My Linux system is doing a lot of DNS queries to 73.207.210.75.in-addr.arpa but I don't know of any reason it should be doing this. What is at in-addr.arpa?
Any reason why these queries are occurring?
This is a totally normal PTR lookup for the IPv4 address 75.210.207.73 (which is the reverse of how it appears in your logs).
Its purpose is to resolve the IP into a name, if a PTR record was registered. This is the inverse of the usual name lookup which looks up a name in order to retrieve the IP address.
answered Jun 9 '14 at 0:50
-
-
-
Nethogs is showing this program as the sole network user "75.210.96.239:3389-84.232.246.36:4790". How do I figure out exactly what is making the connections? I don't recognize those IPs or ports. – Virgil Jun 9 '14 at 17:06
-
1I found out that running a "route" command from my code was triggering the PTR lookup. Changed it to "route -n" and the lookup no longer occurs. Thanks guys. – Virgil Jun 10 '14 at 3:56
-
1@Virgil - ha, there you go. Good sleuthing! I'd write that up as the solution to your problem, if you wouldn't mind. Others might benefit from this in the future 8-) – slm♦ Jun 10 '14 at 6:53
netstat -anshow any on this IP? – slm♦ Jun 9 '14 at 1:47nethogsto see what applications are using the network. You could attack this that way. Also you could useiptrafto see what's accessing the network via that IP. – slm♦ Jun 9 '14 at 12:32