2

My Linux system is doing a lot of DNS queries to 73.207.210.75.in-addr.arpa but I don't know of any reason it should be doing this. What is at in-addr.arpa?

Any reason why these queries are occurring?

3
  • 1
    This appears to be a comcast IP address. Since some process is querying for this via DNS, I would expect an outgoing connection as well. Does netstat -an show any on this IP?
    – slm
    Jun 9, 2014 at 1:47
  • all my netstat -an tcp connections are on localhost.
    – Virgil
    Jun 9, 2014 at 3:57
  • It may be a connection that's intermittent. You can use nethogs to see what applications are using the network. You could attack this that way. Also you could use iptraf to see what's accessing the network via that IP.
    – slm
    Jun 9, 2014 at 12:32

1 Answer 1

3

This is a totally normal PTR lookup for the IPv4 address 75.210.207.73 (which is the reverse of how it appears in your logs).

Its purpose is to resolve the IP into a name, if a PTR record was registered. This is the inverse of the usual name lookup which looks up a name in order to retrieve the IP address.

5
  • OK how do I work out what is making the queries?
    – Virgil
    Jun 9, 2014 at 1:29
  • @user43995 - you can start with nethogs.
    – slm
    Jun 9, 2014 at 12:34
  • Nethogs is showing this program as the sole network user "75.210.96.239:3389-84.232.246.36:4790". How do I figure out exactly what is making the connections? I don't recognize those IPs or ports.
    – Virgil
    Jun 9, 2014 at 17:06
  • 1
    I found out that running a "route" command from my code was triggering the PTR lookup. Changed it to "route -n" and the lookup no longer occurs. Thanks guys.
    – Virgil
    Jun 10, 2014 at 3:56
  • 1
    @Virgil - ha, there you go. Good sleuthing! I'd write that up as the solution to your problem, if you wouldn't mind. Others might benefit from this in the future 8-)
    – slm
    Jun 10, 2014 at 6:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.