On one of my FC10 boxes I noticed that the network activity lights keep flashing even when I'm doing nothing on it so I pulled out wireshark and took a look at whats causing it. It's logging the same query xxx.1.168.192 where xxx is another machine (winXP) on my network thats currently not turned on. Wireshark provides additional info of "type PTR, class IN" under the 'Queries' tab. The response packet is 'No such name' and Under the 'Authoratative nameservers' it says "168.192.in-addr.arpa: type SOA, class IN, mname prisoner.iana.org"
It occurs for a few minutes every few minutes.
I'm not (much of) a sysadmin but I do some simple tasks to look after the network so some pointers on a) How to find out whats causing this and b) How do I fix this would be great.
Details:
Source 192.168.1.fc10 dest 192.168.1.1 (dsl gateway) 'PTR xxx.1.168.192.in-addr.arpa'
Source 192.168.1.1 dest 192.168.1.fc10 'No such name'
[repeat at >40Hz]
Edit 2:
Another question: in the meanwhile while someone tries to point me in the right direction, is there anyway to firewall off this particular request without messing with other dns requests?
Edit 3:
Tried tcpdump -i any -X nnv ip host 192.168.1.winxp produced:
0 packets captured
0 packets received by filter
0 packets dropped by kernel
Tried editing hosts file with '192.168.1.xxx winxp' (Eddy put the hostname first but I thought the IP goes first? Am I missing something?) but that doesnt do anything still getting the PTR queries.