Fedora Linux keeps doing DNS requests to random sites

Question

I have Fedora 12 Linux on my laptop with all the latest security updates installed. But when I open wireshark and view only dns requests (by adding a dns filter), I notice that my laptop keeps doing dns requests to random sites. I have observed this even after closing all applications (browser, torrent clients etc.,)

Is this some kind of worm or virus? :( How do I find out which process is sending these DNS requests? Strangely enough, only some of the sites that are being queried for DNS are the ones I have visited. The other sites- I haven't even heard of them before..

Tried running lsof -nl | grep udp in a loop inside a script. This always results in no output.

Thanks,
-Keshav

Answer 1

The site's you don't think you visited could possibly just be nameservers of sites that you did. For example, Superuser is actually located in the http://www.peak.org datacenter on a VLAN. These mystery requests could also be services in the background such as your system querying the internet time server, rather than obvious programs like your torrent client.

Answer 2

Some notes.

1. All the names you refer in your comments appear to be
   things that would be either related to your browser or fedora update processes.
   • When you run wireshark from a silent Fedora installation,
     it would help to keep an open capture-filter to get all packets.
     This will tell you what happens with a site after the DNS lookup.
     That latter part will have really useful information.
     If there is malware involved, DNS lookup will be the least suspicious packets.
   • In general (and, I am probably sticking my neck out on this one),
     it is not likely you have a some form of root-kit hitting your Fedora,
     And, you should find reasonable answers based on the above two points.
     Then, it would be appropriate to,
   • remove the worm and virus tags from your question -- once you are confident this is not the case. At least consider clarifying your case-after-investigations in your question.
   • add notes in your question describing what exactly was happening on your Fedora

Updating with your results would help people reaching this question in future.

Answer 3

You can try to use ltrace to capture the DNS api such as gethostbyname(), getaddrinfo() of any running programs.

[root@fc8 tmp]# ltrace -e getaddrinfo -f -tt wget http://www.google.com
--07:30:31--  http://www.google.com/
           => `index.html'
Resolving www.google.com... 07:30:31.415398 getaddrinfo("www.google.com", NULL, 0xbfd5e120, 0xbfd5e154) = 0
72.14.213.106, 72.14.213.105, 72.14.213.103, ...
Connecting to www.google.com|72.14.213.106|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]

    [ <=>                                                     ] 5,640         --.--K/s

07:30:31 (216.90 KB/s) - `index.html' saved [5640]

You can attach the ltrace to running program with -p pid option.

If you are really in the CSI/Perry Mason/Sherlock Homes moods, you can try to write a shim library to globally replace the DNS APIs and log who and what everyone is doing. Use Modifying a Dynamic Library Without Changing the Source Code as an example.

Please let us know what you find.

Answer 4

Switch all your nameservers to OpenDNS (208.67.222.222 and 208.67.220.220) OR Google (8.8.8.8 and 8.8.4.4) because then you can be alerted if any of your request dns entries for known malware sites and phishing sites. I recommend OpenDNS over google because it has very fine grain control of categories of websites. You can block all dns queries to .ru and .cn but then whitelist legitimate ones.

netstat can tells you what are the current connections and the processes that have those connections open. memorize this command, t=tcp,u=udp,n=numerical,a=all, p=processes: netstat -tunap

Firewall activity: iptstate

host peak.org whois peak.org robtex.com is awesome for analyzing networks.