Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently forwarded all my router logs to my Debian machine. I noticed a repeated entry in the router logs. The entry is:

Sep 14 17:07:29 [Host] UDP,38048 --> {ip_of_my_isp_dns_server},53 ALLOW: Outbound access request [DNS query for]

I have the following questions:

  1. Is that normal? Why is the Debian machine trying to resolve its own ip in dns?
  2. How can I figure out what application on my Debian machine sends these DNS requests?
share|improve this question
That log entry says that .2 is trying to reverse resolve .1, not itself. Just ping'ing the router would be enough to generate such requests. netstat -r or traceroute would do the same. – Kyle Jones Sep 14 '13 at 16:34
thanks. my mistake. Anyway is a gateway ip address. Why does Debian need to resolve it? – Druid Sep 14 '13 at 16:39
I think I found the answer. It is here. – Druid Sep 14 '13 at 17:28
@Druid could you post that information as an answer and accept it please? – terdon Sep 14 '13 at 17:31

Is that normal? Why is the Debian machine trying to resolve its own ip in dns?

Yes, those are reverse DNS lookups. Something on your machine is trying to resolve IPs to their respective hostnames. That is absolutely normal; almost all programs that display IPs do this (for example ping, route, netstat).

How can I figure out what application on my Debian machine sends these DNS requests?

I'm not really sure how one could do that. I wouldn't bother, because as I said, this is absolutely normal. Try the following commands to see the difference between resolving IPs and not resolving IPs; you will notice that the latter is much faster:

ping google.com
ping -n google.com
route -n
netstat -n
share|improve this answer
You are right. I just read netstat help more carefully and I found who did that. I ran netstat -u -a -n -W -c -p | grep and I found that rsyslog was doing that. But I still do not understand why Debian is trying to make a dns request instead of saying to a requested application that it requests a host ip – Druid Sep 14 '13 at 16:33
I made a mistake. Actually it tries to resolve not itself ip but gateway ip. But anyway it looks strange for me that Debian is trying to resolve gateway ip address in DNS. – Druid Sep 14 '13 at 16:42
As I said - many utilities try to resolve IPs to hostnames by default, just for convenience reasons. These utilities usually have a -n parameter that prevents this, which is useful when the DNS requests are causing the utility to slow down too much. If you are sure that it's caused by rsyslog - are you using network logging in some way? – Martin von Wittich Sep 14 '13 at 17:29
Yes. I found a solution. I put a link in a comment to my post. As you said rsyslog should be executed with -x option. – Druid Sep 14 '13 at 18:34
up vote 0 down vote accepted

I think this link is related. One of the solutions is to run rsyslogd daemon with -x parameter. rsyslog will stop doing dns lookups. But I suppose it is not suitable for all cases.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.