Desktop sends packet to the dns server when connecting to a seperate desktop via ssh

Alpha90 · 10-21-2013, 01:13 AM

I was doing some network auditing looking for security holes and doing other various maintenance when I needed to access another system via ssh. I had running at the time capturing all the packets my system sent out and I noticed something odd. My desktop sends out a packet to the DNS server my isp uses. I do not understand why that would be needed at all since I used an ip address for ssh not a FQDN. Is this a security concern that I should be concerned about. I am using openssh V1.27.

ilesterg · 10-21-2013, 01:51 AM

Did you try to check the contents of the DNS packet? It might also be possible to know the purpose of the DNS session if you can trace the conversation (depends on the tool you use).

zhjim · 10-21-2013, 02:05 AM

I'd definitely see what host got resolved by that dns query. It might now even have anything to do with your ssh connection. Maybe ntp? Or a hourly cron script?

Also if the dns query came from the server you are connecting _to_ thats normal behaviour. SSH makes a reverse dns check to find out if the server is the one he says he is.