udp sockets of dns requests not showing anywhere...


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users udp sockets of dns requests not showing anywhere...
# 1  
Old 11-11-2008
udp sockets of dns requests not showing anywhere...

Dear guys,

I am facing the most weird problem I have ever encountered!
Ok here is the situation:
From my dns query.log file - it is generated using usual bind9 logging:
logging {
channel query.log {
file "/var/log/bind9/query.log" versions 10 size 2m;
severity debug 2;
print-time yes;
};

category queries { query.log; };
};

I get many requests from localhost (like the following):
11-Nov-2008 12:27:01.010 client 127.0.0.1#45976: query: cyberfortress.com IN AAAA +
11-Nov-2008 12:27:01.010 client 127.0.0.1#57628: query: cyberfortress.com.smart-vision.eu IN AAAA +
11-Nov-2008 12:27:01.011 client 127.0.0.1#39766: query: cyberfortress.com IN A +
11-Nov-2008 12:27:01.055 client 127.0.0.1#58181: query: a094.server.lu IN A +

(domain cyberfortress.com is hosted on the same machine).
I tried to find where these requests are coming from. So using tcpdump:
Code:
tcpdump -vvv -n -i lo src host 127.0.0.1 and dst port 53

I get many packets:
21:25:02.000103 IP (tos 0x0, ttl 64, id 41188, offset 0, flags [DF], proto: UDP (17), length: 63) 127.0.0.1.54038 > 127.0.0.1.53: [bad udp cksum 400e!] 58884+ AAAA? cyberfortress.com. (35)
21:25:02.000412 IP (tos 0x0, ttl 64, id 41188, offset 0, flags [DF], proto: UDP (17), length: 79) 127.0.0.1.54188 > 127.0.0.1.53: [bad udp cksum 3a21!] 4651+ AAAA? cyberfortress.com.smart-vision.eu. (51)
21:25:02.000542 IP (tos 0x0, ttl 64, id 41188, offset 0, flags [DF], proto: UDP (17), length: 63) 127.0.0.1.56204 > 127.0.0.1.53: [bad udp cksum def1!] 5360+ A? cyberfortress.com. (35)


The actual question is which processes are sending these packets.
I tried using lsof, netstat, fuser even a perl program called socklist.pl, which I modified to print only udp sockets and run into a while (1) loop but the above sockets (54038, 54188, 56204 etc...) cannot be seen anywhere !!! [Could it be because they are so short-lived ???]
I am running a grsec-enabled 2.6 kernel in a debian etch system.

Do you have any ideas what is happening and how to pinpoint there processes that generate these packets ???

It is very important for me. I could possible give some money to a really good solution.

Thanks to all for your time
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

DNS client added to DNS server but not working

Hi, We have built a new server (RHEL VM)and added that IP/hostname into dns zone configs file on DNS server (Solaris 10). Reloaded the configuration using and added nameserver into resolv.conf on client. But when I am trying nslookup, its not getting resolved. The nameserver is not able to... (8 Replies)
Discussion started by: snchaudhari2
8 Replies

2. Solaris

Identify process sending ldap requests to old DNS server

Hi, I have a Solaris 10 system, which appears to be sending out LDAP queries to a server that is due to be decomissioned. Is there a way to identify which process is sending out these queries? The problem is that the local port constantly changes, and the connections do not stay open long... (3 Replies)
Discussion started by: badoshi
3 Replies

3. IP Networking

DNS requests through SSH/443

Anybody know how to force all DNS requests through port 443 or an SSH tunnel such as Putty in Ubuntu 10.4? (2 Replies)
Discussion started by: 3therk1ll
2 Replies

4. Red Hat

DHCP & DNS - Clients get IP but don't register in DNS

I am trying to setup a CentOS 6.2 server that will be doing 3 things DHCP, DNS & Samba for a very small office (2 users). The idea being this will replace a very old Win2k server. The users are all windows based clients so only the server will be Linux based. I've installed CentOS 6.2 with... (4 Replies)
Discussion started by: FireBIade
4 Replies

5. HP-UX

Some I/O requests to this LV are waiting

Hi All I have a blade BL860c running on a C7000 chassis, in which is connected to a NetApp, so lately I am having I/O issues, and dmesg as well as syslog.log is reporting the following: /dev/vg01/lvol2 file system file data error in dev/block 0/55892768 Page I/O error occurred while paging... (2 Replies)
Discussion started by: fretagi
2 Replies

6. Red Hat

DNS A-Record point to another DNS

Hi, I have a question on how to point the DNS server-1's A-record to second DNS server, which is DNS server-2. So, the computer can access other domain which only listed in the DNS server-2. The scenario is as follow: http://img689.imageshack.us/img689/6333/12234.png How to configure this... (4 Replies)
Discussion started by: Paris Heng
4 Replies

7. Programming

Accept (sockets) queuing up connection requests

Yes, I guess that is what it is sort of meant to do but it is sort of a problem. Scenario: Server is running and is blocked at ACCEPT Client A connects with server Server returns from ACCEPT and moves to RECV call waiting for incoming string Client... (4 Replies)
Discussion started by: Kam5FCC
4 Replies

8. UNIX for Advanced & Expert Users

DNS server choice: Windows DNS vs Linux BIND

I'd like to get some opnions on choosing DNS server: Windows DNS vs Linux BIND comparrsion: 1) managment, easy of use 2) Security 3) features 4) peformance 5) ?? I personally prefer Windows DNS server for management, it supports GUI and command line. But I am not sure about security... (2 Replies)
Discussion started by: honglus
2 Replies

9. Solaris

Solaris DNS Client For Microsoft DNS Server

hey guys, how to add soalris box as a microsoft DNS Client ? and how to register in the microsoft DNS ?? i managed to query from the DNS server after adding /etc/resolve.conf and editing /etc/nsswitch.conf but i need to register the soalris server (dns Client) into Microsoft DNS automatically.... (3 Replies)
Discussion started by: mduweik
3 Replies

10. IP Networking

UDP sockets

hi... i have made this client server prog with UDP sockets but im not getting the output. the client sends the message but the server just keeps on waiting. Im running the prog an a solaris 10 box... server: main() { int sd; struct sockaddr_in server; char buf; int rc,len; ... (2 Replies)
Discussion started by: strider
2 Replies
Login or Register to Ask a Question