0

On one of my FC10 boxes I noticed that the network activity lights keep flashing even when I'm doing nothing on it so I pulled out wireshark and took a look at whats causing it. It's logging the same query xxx.1.168.192 where xxx is another machine (winXP) on my network thats currently not turned on. Wireshark provides additional info of "type PTR, class IN" under the 'Queries' tab. The response packet is 'No such name' and Under the 'Authoratative nameservers' it says "168.192.in-addr.arpa: type SOA, class IN, mname prisoner.iana.org"

It occurs for a few minutes every few minutes.

I'm not (much of) a sysadmin but I do some simple tasks to look after the network so some pointers on a) How to find out whats causing this and b) How do I fix this would be great.

Details:

Source 192.168.1.fc10 dest 192.168.1.1 (dsl gateway) 'PTR xxx.1.168.192.in-addr.arpa'
Source 192.168.1.1 dest 192.168.1.fc10 'No such name' [repeat at >40Hz]

Edit 2:

Another question: in the meanwhile while someone tries to point me in the right direction, is there anyway to firewall off this particular request without messing with other dns requests?

Edit 3:

Tried tcpdump -i any -X nnv ip host 192.168.1.winxp produced:
0 packets captured
0 packets received by filter
0 packets dropped by kernel

Tried editing hosts file with '192.168.1.xxx winxp' (Eddy put the hostname first but I thought the IP goes first? Am I missing something?) but that doesnt do anything still getting the PTR queries.

4 Answers 4

2

Found the culprit. Since it appeared periodic I checked crontab on a hunch and found that I had sarg (squid report generator) running every x minutes. From everyones suggestion about DNS lookups etc. I checked the details in the config and found it was configured to resolve IP addresses (mistake) so for every request logged from the winXP box it tried to resolve it, and it appeared to do this for every request in the log hence the flood.

fix: turn off resolve ip address.

thanks everyone for the ideas that got me looking in the right direction. posting the answer in the event it might help someone else.

3
  • 1
    you should accept this answer to indicate this issue is solved. Nov 11, 2009 at 20:26
  • 1
    You have to wait two days before you can accept your own answer. Nov 11, 2009 at 22:02
  • +1: I did not know that. Nov 12, 2009 at 14:27
1

I see two issues:

  1. your machine is doing a PTR lookup for the other machine.

  2. you don't have a reverse lookup zone for your subnet in your internal DNS. That's why the PTR lookups are going to prisoner.iana.org

http://support.microsoft.com/kb/259922

0

What is the source of the query? I'm wondering if there is a service on your network that is trying to access the disabled winxp box (network share maybe) and when it fails it does a reverse dns lookup on the IP (for I don't know why).

9
  • The source is the box itself, I've added details above thanks
    – Ben
    Nov 11, 2009 at 13:41
  • Is the fc10 box providing dhcpd service and if so, is the winxp box a client?
    – Eddy
    Nov 11, 2009 at 14:24
  • no, dhcp provided by the DSL router box (192.168.1.1). xp box is a client to the DSL router for DHCP however.
    – Ben
    Nov 11, 2009 at 14:32
  • does the fc10 box access any services on the winxp box? Hard to firewall this as you'd have to block access to dns from the source. Have you tried adding an in-addr.arpa entry to the bind service? You might also try running a network dump for traffic to the winxp box to try and see what other attempts are going on - tcpdump -i any -X -nnv ip host 192.168.1.winxp_ip
    – Eddy
    Nov 11, 2009 at 15:19
  • no. xp box is pure client. it does syslog to the fc10 box but the winxp box is off. what do you mean by adding in-addr.arpa to the bind service? sorry not too familiar with bind. will try the tcpdump you suggest but i doubt it. I've left wireshark running and it only catches this traffic to the xp box. i dont think theres any easy way to trace what process is doing the dns lookups is there?
    – Ben
    Nov 11, 2009 at 15:37
0

Did you recently change your IPs around? Could it be that some other machine thinks it is using the XP station's IP? PTR records are usually only asked for when another machine tries to connect to the station. IP 192.168.1.xxx in your example is attempting to connect to your fc10 box. If your WinXP box is off, then an IP conflict will not be noticed. Are there any other machines on your network besides winxp, fc10 and dsl router?

As Eddy suggests, I would run a sniff (tcpdump) on your fc10 box and figure out what those PTR records are in response to.

To fix it, put an entry in your /etc/hosts file for that IP. It's covering up the problem, but you won't see any more PTR traffic for that IP on your network.

BTW, other than why this is happening, I don't see any reason to worry about a minuscule amount of data traffic being an issue on your network.

2
  • The problem is my ADSL router (Netgear DG834G v5) doesnt seem to like it - when this occurs, I'm unable to access the net but I can still ping the gateway. I've also noticed BT traffic is unaffected (UL/DL chart doesnt change) but browsing the web (presumably due to DNS lookups - although I would have thought there would be some caching) fails (DOS by my FC box?). At first I thought it was due to a faulty router so I bought a new one but there's little change.
    – Ben
    Nov 11, 2009 at 16:38
  • re. your question, yes there are about 20 devices on the subnet however no active devices matches the ip that the PTR query is asking for. will try running tcpdump shortly.
    – Ben
    Nov 11, 2009 at 16:46

You must log in to answer this question.