DNS something is wrong?

Posted by Nickolas R. on Server Fault See other posts from Server Fault or by Nickolas R.
Published on 2010-03-14T21:47:42Z Indexed on 2010/03/14 21:55 UTC
Read the original article Hit count: 406

Filed under:
|

Hello

I am configuring bind9 on a server with two network interfaces, one is connected to the LAN and the other is connected to the Internet through NAT so bind is not faced directly to the Internet. Everything seems to work fine, clients can do both forward and reverse lookups but somethings seems strange.

On the server if i try to ping www.google.com one time, a great amount of network activity is genereated, alot more that one would expect so i decided to sniff the traffic with tcpdump. When loading the dump into Wireshark i can see about 250 entries with "Standard query A" and "Standard query response" Here a some of the entries from the dump

DNS Standard query A www.google.com
DNS Standard query A blackhole-1.iana.org
DNS Standard query A blackhole-2.iana.org
DNS Standard query response
DNS Standard query A ns2.isc-sns.com
DNS Standard query A ns1.isc-sns.net
DNS Standard query A ns3.isc-sns.info
DNS Standard query response PTR b.iana-servers.net RRSIG
DNS Standard query A auth2.dns.cogentco.com
DNS Standard query A ns1.crsnic.net
DNS Standard query A ns2.nsiregistry.net
DNS Standard query A ns3.verisign-grs.net
DNS Standard query A ns4.verisign-grs.net
DNS Standard query PTR 79.52.19.199.in-addr.arpa

I do not have too much experince with DNS yet, but i am pretty sure that something is wrong. Anybody that have an idea of whats is going on?

© Server Fault or respective owner

Related posts about bind9

Related posts about dns