1

Situation

My box keeps sending reverse DNS queries about our LAN hosts. Obviously they all fail because they are private addresses.

Request

  • Source: 192.168.1.6
  • Destination: 192.168.1.1 (default gateway)
  • Query: Standard query 0x2515 PTR 5.1.168.192.in.addr.arpa

The queries extend to all hosts it finds on the 192.168.1.0/24 network, not only host 192.168.1.5 above.

Response

Standard query response 0x2515 No such name

Some Information

(I wanted to paste a screenshot of the pcap file packet capture, but I do not have enough reputations.)

  1. Output of uname -a:

    Linux backbox 3.13.0-44-generic #73-Ubuntu SMP Tue Dec 16 00:22:43 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

  2. I tried to look at sudo netstat -tunpl to see if the source ports would be listed there, but I believe because they are UDP, I was not fast enough to catch it on the terminal.

  3. I tried searching for a problem like this in DuckDuckGo, but I believe because English is my second language, I might be missing some search terms.

  4. The box is a BackBox distribution. Interestingly I have another box, built from the same BackBox ISO file, but that other box does not behave in the same manner as to perform failed reverse DNS look-ups of our LAN hosts.

Questions:

  1. Why is this happening?
  2. How could I find out what is causing the queries?
  3. How to stop it?

If anyone could be kind enough to provide a pointer, I shall be very grateful, and reckon I should be able to take from there.

Community
  • 1
Arkanoid
  • 111
  • Note that private addresses failing a reverse DNS lookup is not a given. We have PTR records hosted internally for a majority of our private IPs, even the ones handed out via DHCP, since it is possible to dynamically update PTR records (as well as A records). – Todd Wilcox Jun 23 '15 at 12:53
  • 1
    The source ports for these DNS queries vary - Of course it does. 1.Why is this happening? - My guess, based on the fact that the machine is running BackBox, is that it's using rDNS queries as part of it's Intelligence Gathering process. – joeqwerty Jun 23 '15 at 13:47
  • @joeqwerty - it might the IG process, but I wonder why the other machine I have, which built from the exact same source does not do this. – Arkanoid Jun 23 '15 at 17:57

0 Answers0