I'm having problems where my upstream bandwidth is being saturated. I've narrowed it down to a DNS issue of some type. If I stop the named service then my bandwidth drops to "normal" according to my untangle firewall.
I'm running bind-9.3.6-20.P1.el5_8.6.
I'm seeing the following in /var/log/messages: 2014-02-08T23:03:09.558315-05:00 mailserver named[3497]: network unreachable resolving 'hccforums.nl/ANY/IN': 2a00:1188:5::212#53 2014-02-08T23:03:09.558441-05:00 mailserver named[3497]: network unreachable resolving 'hccforums.nl/ANY/IN': 2001:7b8:606::85#53 2014-02-08T23:03:10.008926-05:00 mailserver named[3497]: client 174.128.253.163#5209: view external: no more recursive clients: quota reached 2014-02-08T23:03:11.001878-05:00 mailserver named[3497]: client 173.234.39.133#5209: view external: no more recursive clients: quota reached 2014-02-08T23:03:12.000487-05:00 mailserver named[3497]: client 173.234.39.133#5209: view external: no more recursive clients: quota reached 2014-02-08T23:03:13.000820-05:00 mailserver named[3497]: client 173.234.39.133#5209: view external: no more recursive clients: quota reached 2014-02-08T23:03:14.001501-05:00 mailserver named[3497]: client 192.126.118.105#5209: view external: no more recursive clients: quota reached 2014-02-08T23:03:15.005720-05:00 mailserver named[3497]: client 192.126.118.105#5209: view external: no more recursive clients: quota reached
I've tried changing the following in /etc/named.conf but it doesn't seem to have any affect so I commented them back out. tcp-clients 1000; recursive-clients 10000;
I also see a chroot directory, but if I grep for named it doesn't appear to be using the chroot(?): # ps aux | grep named named 3497 0.4 0.7 170088 15836 ? Ssl 23:02 0:02 /usr/sbin/named -u named root 3763 0.0 0.0 61192 764 pts/1 S+ 23:13 0:00 grep named
I've also tried adding the following to iptables, but it also seems to have no affect: iptables --insert INPUT -p udp --dport 53 -m string --from 40 --to 56 --algo bm --hex-string '|09686363666f72756d73026e6c0000ff|' -j DROP -m comment --comment "DROP DNS Q hccforums.nl"
Any suggestions or troubleshooting advice?
Much appreciated. James