udp sockets of dns requests not showing anywhere...
Dear guys,
I am facing the most weird problem I have ever encountered!
Ok here is the situation:
From my dns query.log file - it is generated using usual bind9 logging: logging {
channel query.log {
file "/var/log/bind9/query.log" versions 10 size 2m;
severity debug 2;
print-time yes;
};
category queries { query.log; };
};
I get many requests from localhost (like the following): 11-Nov-2008 12:27:01.010 client 127.0.0.1#45976: query: cyberfortress.com IN AAAA +
11-Nov-2008 12:27:01.010 client 127.0.0.1#57628: query: cyberfortress.com.smart-vision.eu IN AAAA +
11-Nov-2008 12:27:01.011 client 127.0.0.1#39766: query: cyberfortress.com IN A +
11-Nov-2008 12:27:01.055 client 127.0.0.1#58181: query: a094.server.lu IN A +
(domain cyberfortress.com is hosted on the same machine).
I tried to find where these requests are coming from. So using tcpdump:
I get many packets: 21:25:02.000103 IP (tos 0x0, ttl 64, id 41188, offset 0, flags [DF], proto: UDP (17), length: 63) 127.0.0.1.54038 > 127.0.0.1.53: [bad udp cksum 400e!] 58884+ AAAA? cyberfortress.com. (35)
21:25:02.000412 IP (tos 0x0, ttl 64, id 41188, offset 0, flags [DF], proto: UDP (17), length: 79) 127.0.0.1.54188 > 127.0.0.1.53: [bad udp cksum 3a21!] 4651+ AAAA? cyberfortress.com.smart-vision.eu. (51)
21:25:02.000542 IP (tos 0x0, ttl 64, id 41188, offset 0, flags [DF], proto: UDP (17), length: 63) 127.0.0.1.56204 > 127.0.0.1.53: [bad udp cksum def1!] 5360+ A? cyberfortress.com. (35)
The actual question is which processes are sending these packets.
I tried using lsof, netstat, fuser even a perl program called socklist.pl, which I modified to print only udp sockets and run into a while (1) loop but the above sockets (54038, 54188, 56204 etc...) cannot be seen anywhere !!! [Could it be because they are so short-lived ???]
I am running a grsec-enabled 2.6 kernel in a debian etch system.
Do you have any ideas what is happening and how to pinpoint there processes that generate these packets ???
It is very important for me. I could possible give some money to a really good solution.
Hi,
We have built a new server (RHEL VM)and added that IP/hostname into dns zone configs file on DNS server (Solaris 10). Reloaded the configuration using
and added nameserver into resolv.conf on client. But when I am trying nslookup, its not getting resolved. The nameserver is not able to... (8 Replies)
Hi,
I have a Solaris 10 system, which appears to be sending out LDAP queries to a server that is due to be decomissioned.
Is there a way to identify which process is sending out these queries? The problem is that the local port constantly changes, and the connections do not stay open long... (3 Replies)
I am trying to setup a CentOS 6.2 server that will be doing 3 things DHCP, DNS & Samba for a very small office (2 users). The idea being this will replace a very old Win2k server. The users are all windows based clients so only the server will be Linux based.
I've installed CentOS 6.2 with... (4 Replies)
Hi All
I have a blade BL860c running on a C7000 chassis, in which is connected to a NetApp, so lately I am having I/O issues, and dmesg as well as syslog.log is reporting the following:
/dev/vg01/lvol2 file system file data error in dev/block 0/55892768
Page I/O error occurred while paging... (2 Replies)
Hi,
I have a question on how to point the DNS server-1's A-record to second DNS server, which is DNS server-2. So, the computer can access other domain which only listed in the DNS server-2. The scenario is as follow:
http://img689.imageshack.us/img689/6333/12234.png
How to configure this... (4 Replies)
Yes, I guess that is what it is sort of meant to do but it is sort of a problem.
Scenario:
Server is running and is blocked at ACCEPT
Client A connects with server
Server returns from ACCEPT and moves to RECV call waiting for incoming string
Client... (4 Replies)
I'd like to get some opnions on choosing DNS server:
Windows DNS vs Linux BIND comparrsion:
1) managment, easy of use
2) Security
3) features
4) peformance
5) ??
I personally prefer Windows DNS server for management, it supports GUI and command line. But I am not sure about security... (2 Replies)
hey guys, how to add soalris box as a microsoft DNS Client ?
and how to register in the microsoft DNS ??
i managed to query from the DNS server after adding /etc/resolve.conf and editing /etc/nsswitch.conf
but i need to register the soalris server (dns Client) into Microsoft DNS automatically.... (3 Replies)
hi...
i have made this client server prog with UDP sockets but im not getting the output. the client sends the message but the server just keeps on waiting. Im running the prog an a solaris 10 box...
server:
main()
{
int sd;
struct sockaddr_in server;
char buf;
int rc,len;
... (2 Replies)