Resolvers performing broadcast requests

Moyer, Rob (c) RMoyer at Carlson.com
Thu Jun 24 16:52:55 UTC 1999


There is (or was) a stealth secondary server on our network running bind
4.9.6 on HP-UX 10.20. I am preparing to shutdown the name server on this box
but not being sure of how many devices were using it for DNS resolution I
first turned it into a caching server, updated all the known resolvers that
were configured with its address then started query logging. I have been
monitoring the queries for a week now and I noticed a large number of
queries coming from resolvers that I know do not have this server's address
in their resolv.conf, I then realized they were all coming from the local
subnet so I surmise that these queries are broadcasts. 

I looked at the "DNS and Bind" books and did some queries on dejanews but I
can't find a enough information to help answer the following questions that
I have.

1) What causes resolvers to send out broadcast queries like this when they
clearly are configured with nameserver addresses?

2)  I notice that most of the queries to this server are coming from the
local host itself yet the resolv.conf on this server does not have its own
address in its resolv.conf so I can't understand why it queries itself so
often?

TIA.

Rob Moyer
Carlson Companies, Inc.
Carlson Shared Services - UNIX Support


More information about the bind-users mailing list