2

My dad brought his laptop over, and I noticed in my pihole dashboard that the number of dns requests nearly tripled. Turns out his laptop is sending nonstop dns requests about every 5 seconds for one of two hostnames: sec001599e75708.mydomain and brw28565a8f35b1.mydomain (where mydomain is the local dhcp domain). I've tried looking at sysinternals procmon to see where the requests are coming from, but it's all coming from one process, the built in DNS Client service, which I can't seem to disable. So then I started killing processes one by one. I got everything I could think of, and still, getting DNS requests every 5 seconds or so. Has anyone seen this? Any other way to find out where its coming from?

1
  • 1
    You have the right idea using ProcMon. See this link for how to disable the DNS Client service, after which your offending process should be forced to betray itself by make the lookup query on its own. Oct 17, 2018 at 21:29

2 Answers 2

0

Turns out the culprit is the Windows Image Acquisition service. The weird hostnames are hostnames for a couple of imaging devices that he has at home (pc-fax and scanner). I'm guessing the service is trying to find the devices, but can't. Guess MS programmers have never heard of exponential backoff.

0

interesting. I just noticed similar outbound activity (being blocked) when reviewing my host firewall logs. Noticed ICMP type 3, code 3 messages being sent(approximate 5 min interval) to the hosts primary and secondary DNS addressees. I will stop the Windows Image Acquisition service, and set to manual start.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .