My Linux system is doing a lot of DNS queries to 73.207.210.75.in-addr.arpa but I don't know of any reason it should be doing this. What is at in-addr.arpa?
Any reason why these queries are occurring?
1 Answer
This is a totally normal PTR lookup for the IPv4 address 75.210.207.73 (which is the reverse of how it appears in your logs).
Its purpose is to resolve the IP into a name, if a PTR record was registered. This is the inverse of the usual name lookup which looks up a name in order to retrieve the IP address.
answered Jun 9, 2014 at 0:50
-
-
-
Nethogs is showing this program as the sole network user "75.210.96.239:3389-84.232.246.36:4790". How do I figure out exactly what is making the connections? I don't recognize those IPs or ports.– VirgilJun 9, 2014 at 17:06
-
1I found out that running a "route" command from my code was triggering the PTR lookup. Changed it to "route -n" and the lookup no longer occurs. Thanks guys.– VirgilJun 10, 2014 at 3:56
-
1@Virgil - ha, there you go. Good sleuthing! I'd write that up as the solution to your problem, if you wouldn't mind. Others might benefit from this in the future 8-)– slm ♦Jun 10, 2014 at 6:53
netstat -anshow any on this IP?nethogsto see what applications are using the network. You could attack this that way. Also you could useiptrafto see what's accessing the network via that IP.