dns forum needed-or-some help

Hi there my dns server before respons to the request he searchs for a pc with ip address 192.168.64.254 . In my network nowhere exists such an ip. I think that the last ip address of a network by default is given to a dns server ..... so i was wondering why my dns server is searching for another den server? After a lot of arp messages my dns server replies to the client.

Do u know any forum for dns in order to ask some things?
Thx guys

The Networking forum is OK for your question.

There are many possible reasons and it's hard to answer without knowing more. Some ideas:
1) Check the DNS configuration (if you're using named look into named.conf and files mentioned inside). Maybe there's an old entry with such IP?

2) Maybe it's the client asking for the IP by mistake? Maybe the client is not configured properly? Maybe the IP was in use before?

3) Run tcpdump or a similar tool (I understand you have already done it) and see if the client asks about the IP. Does it?

1) Check the DNS configuration (if you're using named look into named.conf and files mentioned inside). Maybe there's an old entry with such IP?
Reply: I installed the named from the beggining. Nowhere tells something about this address.

2) Maybe it's the client asking for the IP by mistake? Maybe the client is not configured properly? Maybe the IP was in use before?
Reply: Never before, because i installed from the beggining my home network with its clients

3) Run tcpdump or a similar tool (I understand you have already done it) and see if the client asks about the IP. Does it?
Reply: I will do it when i ll go home. Till then i was wondering if i must search all the file for the ip 192.168.64.254 . If i ll find some, then i can probably find out the problem.
I was thinking that redhat 8.0 has by default some network files so it must be a malfuntion of the distribution... any other idea will real help

what kind of dns server u configured?
master or slave?

type master? Is that all?


//Startup file for bind 8 and later
// generated by named-bootconf.pl

options {
directory "/var/named";
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
// query-source address * port 53;
};

//
// a caching only nameserver config
//


zone "palaios.gr"{
type master;
file "db.palaios";
};
zone "64.168.192.in-addr.arpa" in {
type master;
file "db.192.168.64";
};
zone "0.0.127.in-addr.arpa" in {
type master;
file "db.127.0.0";
};
zone "." in {
type hint;
file "db.cache";
};


include "/etc/rndc.key";

Do u have something else to suggest?

The DNS configurations looks good.
If I remember correctly, x.x.x.254 may be a default choice for default gateway. Look how your 'route' result say. If there's the address somewhere, you probable need to change it. On the other way, it's rathere not the server, because I understand you have the Net access.

I highly recommend you to run tcpdump and find out which hosts starts using the strange IP.

Does that IP appear in your /etc/resolv.conf or /etc/hosts file? It might be trying host resolution prior to BIND.

try $ grep 192.168.64.254 /etc/*

first of all thx a lot about your interest. I found the /etc/sysconfig/network file which has a value 192.168.64.254. So i change this ip address to the machines ip. Is this right or what will the right be?

The problem has complettely transformed now . The dns no more asks about the 192.168.64.254. address but for a whole other completely wrong considering my network.
For example dns sends broadcast message for the following ips?
Who has the ip address 194.123.56.12
Who has the ip address 213.112.54.36
................................


What do u suggest?

I would suggest you to look resolv.conf. It must looks like

earch hostname.domain domain
nameserver 127.0.0.1
nameserver your_isp_1st_ip
nameserver your_isp_2nd_ip


also, don't forget to check host.conf (should be something like that):

order hosts, bind
multi on

Also, you must edit the name/reverse lookup that bind put in some place in your /var dir.

If you want an example, let me know.

Good luck

It sounds like something is not right with the routing. You should not be sending arp requests for non-local IPs. You should have a route for 192.168.64.0/24 as directly connected via one of your ethernet interfaces. Default (0.0.0.0/0) should point at your first hop towards the Internet (first hop after your external ethernet interface).

What's the output of netstat -nra
?

PS based on the problem you're having, I think the 192.168.64.254 address was probably listed as your "gateway" address. That's why it was trying to find that IP before and that's why it's now trying to send arp requests for non-local addresses. If your machine now thinks that it's own IP is the default gateway, it's going to treat any IP as directly connected. You should change that value in /etc/sysconfig/network to be whatever your default gateway is (the inside IP of your cable modem/DSL router, etc).

What do u mean by this
"Also, you must edit the name/reverse lookup that bind put in some place in your /var dir."?

I think i find out the solution

In the /etc/sysconfig/network

there was a field that has the value
GATEWAY=192.168.64.254
This was the reason why my dns was searching for a machine with this ip address

Firstly i changed it to this
GATEWAY=192.168.64.12(ip of the dns server) and my dns got mad searching for lot of different addresse

I changed it today to
GATEWAY=<blank>
And no more arp messages to my network......
Simple eh?
Thx
Plz keep answering as fas as i am going to learn

You need to fill the GATEWAY line with the right default gateway for your network. You should know it. If not, it should be in your other machines configuration. Usually it's IP of the router you have your Internet connection plugged into.

If you look your named.conf your will see the following zones:

zone "palaios.gr"{
type master;
file "db.palaios";
};

zone "64.168.192.in-addr.arpa" in {
type master;
file "db.192.168.64";
};

zone "0.0.127.in-addr.arpa" in {
type master;
file "db.127.0.0";
};

zone "." in {
type hint;
file "db.cache";
};

The first zone should be your domain zone, if you try to look for something like "mycomp.palaios.gr" the file "db.palaios" will be traversed so that the correct IP can be taken. It's a direct mapping.

The second one is searched when your try something like "ping 192.168.64.1" and will give to you the hostname.domain of the IP you gave. The file is "db.192.168.64" and in this case is a reverse mapping.

After that, is just your computer itself.

And the last one is searched when no other zone was defined. The db.cache has most common internet name/IPs.

I'm being a bit lax, but think you got the idea.

Thx. My network is a home small network with 3 pcs. No router is available. The dns server is not connected with the internet. So what i must enter for the gateway. I think that <blank> is the best choice. Isn't it?