Re: [squid-users] 3.4.0.1 dnsreq statistics question

From: Ralf Hildebrandt <Ralf.Hildebrandt_at_charite.de>
Date: Wed, 31 Jul 2013 14:56:37 +0200

* Ralf Hildebrandt <Ralf.Hildebrandt_at_charite.de>:

> Nameservers:
> IP ADDRESS # QUERIES # REPLIES Type
> ---------------------------------------------- --------- --------- --------
> 224.0.0.251 122256 0 multicast

Huh? The numbers account for what I'm seeing in my graphs.
And indeed, I'm seeing queries on the net:

% tcpdump -i eth1 host 224.0.0.251
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes

14:41:00.546196 IP proxy-cvk-2-e.charite.de.49093 > 224.0.0.251.mdns: 44683+ PTR (QM)? 234.129.89.95.in-addr.arpa. (44)
14:41:00.546796 IP proxy-cvk-2-e.charite.de.49093 > 224.0.0.251.mdns: 15065+ PTR (QM)? 234.129.89.95.in-addr.arpa. (44)
14:41:00.879966 IP proxy-cvk-1-e.charite.de.50277 > 224.0.0.251.mdns: 38706+ PTR (QM)? 139.203.238.77.in-addr.arpa. (45)
14:41:00.880286 IP proxy-cvk-1-e.charite.de.50277 > 224.0.0.251.mdns: 3929+ PTR (QM)? 139.203.238.77.in-addr.arpa. (45)

So what we are seeing here are two proxies querying IP addresses
(client IP addresses?) using mDNS. But why?

I don't have avahi running at all.

proxy-cvk-1-e.charite.de.50277 points to squid:

# netstat -tulpen |grep 50277
udp 0 0 0.0.0.0:50277 0.0.0.0:* 13 1393747784 7832/squid

According to the release notes:

There is no additional or special configuration required. The
multicast DNS group IP addresses for IPv4 and IPv6 resolving are added
to the set of available DNS resolvers and used automatically for
domain names ending in .local before attempting a secondary resolution
on the configured resolvers. Domains without .local are resolved using
only the configured DNS resolvers.

Hm, so everything is working as expected. Can it be turned off? 

-- 
Ralf Hildebrandt                   Charite Universitätsmedizin Berlin
ralf.hildebrandt_at_charite.de        Campus Benjamin Franklin
http://www.charite.de              Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155
Received on Wed Jul 31 2013 - 12:56:46 MDT

This archive was generated by hypermail 2.2.0 : Wed Jul 31 2013 - 12:00:05 MDT