must be "Attack Info: Illegal number of Resource Records"

[djbones]

I am having this same issue. The traffic is between two of my own DNS servers (Windows domain controllers). The one making the request is behind a VPN-1 Edge X, and there is a tunnel to our FW-1. The packets are dropped by FW-1.

Number: 51453
Date: 21Jun2006
Time: 8:17:49
Product: SmartDefense
VPN-1 & FireWall-1
Interface: eth2c0
Origin: Xxxxxx (172.16.0.4)
Type: Log
Action: Drop
Service: domain-udp (53)
Source: vpnTest2 (10.1.2.30)
Destination: xxxxxxx.xxxx.corp (172.16.0.3)
Protocol: udp
Rule: 10
Source Port: 1597
Attack Name: Invalid DNS
Information: Attack Info: Illegal Resource Record format

[jimirezin]

I'm having the same problem. It may have started when I installed sp1 for server 2003 but I'm not sure. My isp can't slave anymore and I can't slave from outside the firewall. Smartdefense seems to be broken....Checkpoint just said to apply the latest hotfix and call them back. It worked with this hotfix for over a year!