probleme DNS
Bonjour,
je suis (mon entrerpise) connecte a l'Internet via un routeur RNIS,
en connexion intermitente, mais avec une IP fixe.
Mon probleme:
une facture telephonique tres elevee, qui semble correspondre a des
requetes DNS. En effet ma passerelle fait office de serveur DNS pour
mon LAN.
toutes les 20 minutes j'ai ce genre requete dans mes logs:
20:51:02.863745 mailhost.1024 > E.ROOT-SERVERS.NET.domain: 14637 (34)
20:51:02.863870 mailhost.1024 > E.ROOT-SERVERS.NET.domain: 39198 (34)
20:51:03.153553 arp who-has mailhost (0:1:2:f6:21:a7) tell 192.168.1.1
20:51:03.153610 arp reply mailhost is-at 0:1:2:f6:21:a7
20:51:03.155552 E.ROOT-SERVERS.NET.domain > mailhost.1024: 14637-
0/12/12 (431) (DF)
20:51:03.211354 E.ROOT-SERVERS.NET.domain > mailhost.1024: 39198-
0/12/12 (431) (DF)
20:54:06.187054 mailhost.1024 > E.ROOT-SERVERS.NET.domain: 27449 (39)
20:54:06.420237 E.ROOT-SERVERS.NET.domain > mailhost.1024: 27449
NXDomain*- 0/1/0 (103) (DF)
20:54:11.180038 arp who-has 192.168.1.1 tell mailhost
20:54:11.182841 arp reply 192.168.1.1 is-at 0:90:f4:0:24:4a
20:55:18.956821 mailhost.1024 > E.ROOT-SERVERS.NET.domain: 34469 (34)
20:55:19.233525 E.ROOT-SERVERS.NET.domain > mailhost.1024: 34469-
0/12/12 (434) (DF)
20:55:19.234699 mailhost.1024 > c.gtld-servers.net.domain: 6208 (34)
20:55:19.409743 c.gtld-servers.net.domain > mailhost.1024: 6208- 0/2/2
(114)
20:55:19.410166 mailhost.1024 > m.gtld-servers.net.domain: 15790 (34)
20:55:19.410282 mailhost.1024 > m.gtld-servers.net.domain: 33822 (34)
20:55:19.410826 mailhost.1024 > ns.apnic.net.domain: 16490 (46)
20:55:19.825649 m.gtld-servers.net.domain > mailhost.1024: 15790- 1/3/3
(152)
20:55:19.848520 m.gtld-servers.net.domain > mailhost.1024: 33822- 1/3/3
(152)
20:55:19.935909 ns.apnic.net.domain > mailhost.1024: 16490- 0/2/0 (91)
20:55:19.936160 mailhost.1024 > k.gtld-servers.net.domain: 63719 (31)
20:55:19.936265 mailhost.1024 > k.gtld-servers.net.domain: 42224 (31)
20:55:19.954153 mailhost.1024 > ns4.fr.clara.net.domain: 63915 (34)
20:55:20.043304 k.gtld-servers.net.domain > mailhost.1024: 63719- 1/2/2
(111)
20:55:20.062362 k.gtld-servers.net.domain > mailhost.1024: 42224- 1/2/2
(111)
--
Fabrice Cartron
Reply to: