My Linux system is doing a lot of DNS queries to but I don't know of any reason it should be doing this. What is at in-addr.arpa?

Any reason why these queries are occurring?

  • 1
    This appears to be a comcast IP address. Since some process is querying for this via DNS, I would expect an outgoing connection as well. Does netstat -an show any on this IP? – slm Jun 9 '14 at 1:47
  • all my netstat -an tcp connections are on localhost. – Virgil Jun 9 '14 at 3:57
  • It may be a connection that's intermittent. You can use nethogs to see what applications are using the network. You could attack this that way. Also you could use iptraf to see what's accessing the network via that IP. – slm Jun 9 '14 at 12:32

This is a totally normal PTR lookup for the IPv4 address (which is the reverse of how it appears in your logs).

Its purpose is to resolve the IP into a name, if a PTR record was registered. This is the inverse of the usual name lookup which looks up a name in order to retrieve the IP address.

  • OK how do I work out what is making the queries? – Virgil Jun 9 '14 at 1:29
  • @user43995 - you can start with nethogs. – slm Jun 9 '14 at 12:34
  • Nethogs is showing this program as the sole network user "". How do I figure out exactly what is making the connections? I don't recognize those IPs or ports. – Virgil Jun 9 '14 at 17:06
  • 1
    I found out that running a "route" command from my code was triggering the PTR lookup. Changed it to "route -n" and the lookup no longer occurs. Thanks guys. – Virgil Jun 10 '14 at 3:56
  • 1
    @Virgil - ha, there you go. Good sleuthing! I'd write that up as the solution to your problem, if you wouldn't mind. Others might benefit from this in the future 8-) – slm Jun 10 '14 at 6:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.