bind/named output from netstat

I was doing some security tweaking on one of my servers today and I came across this in netstat:

Code: 
udp     0      0 1.2.3.4:domain           *:*      30000/named
udp     0      0 sub.notmydomain.com:domain *:*    30000/named
udp     0      0 ns2.mydomain.:domain        *:*   30000/named
udp     0      0 sub.mydomain:domain        *:*    30000/named
udp     0      0 localhost:domain         *:*      30000/named
ns2.mydomain.com (changed to protect the innocent) is good, and so is sub.mydomain.com, but I have never heard of sub.notmydomain.com, nor 1.2.3.4 - that is not my ip address. I what does the "sub.notmydomain.com:domain" part mean and why is it listening to some server I have nothing to do with?

 

 

 

 

Top