Arch Linux

fatjake

Member

Registered: 2010-04-26

Posts: 45

[Solved] Strange reverse DNS requests and lost network connectivity

I have been trying to resolve an intermittent connectivity problem, and ran into something that may or may not be related. Either way, it is strange.

Background:
-When the internet stops working I cannot ping local router, nor internet sites. Problem resolves on own within 30 seconds, but can happen again a few minutes later. At times it will work fine for hours. -Other computers on network do not see the problem.
-Running Arch x86_64
-Have two network cards, tried both Vitesse VSC8201 Gigabit and Marvell 88E8001 Gigabit with same results
-Problem does not exist in Windows on this machine.

I ran Wireshark to see if I could figure out what was going on, and the only thing that stands out is that I have a very large number of DNS requests to the router for addresses that I believe are special or reserved. These requests happen over and over in chunks of about 100 times.

For example my pc will send:
192.168.1.3 to 192.168.1.1        Standard query PTR 240.13.240.72.in-addr.arpa

Router replies back
192.168.1.1 to 192.168.1.3        Standard query response, No such name

From my understanding, 240.X.X.X is reserved and not a valid internet IP address. There are similar requests for other reserved IP addresses, although I no longer have records of them. These odd dns requests seem to happen roughly around the times that I have connection problems. What could this be?

Edit: Another burst of these requests just went out and sure enough my network connection became unresponsive right after. The addresses that it requested reverse DNS lookups on were:
234.13.240.72
235.13.240.72
242.13.240.72

Last edited by fatjake (2011-04-09 20:31:07)

brebs

Member

Registered: 2007-04-03

Posts: 3,742

Re: [Solved] Strange reverse DNS requests and lost network connectivity

So figure out which app is causing those DNS requests.

I recommend running the BIND server (as I do), so as not to rely on the ISP's nameservers, which are usually crappy in my experience. If that's too bloaty for ya, then I suppose unbound would be the next choice.

"30 seconds" sounds like your router is rebooting. Check for a firmware upgrade being available for your router.

fatjake

Member

Registered: 2010-04-26

Posts: 45

Re: [Solved] Strange reverse DNS requests and lost network connectivity

I would like to find out which program is causing this, and I somewhat expect Firefox (plus extensions), but I don't have time to just sit here and try this and that and wait. Is there a very direct way to see which program a certain request originates from?

Also, I do normally use non-ISP DNS, typically I run a benchmark of various DNS sources and go from there (although now I am using the ISP's DNS). I'll try that first before posting again, but really either way that still means I am making hundreds of non-essential dns requests per minute (at times). I would like to prevent that if possible, it can only cause problems. When I see these kinds of illogical dns requests I just cant explain it and think malicious software or bugs.

fatjake

Member

Registered: 2010-04-26

Posts: 45

Re: [Solved] Strange reverse DNS requests and lost network connectivity

In an "aha!" moment I figured out what was causing this problem, although I still do not understand exactly why.

I run Conky, periodically Conky executes a script that retrieves an rss feed, trims it down, and displays it on my desktop. I disabled this script the problem went away. I'll look into it later to figure out exactly what was going on. The offending script is posted below:

# Usage Example
# ${execi 300 /home/youruser/scripts/conky-rss.sh}

#RSS Setup
URI=http://whateverrssfeed.goatse.cx/rss/news.xml #URI of RSS Feed
LINES=10 #Number of headlines

#Environment Setup
EXEC="/usr/bin/curl -s" #Path to curl

#Work Start
$EXEC $URI | grep title |\
sed -e :a -e 's/<[^>]*>//g;/</N' |\
sed -e 's/[ \t]*//' |\
sed -e 's/\(.*\)/ \1/' |\
sed -e 's/\.//' |\
sed -e 's/\"//' |\
sed -e 's/\"//' |\
head -n $(($LINES + 2)) |\
tail -n $(($LINES))

Last edited by fatjake (2011-04-08 17:55:43)

fatjake

Member

Registered: 2010-04-26

Posts: 45

Re: [Solved] Strange reverse DNS requests and lost network connectivity

Actually, that did not resolve the problem. It just happened again, and Wireshark showed the DNS requests as before. I am not certain which process is generating these requests, as now I have seen it happen without Firefox being open, when I was using Midori instead. Perhaps it is not originating from the browsers, but I did not notice it without a browser window being open.

Last edited by fatjake (2011-04-08 21:53:50)

fatjake

Member

Registered: 2010-04-26

Posts: 45

Re: [Solved] Strange reverse DNS requests and lost network connectivity

Confirmed for certain that this still happens when running Firefox (Namoroka) with all addons disabled. Trying to now confirm for sure if this can happen without Firefox running.

fatjake

Member

Registered: 2010-04-26

Posts: 45

Re: [Solved] Strange reverse DNS requests and lost network connectivity

This started to make more sense once I figured out that the address in a PTR is presented with the octets in reverse order. For example, 240.13.240.72 is actually 72.13.240.72.

Those addresses belong to my ISP, although I am still unsure what the requests are for I am closing this thread.

Edit: The PTR requests were placed on IP addresses that belong to my ISP's DNS servers. I don't know why my computer would want the hostname of the servers, or why these requests seem to show up around the time that my router becomes unresponsive (router bug I suppose). It doesn't matter any longer, I did as the #2 poster brebs suggested and setup Bind and configured forwarders to 3 DNS servers that had low response times better than or near my ISP's DNS. Ever since the changes I have not seen any of the busts of PRT record requests, and my network connectivity is great. I am still a relative noob when it comes to networking, I apologize for making this thread without a true understanding of PRT records.

Last edited by fatjake (2011-04-11 03:06:45)