1

I run a PiHole dns server, I keep seeing mass dns requests for the domain mariadb from my Ubuntu Server. About 50,000 a day, 3 A and 3 AAAA every 10 seconds. I can't seem to find a way to identify the program that is sending them. I've tried setting the entry manually to a non existant ip in /etc/hosts and that stopped the requests for a while but then they came back and there was still no way to identify what program was sending them. Looking for a way to identify the program doing this. I've checked configs and temporarily stopped almost every program I can think of and the requests have continued.

UPDATE: These dns requests are showing up in my dns query log on my pihole and occasionally overloading it. This is why I thought pihole relevant, pihole is running on a different machine, and this machine is not running anything to do with dns except the "systemd-resolved stub resolver". Mariadb is running on the server in a docker container for bookstack (Also dockerized), mysql is running on the server (not in docker) for several wordpress sites but there is no configuration in any of these services that should be causing them to lookup the "mariadb" domain. PHP7.4.9 is installed as required for the wordpress sites.

1
  • What DNS requests? Is this server a DNS server? Is it running PHP alongside MariaDB? Are you running MariaDB on your system? We need more information, and if your system has some type of update checker running on the system, chances are the system or applications are checking for updates. PiHole DNS server is also offtopic here, by the way.
    – Thomas Ward
    Aug 16, 2020 at 1:47

1 Answer 1

0

on your DNS server, as root you can use tcpdump to see the actual traffic, and identify the source IPs from which you receive the requests. Something like:

tcpdump -vvnn tcp port 53 or udp port 53

should show a great deal of output, so you can save this output to a file, and attach part of it here, if you cannot recognize the source IPs..

15
  • Thank you for the suggestion, but I actually know from the logs that the queries are coming from my Ubuntu Server already, just not sure what program is doing it.
    – Jacob
    Aug 16, 2020 at 2:27
  • You are DoS-ing yourself? netstat -tanp|grep :53 should give you pointers on which PID from your localhost/127.0.0.1 is generating requests towards the local DNS server.
    – Ron
    Aug 16, 2020 at 2:30
  • Essentially yes that is what's happening. Unfortunately the only response from that is tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 882/systemd-resolve I believe this is because of the systemd dns resolver. I've tried to override that and go direct to the main dns, I've managed to add my dns to the resolv.conf file without it being overwritten but 127.0.0.53 still takes precedence even being 2nd.
    – Jacob
    Aug 16, 2020 at 2:38
  • 1
    you may want to, to @ron's netstat parameters, add a "u" udp (or remove the t) and add a "c" for continuous to monitor constantly monitor
    – WU-TANG
    Aug 16, 2020 at 10:29
  • @WU-TANG yes, thank you, I forgot the -u for utp. Good catch.
    – Ron
    Aug 16, 2020 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .