Bind8 does every 4sec a DNS-lookup

[Gareth Bromley]

Christian Birkmeier wrote:

> I have an Dial-on-Demand Connection configured on that computer. My
> Bind8 Nameserver does every 4sec. a DNS-Querry. Tcpdump -i sl0 shows
> that:

Do you have any internal clients using WINS or DNS e.g. Windows clients. I
used to have similar things, when the sales people came in with laptops
misconfigured to use DNS for WINS queries resulting in the ISDN routers
kicking every 4-16 seconds (Nice ISDN bill ;) )

> 21:01:16.858929 fw.home.net.61002 > 202.12.27.33.domain: 3816 NS? . (17)
> 21:01:20.858929 fw.home.net.61002 > 192.112.36.4.domain: 3816 NS? . (17)
> 21:01:24.858929 fw.home.net.61002 > 128.63.2.53.domain: 3816 NS? . (17)

All the above are root level servers.
H.ROOT-SERVERS.NET.      3600000      A     128.63.2.53
G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33

Looks like something is query for a non-local domain. Whats your NT/WINS
domains/workgroups called?

> Why does my NS that querrys?!?

A good way to check is to turn on logging of queries made. Add the following
to your named.conf:
logging {
  channel req_file {
    file "dbuglog.msgs";
    severity dynamic;
    print-category yes;
    print-severity yes;
  };

  category default  { default_syslog; req_file; };
  category panic    { default_syslog; req_file; };
  category packet   { req_file; };
  category eventlib { req_file; };
  category queries  { req_file; };
};

Then put your DNS server into Logging level 1 using:
kill -USR1 `cat /var/named/named.pid`

Hope this helps,

--
--Gareth Bromley
Managing Director, Int* Consulting Ltd



-- Binary/unsupported file stripped by Listar --
-- Type: text/x-vcard
-- File: gbromley.vcf
-- Desc: Card for Gareth Bromley