Resolvers performing broadcast requests

[Frank Marchan]

It could be application-related as opposed to OS-related.  I had a problem
in which an application used its own resolver library-type code and, due
to a bug, was determining to broadcast DNS queries because it saw the word
"nameserver" in a comment of resolv.conf.

Frank

--
M. Frank Marchan
Technical Services
IT Infrastructure
Alcatel USA
mmarchan at usa.alcatel.com

On Thu, 24 Jun 1999, Moyer, Rob (c) wrote:

> There is (or was) a stealth secondary server on our network running bind
> 4.9.6 on HP-UX 10.20. I am preparing to shutdown the name server on this box
> but not being sure of how many devices were using it for DNS resolution I
> first turned it into a caching server, updated all the known resolvers that
> were configured with its address then started query logging. I have been
> monitoring the queries for a week now and I noticed a large number of
> queries coming from resolvers that I know do not have this server's address
> in their resolv.conf, I then realized they were all coming from the local
> subnet so I surmise that these queries are broadcasts. 
> 
> I looked at the "DNS and Bind" books and did some queries on dejanews but I
> can't find a enough information to help answer the following questions that
> I have.
> 
> 1) What causes resolvers to send out broadcast queries like this when they
> clearly are configured with nameserver addresses?
> 
> 2)  I notice that most of the queries to this server are coming from the
> local host itself yet the resolv.conf on this server does not have its own
> address in its resolv.conf so I can't understand why it queries itself so
> often?
> 
> TIA.
> 
> Rob Moyer
> Carlson Companies, Inc.
> Carlson Shared Services - UNIX Support
> 
>