BIND and 127.0.0.1 clients - DNS

This is a discussion on BIND and 127.0.0.1 clients - DNS ; Can anyone shed some light on why I am seeing occasional lookups like these? (the key is the client is 127.0.0.1 - localhost) 27-Sep-2008 5:56:55.851 client 127.0.0.1#3068: query: 1.0.0.127.in- addr.arpa IN PTR + 27-Sep-2008 5:56:55.851 client 127.0.0.1#3069: query: gmx.us IN ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: BIND and 127.0.0.1 clients

  1. BIND and 127.0.0.1 clients

    Can anyone shed some light on why I am seeing occasional lookups like
    these? (the key is the client is 127.0.0.1 - localhost)

    27-Sep-2008 5:56:55.851 client 127.0.0.1#3068: query: 1.0.0.127.in-
    addr.arpa IN PTR +
    27-Sep-2008 5:56:55.851 client 127.0.0.1#3069: query: gmx.us IN A +
    27-Sep-2008 5:56:56.242 client 127.0.0.1#3070: query: 1.0.0.127.in-
    addr.arpa IN PTR +
    27-Sep-2008 5:56:56.242 client 127.0.0.1#3071: query: gmx.us IN MX +

    AFAIAA I don't have any clients running on the box that would address the
    DNS server at a local host level - they are all seen connecting by their
    respective IP addresses. My googles on this, as you can imagine, have not
    given much use with a search string like '127.0.0.1' :-)

    It's a few every day, always the same lookups, differing times.

    --
    GIVE IT TO ME! I WANT YOUR SPAM! givemespam@wibblywobblyteapot.co.uk
    h o n e y p o t h o n e y p o t h o n e y p o t h o n e y p o t



  2. Re: BIND and 127.0.0.1 clients

    In article ,
    Klunk wrote:

    > Can anyone shed some light on why I am seeing occasional lookups like
    > these? (the key is the client is 127.0.0.1 - localhost)
    >
    > 27-Sep-2008 5:56:55.851 client 127.0.0.1#3068: query: 1.0.0.127.in-
    > addr.arpa IN PTR +
    > 27-Sep-2008 5:56:55.851 client 127.0.0.1#3069: query: gmx.us IN A +
    > 27-Sep-2008 5:56:56.242 client 127.0.0.1#3070: query: 1.0.0.127.in-
    > addr.arpa IN PTR +
    > 27-Sep-2008 5:56:56.242 client 127.0.0.1#3071: query: gmx.us IN MX +
    >
    > AFAIAA I don't have any clients running on the box that would address the
    > DNS server at a local host level - they are all seen connecting by their
    > respective IP addresses. My googles on this, as you can imagine, have not
    > given much use with a search string like '127.0.0.1' :-)


    I assume that you don't have

    nameserver 127.0.0.1

    in the machine's /etc/resolv.conf.

    >
    > It's a few every day, always the same lookups, differing times.


    Maybe there's a shell script that does these lookups and has the server
    127.0.0.1 hard-coded into it.

    --
    Barry Margolin, barmar@alum.mit.edu
    Arlington, MA
    *** PLEASE don't copy me on replies, I'll read them in the group ***


  3. Re: BIND and 127.0.0.1 clients

    On Mon, Sep 29, 2008 at 01:42:30AM -0400, Barry Margolin wrote:
    > In article ,
    > Klunk wrote:
    >
    > > Can anyone shed some light on why I am seeing occasional lookups like
    > > these? (the key is the client is 127.0.0.1 - localhost)
    > >
    > > 27-Sep-2008 5:56:55.851 client 127.0.0.1#3068: query: 1.0.0.127.in-
    > > addr.arpa IN PTR +
    > > 27-Sep-2008 5:56:55.851 client 127.0.0.1#3069: query: gmx.us IN A +
    > > 27-Sep-2008 5:56:56.242 client 127.0.0.1#3070: query: 1.0.0.127.in-
    > > addr.arpa IN PTR +
    > > 27-Sep-2008 5:56:56.242 client 127.0.0.1#3071: query: gmx.us IN MX +
    > >
    > > AFAIAA I don't have any clients running on the box that would address the
    > > DNS server at a local host level - they are all seen connecting by their
    > > respective IP addresses. My googles on this, as you can imagine, have not
    > > given much use with a search string like '127.0.0.1' :-)

    >
    > I assume that you don't have
    >
    > nameserver 127.0.0.1
    >
    > in the machine's /etc/resolv.conf.
    >
    > >
    > > It's a few every day, always the same lookups, differing times.

    >
    > Maybe there's a shell script that does these lookups and has the server
    > 127.0.0.1 hard-coded into it.

    Or, you had 127.0.0.1 in resolv.conf at some point in the past (or
    didn't have a resolv.conf, which is equivalent). If there's an old
    process from that time, it won't reread resolv.conf, you have
    to restart it. Last I knew, glibc reads that information the first
    time it's needed, caches it, and never rereads the relevant files.

    Justin


+ Reply to Thread