>40Hz DNS query xxx.1.168.192.in-addr.arpa, unknown cause

networkingtroubleshooting

On one of my FC10 boxes I noticed that the network activity lights keep flashing even when I'm doing nothing on it so I pulled out wireshark and took a look at whats causing it. It's logging the same query xxx.1.168.192 where xxx is another machine (winXP) on my network thats currently not turned on. Wireshark provides additional info of "type PTR, class IN" under the 'Queries' tab. The response packet is 'No such name' and Under the 'Authoratative nameservers' it says "168.192.in-addr.arpa: type SOA, class IN, mname prisoner.iana.org"

It occurs for a few minutes every few minutes.

I'm not (much of) a sysadmin but I do some simple tasks to look after the network so some pointers on a) How to find out whats causing this and b) How do I fix this would be great.

Details:

Source 192.168.1.fc10 dest 192.168.1.1 (dsl gateway) 'PTR xxx.1.168.192.in-addr.arpa'
Source 192.168.1.1 dest 192.168.1.fc10 'No such name'
[repeat at >40Hz]

Edit 2:

Another question: in the meanwhile while someone tries to point me in the right direction, is there anyway to firewall off this particular request without messing with other dns requests?

Edit 3:

Tried tcpdump -i any -X nnv ip host 192.168.1.winxp produced:
0 packets captured
0 packets received by filter
0 packets dropped by kernel

Tried editing hosts file with '192.168.1.xxx winxp' (Eddy put the hostname first but I thought the IP goes first? Am I missing something?) but that doesnt do anything still getting the PTR queries.

Best Answer

Found the culprit. Since it appeared periodic I checked crontab on a hunch and found that I had sarg (squid report generator) running every x minutes. From everyones suggestion about DNS lookups etc. I checked the details in the config and found it was configured to resolve IP addresses (mistake) so for every request logged from the winXP box it tried to resolve it, and it appeared to do this for every request in the log hence the flood.

fix: turn off resolve ip address.

thanks everyone for the ideas that got me looking in the right direction. posting the answer in the event it might help someone else.

Related Topic