DNS something is wrong?
Posted
by Nickolas R.
on Server Fault
See other posts from Server Fault
or by Nickolas R.
Published on 2010-03-14T21:47:42Z
Indexed on
2010/03/14
21:55 UTC
Read the original article
Hit count: 433
Hello
I am configuring bind9 on a server with two network interfaces, one is connected to the LAN and the other is connected to the Internet through NAT so bind is not faced directly to the Internet. Everything seems to work fine, clients can do both forward and reverse lookups but somethings seems strange.
On the server if i try to ping www.google.com one time, a great amount of network activity is genereated, alot more that one would expect so i decided to sniff the traffic with tcpdump. When loading the dump into Wireshark i can see about 250 entries with "Standard query A" and "Standard query response" Here a some of the entries from the dump
DNS Standard query A www.google.com
DNS Standard query A blackhole-1.iana.org
DNS Standard query A blackhole-2.iana.org
DNS Standard query response
DNS Standard query A ns2.isc-sns.com
DNS Standard query A ns1.isc-sns.net
DNS Standard query A ns3.isc-sns.info
DNS Standard query response PTR b.iana-servers.net RRSIG
DNS Standard query A auth2.dns.cogentco.com
DNS Standard query A ns1.crsnic.net
DNS Standard query A ns2.nsiregistry.net
DNS Standard query A ns3.verisign-grs.net
DNS Standard query A ns4.verisign-grs.net
DNS Standard query PTR 79.52.19.199.in-addr.arpa
I do not have too much experince with DNS yet, but i am pretty sure that something is wrong. Anybody that have an idea of whats is going on?
© Server Fault or respective owner