Why is LibreNMS making DNS requests in reverse of my local IP net which is 192.168.86.0/24. I am getting requests for x.86.168.192 and in the tens of thousands per day. I blocked them in PiHole and in my firewall.
I am getting DNS requests for IP’s as per the below:
[196.86.168.192.in-addr.arpa]
[1.86.168.192.in-addr.arpa]
[184.86.168.192.in-addr.arpa]
[252.86.168.192.in-addr.arpa]
[53.86.168.192.in-addr.arpa]
What is causing this?
You probably enabled discovery-protocols and it is trying to add your local network devices by hostname. If you don’t want that, just disable it, likely on a home network, there is not much reason to have it enabled.
Another option would be to add those devices to your LibreNMS instance, if they already exist, it won’t try to add them.
I turned of auto discovery and will see what happens as yes this is a home network.
What does not make sense is the IP’s in question are my Unifi AP’s. As an example, one of my AP’s is 192.168.86.196 yet a DNS request is for 196.86.168.192. Basically 1.2.3.4 is being queried as 4.3.2.1.
That is quite literally how in-addr.arpa reverse DNS resolution works: Reverse DNS lookup - Wikipedia
@rhinoau Thanks. I was not aware that in-addr.arpa did that. I learned something new.
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.