Yeah... so something is horked with the dnsmasq instance on Minotaur. I think it's gone braindead.<div>It's firing off queries to refresh a root hints cache against its upstream resolvers, only it's doing so in a tight-ish (snug?) loop.</div>
<div><br></div><div>This capture ran for ~10 seconds:</div><div><br></div><div><div>`--> sudo tshark -ni eth0 -q -z conv,ip ip src 75.101.62.92 and udp port 53 or tcp port 53</div><div>Running as user "root" and group "root". This could be dangerous.</div>
<div>Capturing on eth0</div><div>^C2985 packets dropped</div><div>15706 packets captured</div><div>================================================================================</div><div>IPv4 Conversations</div><div>Filter:<No Filter></div>
<div> | <- | | -> | | Total |</div><div> | Frames Bytes | | Frames Bytes | | Frames Bytes |</div>
<div>75.101.62.92 <-> 4.2.2.2 0 0 7748 542360 7748 542360</div><div>75.101.62.92 <-> 8.8.8.8 0 0 7616 533120 7616 533120</div>
<div>77.98.80.86 <-> 75.101.62.92 342 516344 0 0 342 516344</div><div>================================================================================</div><div><br></div>
<div><br></div><div><br></div><div>I'm going to restart dnsmasq and setup resolver paths that take both Monkeybrains and Sonic.net.</div><div>However, I think we really ought to replace it with BIND or a more heavily battle-tested recurser. It's just too bad that nothing reads in shim entries in /etc/hosts as well as dnsmasq does.</div>
<div><br></div><div>Cheers,</div><div>jof</div><br><div class="gmail_quote">On Thu, Oct 4, 2012 at 11:02 AM, Jonathan Lassoff <span dir="ltr"><<a href="mailto:jof@thejof.com" target="_blank">jof@thejof.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Whoa.<div>Whatever started on the Sonic.net line last weekend is causing some minor congestion pretty regularly:</div><div>
<br></div><div><img src="cid:ii_13a2cef454e394bc" alt="Inline image 1"><div><div class="h5"><br><br><div class="gmail_quote">
On Thu, Oct 4, 2012 at 10:53 AM, Jonathan Lassoff <span dir="ltr"><<a href="mailto:jof@thejof.com" target="_blank">jof@thejof.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The bits, they are a' flowin'<div><br></div><div>Monkeybrains:</div><div><img src="cid:ii_13a2ce75636621df" alt="Inline image 1"></div><div><br></div><div>Sonic.net:</div><div><br></div><div><img src="cid:ii_13a2ce896d6c0912" alt="Inline image 2"></div>
<div><br></div><div><br></div><div>Strangely, something caused a failover onto Sonic.net, or there's a lot more traffic flowing as of last Saturday:</div><div><br></div><div><img src="cid:ii_13a2ce9104b03b9e" alt="Inline image 3"><br>
<br></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div>