Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I recently forwarded all my router logs to my Debian machine. I noticed a repeated entry in the router logs. The entry is:

Sep 14 17:07:29 192.168.0.1 [Host 192.168.0.1] UDP 192.168.0.2,38048 --> {ip_of_my_isp_dns_server},53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]

I have the following questions:

  1. Is that normal? Why is the Debian machine trying to resolve its own ip in dns?
  2. How can I figure out what application on my Debian machine sends these DNS requests?
share|improve this question
    
That log entry says that .2 is trying to reverse resolve .1, not itself. Just ping'ing the router would be enough to generate such requests. netstat -r or traceroute would do the same. –  Kyle Jones Sep 14 '13 at 16:34
    
thanks. my mistake. Anyway 192.168.0.1 is a gateway ip address. Why does Debian need to resolve it? –  Druid Sep 14 '13 at 16:39
    
I think I found the answer. It is here. –  Druid Sep 14 '13 at 17:28
    
@Druid could you post that information as an answer and accept it please? –  terdon Sep 14 '13 at 17:31
add comment

2 Answers 2

Is that normal? Why is the Debian machine trying to resolve its own ip in dns?

Yes, those are reverse DNS lookups. Something on your machine is trying to resolve IPs to their respective hostnames. That is absolutely normal; almost all programs that display IPs do this (for example ping, route, netstat).

How can I figure out what application on my Debian machine sends these DNS requests?

I'm not really sure how one could do that. I wouldn't bother, because as I said, this is absolutely normal. Try the following commands to see the difference between resolving IPs and not resolving IPs; you will notice that the latter is much faster:

ping google.com
ping -n google.com
route
route -n
netstat
netstat -n
share|improve this answer
    
You are right. I just read netstat help more carefully and I found who did that. I ran netstat -u -a -n -W -c -p | grep 89.101.160.5 and I found that rsyslog was doing that. But I still do not understand why Debian is trying to make a dns request instead of saying to a requested application that it requests a host ip –  Druid Sep 14 '13 at 16:33
    
I made a mistake. Actually it tries to resolve not itself ip but gateway ip. But anyway it looks strange for me that Debian is trying to resolve gateway ip address in DNS. –  Druid Sep 14 '13 at 16:42
    
As I said - many utilities try to resolve IPs to hostnames by default, just for convenience reasons. These utilities usually have a -n parameter that prevents this, which is useful when the DNS requests are causing the utility to slow down too much. If you are sure that it's caused by rsyslog - are you using network logging in some way? –  Martin von Wittich Sep 14 '13 at 17:29
    
Yes. I found a solution. I put a link in a comment to my post. As you said rsyslog should be executed with -x option. –  Druid Sep 14 '13 at 18:34
add comment
up vote 0 down vote accepted

I think this link is related. One of the solutions is to run rsyslogd daemon with -x parameter. rsyslog will stop doing dns lookups. But I suppose it is not suitable for all cases.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.