In message <[log in to unmask]>you write:
>Last night someone in the UK did a zone transfer to fetch our name
>server data.  This is not a normal name server operation unless the
>fetching system is one of your secondaries, and unless U of T has
>made new arrangements, this system isn't; it is, however, sometimes
>a sign of a bad guy trying to gather data to aid in an attack.

Yes, you're probably right.  Perhaps the admins of that machine should be
notified?  

>Has anyone else seen any unexpected zone transfers lately?
>
>The offending transfers happened at 2242 for hprc.toronto.edu and
>2305 for utirc.toronto.edu, and came from 194.72.238.4, which is
>ns0.netcraft.co.uk.

CDF's came at 2231.  It's the only recorded suspicious zone transfer in 
our logs since Jul 2. 

>(No probes for utoronto.ca.  Can we start a new pointless argument
>that claims that toronto.edu isn't as safe because more bad guys
>probe it?)

Ha! Good one. :-)

Regards,

John
--
John DiMarco <[log in to unmask]>                        Office: EA201B
Computing Disciplines Facility Systems Manager            Phone: 416-978-1928
University of Toronto                                     Fax:   416-978-1931
http://www.cdf.toronto.edu/~jdd