Hi guys, I've got this bunch of DNS queries going from localhost to localhost, repeating about once or twice a minute.
22-Jun-2007 10:04:46.252 queries: info: client x.x.x.129#35318: query: www.example.com IN AAAA + 22-Jun-2007 10:04:46.253 queries: info: client x.x.x.129#35318: query: www.example.com IN A + 22-Jun-2007 10:04:46.309 queries: info: client x.x.x.129#35318: query: www.example.com IN AAAA + 22-Jun-2007 10:04:46.310 queries: info: client x.x.x.129#35318: query: www.example.com IN A + 22-Jun-2007 10:04:46.401 queries: info: client x.x.x.129#35318: query: www.example.com IN AAAA + 22-Jun-2007 10:04:46.401 queries: info: client x.x.x.129#35318: query: www.example.com IN A + 22-Jun-2007 10:04:46.456 queries: info: client x.x.x.129#35318: query: www.example.com IN AAAA + 22-Jun-2007 10:04:46.457 queries: info: client x.x.x.129#35318: query: www.example.com IN A + 22-Jun-2007 10:04:46.512 queries: info: client x.x.x.129#35318: query: www.example.com IN AAAA + 22-Jun-2007 10:04:46.512 queries: info: client x.x.x.129#35318: query: www.example.com IN A + www.example.com points to x.x.x.129 aka itself. This is coming from a Mandriva 2006 box running BIND 9.3.1. The source port number itself increments by one every now and then. I can't seem to figure out which process is at the port and sending these queries. Does this look typical of some other process, httpd, bind itself, etc? Thanks, -cflee _______________________________________________ Slugnet mailing list [email protected] http://www.lugs.org.sg/mailman/listinfo/slugnet
