bind and arp

[Tim Maestas]

	Your name server is doing reverse lookups because your packet
	sniffer (tcpdump?) is converting the IP's it's seeing on the
	wire to names.  If you are not running the sniffer, or if
	you tell it not to do name resolution (-n on tcpdump) you 
	probably will not see these lookups happening.

-Tim




On Fri, 10 Aug 2001, Joseph Fannin wrote:

> 
>     I upgraded to bind 9.1.3 from 9.1.0 today, and now I'm seeing a
> problem similar to the one Piet Pelz is describing in the thread
> 'named is causing severe traffic'.  For some reason, the named on my
> gateway machine is doing a reverse lookup for every arp
> broadcast it recieves from the entire cable modem network it's
> connected to.  None of these requests are even for my own IP; they
> usually originate from one of my ISP's machines are are inquiring
> about other addresses on the ISP's network:
> 
> 04:34:43.366891 arp who-has dhcp065-024-127-146.columbus.rr.com tell dhcp065-024-124-001.columbus.rr.com
> 04:34:43.426883 dhcp065-024-121-117.columbus.rr.com.1041 > clmboh1-dns3.columbus.rr.com.domain:  58012+ PTR? 146.127.24.65.in-addr.arpa. (44) (DF)
> 04:34:43.436881 clmboh1-dns3.columbus.rr.com.domain > dhcp065-024-121-117.columbus.rr.com.1041:  58012* 1/2/2 (179) (DF)
> 04:34:45.016662 arp who-has dhcp065-024-123-204.columbus.rr.com tell dhcp065-024-120-001.columbus.rr.com
> 04:34:45.056657 dhcp065-024-121-117.columbus.rr.com.1041 > clmboh1-dns3.columbus.rr.com.domain:  29006+ PTR? 204.123.24.65.in-addr.arpa. (44) (DF)
> 04:34:45.066655 clmboh1-dns3.columbus.rr.com.domain > dhcp065-024-121-117.columbus.rr.com.1041:  29006* 1/2/2 (179) (DF)
> 
>     Could this be a glitch in my configuration somehow?  I haven't read
> anything involving configuring bind and arp.
> 
> --
> Joseph Fannin
> jhf at rivenstone.net
> 
> "Bull in pure form is rare; there is usually some contamination by data."
>     -- William Graves Perry Jr.
> 
> 
>