E
Eric Zierke
I am working with a pair of DNS servers that are both periodically making
thousands of queries per minute to another name server to find the address
of a third name server. I have turned on all logging except full packets
and have caught the start of several of these bursts. I do not find an
initial query received that this name server would be authoritative for. It
always starts with sending a query and never sends a response back to
anywhere.
Both servers use root hints to resolve external name requests (why we aren't
using our ISPs DNS servers is a long story for another time...). There are
several subjects of the queries although it will usually concentrate on one
occassionally doing two or more concurrently. One example is a query to
4.2.49.2 to resolve ns1.mmc.com. It seems all but one of the subjects only
return partial answers. They respond with the name, but not an address (try
it, you'll see what I mean). If I clear the cache and do an nslookup for
ns1.mmc.com myself, in the logs I see the server query a root server, work
its way to 4.2.49.2 where it queries for ns1.mmc.com and returns the partial
answer to me. It does not continue trying except that my client will ask a
second time. When the server does it by itself, it keeps trying for several
minutes to hours and then suddenly stops.
I'm thinking some process on the server is initiating the query although
that would usually still result in a log entry showing the query received
from itself. How can I determine which process is doing this? Any other
ideas on why they might go nuts like this?
Both servers scan clean with TrendMicro. They are both also domain
controllers with little else on them.
Thanks in advance for you help.
Eric Z.
thousands of queries per minute to another name server to find the address
of a third name server. I have turned on all logging except full packets
and have caught the start of several of these bursts. I do not find an
initial query received that this name server would be authoritative for. It
always starts with sending a query and never sends a response back to
anywhere.
Both servers use root hints to resolve external name requests (why we aren't
using our ISPs DNS servers is a long story for another time...). There are
several subjects of the queries although it will usually concentrate on one
occassionally doing two or more concurrently. One example is a query to
4.2.49.2 to resolve ns1.mmc.com. It seems all but one of the subjects only
return partial answers. They respond with the name, but not an address (try
it, you'll see what I mean). If I clear the cache and do an nslookup for
ns1.mmc.com myself, in the logs I see the server query a root server, work
its way to 4.2.49.2 where it queries for ns1.mmc.com and returns the partial
answer to me. It does not continue trying except that my client will ask a
second time. When the server does it by itself, it keeps trying for several
minutes to hours and then suddenly stops.
I'm thinking some process on the server is initiating the query although
that would usually still result in a log entry showing the query received
from itself. How can I determine which process is doing this? Any other
ideas on why they might go nuts like this?
Both servers scan clean with TrendMicro. They are both also domain
controllers with little else on them.
Thanks in advance for you help.
Eric Z.