# odd data in my bro dns.log

**URL:** <https://community.zeek.org/t/odd-data-in-my-bro-dns-log/4089>\
**Category:** Zeek\
**Created:** [April 3, 2016, 11:31pm UTC](https://community.zeek.org/t/odd-data-in-my-bro-dns-log/4089 "2016-04-03T23:31:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tim\_Krabec](https://avatars.discourse-cdn.com/v4/letter/t/8e8cbc/32.png) [@Tim\_Krabec](https://community.zeek.org/u/Tim_Krabec)\
**Post date:** [April 3, 2016, 11:31pm UTC](https://community.zeek.org/t/odd-data-in-my-bro-dns-log/4089/1 "2016-04-03T23:31:19Z")

</div>

I’m working through mydns logs  
and I’m seeing entries like this  
.13 & .14 are AD domain servers  
not sure what to make of these, google has led me no where.  
TIA

192.168.1.13bp\x95\xff\x7f 192.168.1.13  
192.168.1.13bp\x95\xff\x7f 192.168.1.138  
192.168.1.13bp\x95\xff\x7f 192.168.1.14  
192.168.1.13bp\x95\xff\x7f 192.168.1.143  
192.168.1.13b\x16\x91\xff\x7f 192.168.1.138  
192.168.1.13b\x16\x91\xff\x7f 192.168.1.14  
192.168.1.13b\x16\x91\xff\x7f 192.168.1.143  
192.168.1.13b\xcf\x8f\xff\x7f 192.168.1.14  
192.168.1.13!ek\xff\x7f 192.168.1.14  
192.168.1.13!ek\xff\x7f 192.168.1.143  
192.168.1.13\x17\x96\x96\xff\x7f 192.168.1.14  
192.168.1.13\x81 192.168.1.138  
192.168.1.13\x81 192.168.1.14  
192.168.1.13\x81 192.168.1.143  
192.168.1.13\x82d\x8a\xff\x7f 192.168.1.138  
192.168.1.13\x82d\x8a\xff\x7f 192.168.1.14  
192.168.1.13\x82d\x8a\xff\x7f 192.168.1.143  
192.168.1.13\xa1\xf6a\xff\x7f 192.168.1.138  
192.168.1.13\xa1\xf6a\xff\x7f 192.168.1.14  
192.168.1.13\xa1\xf6a\xff\x7f 192.168.1.143  
192.168.1.13"\xb0\x94\xff\x7f 192.168.1.14  
192.168.1.13\xb1+m\xff\x7f 192.168.1.138  
192.168.1.13\xb1+m\xff\x7f 192.168.1.14  
192.168.1.13\xb1+m\xff\x7f 192.168.1.143  
192.168.1.13\xb2\xc6\x8b\xff\x7f 192.168.1.138  
192.168.1.13\xb2\xc6\x8b\xff\x7f 192.168.1.14  
192.168.1.13\xb2\xc6\x8b\xff\x7f 192.168.1.143  
192.168.1.13\xb2\xd4\x8b\xff\x7f 192.168.1.138  
192.168.1.13\xb2\xd4\x8b\xff\x7f 192.168.1.14  
192.168.1.13\xb2\xd4\x8b\xff\x7f 192.168.1.143  
192.168.1.13\xc0\x80}\xff\x7f 192.168.1.138  
192.168.1.13\xc0\x80}\xff\x7f 192.168.1.14  
192.168.1.13\xc0\x80}\xff\x7f 192.168.1.143  
192.168.1.13\xc2\x07\x93\xff\x7f 192.168.1.13  
192.168.1.13\xc2\x07\x93\xff\x7f 192.168.1.138  
192.168.1.13\xc2\x07\x93\xff\x7f 192.168.1.14  
192.168.1.13\xc2\x07\x93\xff\x7f 192.168.1.143  
192.168.1.13\xd2\x1c\x95\xff\x7f 192.168.1.13  
192.168.1.13\xd2\x1c\x95\xff\x7f 192.168.1.138  
192.168.1.13\xd2\x1c\x95\xff\x7f 192.168.1.14  
192.168.1.13\xd2\x1c\x95\xff\x7f 192.168.1.143  
192.168.1.13\xe1\xb7i\xff\x7f 192.168.1.14  
192.168.1.13\xff 192.168.1.14  
192.168.1.14bp\x95\xff\x7f 192.168.1.14  
192.168.1.14b\x16\x91\xff\x7f 192.168.1.14  
192.168.1.14b\xcf\x8f\xff\x7f 192.168.1.14  
192.168.1.14!ek\xff\x7f 192.168.1.138  
192.168.1.14!ek\xff\x7f 192.168.1.14  
192.168.1.14!ek\xff\x7f 192.168.1.143  
192.168.1.14\x17\x96\x96\xff\x7f 192.168.1.14  
192.168.1.14\x81 192.168.1.14  
192.168.1.14\x82d\x8a\xff\x7f 192.168.1.14  
192.168.1.14\xa1\xf6a\xff\x7f 192.168.1.14  
192.168.1.14"\xb0\x94\xff\x7f 192.168.1.14  
192.168.1.14\xb1+m\xff\x7f 192.168.1.14

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/odd-data-in-my-bro-dns-log/4089/2 "2022-05-06T15:43:33Z")

</div>

Closed on May 6, 2022, 3:43pm UTC