[Solved] Source of DNS query?

With Wireshark I see that HE issues DNS queries for my automation server pretty regularly every 30 seconds and this should not ever happen because I've put IP addresses, and not host names, into every field that needs it. I first thought that it might be the MQTT app but I checked it, and all apps. Any idea what might be making these queries?

What exactly is your "automation server" hosting, and how is HE configured to interact with it?

It is a full-size tower with an ATX Core i7 with 6GB RAM and raid1 hard disks that runs docker images of influxdb, node-red, zwavejs2mqtt, and uptime-kuma. It also runs mosquitto on bare metal.

In addition to the mqtt app on HE, which is configured to use mosquitto (above), node-red has Node-RED nodes for hubitat installed.

Are these true DNS queries or might they be mDNS queries? If the latter, you might be able to drastically reduce the frequency of those queries by disabling the periodic Bonjour refreshing in the HE hub’s Network settings page.

5 Likes

sounds like mdns queries

I appreciate the advice but...

image

2 Likes

Yep, that looks like traditional DNS traffic to me. Looks like you might be running multiple VLANs? No idea why that might make a difference, just an observation. Often, multiple VLANs can create additional complexity that can result in 'fun' troubleshooting. I am not recommending you change anything, just an observation. :thinking:

1 Like

If I'm understanding the setup correctly, there should only be two possible answers:

  1. There is something set up on the hub with a name rather than an IP that you've missed.
  2. One of the processes initiated by the hub connecting to your server via IP is generating a response that leads to another process/function/query that uses the machine name, with the name being provided from the server end. Are there any outbound hub processes that align with the 30 second interval between requests? Then again, they could be more frequent, and the TTL on your DNS server might be set to 30 seconds.

There's no way for the hub to know the server name otherwise, is there?

If it wouldn't break anything else that's critical and using the server name, you could change the DNS record for the server, giving it a bad IP, and then see what breaks on the hub.

1 Like

FWIW I have my hub setup via Marker to talk to a Node-Red server via an IP and checked my DNS server, there are no lookups requests for the server name. I also have Influx Logger setup with the IP, and possibly some other things.

1 Like

Thanks again.

No VLAN. I have an OPNsense box with a bunch of Ethernet ports for segregation.

Exactly, and this is why I opened this topic.

Thanks, I appreciate that you've verified this.

Yep, have that too. Along with MQTT they are the only apps needing the server address.

Well only you will know that and you already said you checked all apps.

Using home assistant at all?

If you truly have never provided the hub with the sever name then the only way it could know it would be if it did an rdns query first, and cached it. Then is doing a dns query on the cached hostname. Seems unlikely.

No

There was a time, probably over 2 years ago, when I did have names rather than IP address in those fields. I can't imagine with all the updates, reboots, and power cycles that the name is still in there somewhere but thanks for suggesting it.

You said you have node red. What about the maker api instance for it? Checked that too?

2 Likes

BINGO! We have a winner! :tada:

1 Like