Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With BIND (named) enabled on an OS-X Lion iMac, I can get a list of queries as they occur. In the list are some very strange entries, listed below. Can anyone shed some light on these? (Note that the iMac is at 192.168.1.3) :

query: xdnrhkbqnn IN A + (127.0.0.1)
query: rvdldbxroe IN A + (127.0.0.1)
query: dtzmkqjwwc IN A + (127.0.0.1)
query: edyidthaxc IN A + (127.0.0.1)
query: bqjmeqglim IN A + (127.0.0.1)
query: sixelsjzvf IN A + (127.0.0.1)
query: c.1.8.1.6.b.e.f.f.f.3.6.b.1.2.0.d.d.0.2.2.3.5.1.2.8.4.d.f.c.d.f.ip6.arpa IN PTR + (127.0.0.1)
query: 3.1.168.192.in-addr.arpa IN PTR + (127.0.0.1)
query: b._dns-sd._udp.0.1.168.192.in-addr.arpa IN PTR + (127.0.0.1)
query: db._dns-sd._udp.0.1.168.192.in-addr.arpa IN PTR + (127.0.0.1)
query: r._dns-sd._udp.0.1.168.192.in-addr.arpa IN PTR + (127.0.0.1)
query: dr._dns-sd._udp.0.1.168.192.in-addr.arpa IN PTR + (127.0.0.1)
query: lb._dns-sd._udp.0.1.168.192.in-addr.arpa IN PTR + (127.0.0.1)
query: c.1.8.1.6.b.e.f.f.f.3.6.b.1.2.0.6.6.9.1.7.d.2.5.7.8.5.6.0.0.d.f.ip6.arpa IN PTR + (127.0.0.1)
share|improve this question

1 Answer 1

In order:

  1. Six entries caused by Google Chrome checking — twice, apparently — to see if you are the victim of an ISP, or an external advertiser-driven proxy DNS provider, that does NXDOMAIN hijacking.
  2. One perfectly ordinary IPv6 address→name lookup for an address in the FD00::/8 block.
  3. One perfectly ordinary IPv4 address→name lookup for an address in 192.168.0.0/16.
  4. Five perfectly ordinary DNS Service Discovery/Bonjour browse lookups for what is presumably the LAN (192.168.1.0/24).
  5. One perfectly ordinary IPv6 address→name lookup for another address in the FD00::/8 block.

Further reading

  • S. Thomson, C. Huitema, V. Ksinant, and M. Souissi (October 2003). "IP6.ARPA domain". DNS Extensions to Support IP Version 6 . RFC 3596. Requests for Comments.
share|improve this answer
    
Thanks very much and thanks for the link - interesting :-) Hoping not to try your patience, how does one determine the FD00::/7 from the long string of numbers? and who/what/where might be using IPv6 on the box? –  William Morris Jan 24 '12 at 0:09
    
Thanks again for the IP6 link :-) –  William Morris Jan 24 '12 at 0:23
    
@WilliamMorris: The numbers for ip→name lookups are backwards so that hierarchy works out right. –  freiheit Jan 24 '12 at 0:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.