1

I have Pi-hole (v5.2.2 Web Interface v5.2.2 FTL v5.3.4) running on a Raspberry Pi at home and I have configured my LAN to use it for the DNS needs. Since some time ago, I noticed that my computers would show as being offline when switched on without apparent reason.

After some research, I noticed that my Synology 716+II NAS (DSM Version: 6.2.3-25426 Update 3) would send an enormous amount of DNS queries to the router (ASUS RT-AC88U), which on its turn would forward them to the Pi-hole. The router’s dnsmasq would block the queries occasionally because they came in too fast. That seems to block clients from performing DNS probing and thats why my computers thought that they were offline.

The thing is that my NAS sends about 5,000 queries per hour about irrelevant webpages. Obviously, the NAS got compromised with some sort of malware, to act as a DNS server and respond to queries. I don't have the Synology DNS Server package installed. I have identified an IP and by blocking it on router level, seems to greatly minimize the queries send by the NAS.

I have tried everything, like disabling UPnP from the router, disabling all port forwarding. Reinstalling the DSM on the NAS, but nothing helped. I haven’t formatted my hard drives, just performed a system partition clean-up and re-install.

Any tips on how to identify the cause/application of this problem?

Example of tcpdump from an SSH connection to the NAS. 192.168.1.8 is the NAS and 192.168.1.4 is the Raspberry Pi:

tcpdump

The output of the ps waux command:

root         1  0.0  0.0  24144  3292 ?        Ss    2020   1:02 /sbin/init
root         2  0.0  0.0      0     0 ?        S     2020   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        S     2020   0:17 [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/0:0H]
root         7  0.0  0.0      0     0 ?        S     2020   0:07 [migration/0]
root         8  0.0  0.0      0     0 ?        S     2020   0:00 [rcu_bh]
root         9  0.1  0.0      0     0 ?        S     2020   1:34 [rcu_sched]
root        10  0.0  0.0      0     0 ?        S     2020   0:00 [watchdog/0]
root        11  0.0  0.0      0     0 ?        S     2020   0:00 [watchdog/1]
root        12  0.0  0.0      0     0 ?        S     2020   0:09 [migration/1]
root        13  0.0  0.0      0     0 ?        S     2020   0:16 [ksoftirqd/1]
root        15  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/1:0H]
root        16  0.0  0.0      0     0 ?        S     2020   0:00 [watchdog/2]
root        17  0.0  0.0      0     0 ?        S     2020   0:01 [migration/2]
root        18  0.0  0.0      0     0 ?        S     2020   0:16 [ksoftirqd/2]
root        20  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/2:0H]
root        21  0.0  0.0      0     0 ?        S     2020   0:00 [watchdog/3]
root        22  0.0  0.0      0     0 ?        S     2020   0:02 [migration/3]
root        23  0.0  0.0      0     0 ?        S     2020   0:16 [ksoftirqd/3]
root        25  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/3:0H]
root        26  0.0  0.0      0     0 ?        S<    2020   0:00 [khelper]
root        27  0.0  0.0      0     0 ?        S     2020   0:00 [kdevtmpfs]
root        28  0.0  0.0      0     0 ?        S<    2020   0:00 [netns]
root       190  0.0  0.0      0     0 ?        S<    2020   0:00 [writeback]
root       194  0.0  0.0      0     0 ?        S<    2020   0:00 [kintegrityd]
root       195  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root       196  0.0  0.0      0     0 ?        S<    2020   0:00 [crypto]
root       198  0.0  0.0      0     0 ?        S<    2020   0:00 [kblockd]
root       312  0.0  0.0      0     0 ?        S<    2020   0:00 [ata_sff]
root       322  0.0  0.0      0     0 ?        S<    2020   0:00 [md]
root       467  0.0  0.0      0     0 ?        S<    2020   0:00 [rpciod]
root       532  0.0  0.0      0     0 ?        S     2020   0:00 [khungtaskd]
root       537  0.5  0.0      0     0 ?        S     2020   7:33 [kswapd0]
root       546  0.0  0.0      0     0 ?        SN    2020   0:00 [ksmd]
root       547  0.0  0.0      0     0 ?        S     2020   0:00 [fsnotify_mark]
root       552  0.0  0.0      0     0 ?        S<    2020   0:00 [nfsiod]
http      1133  0.0  0.5 463332 42780 ?        S     2020   0:27 php-fpm: pool www
root      1223  0.0  0.0      0     0 ?        S    12:05   0:00 [kworker/1:2]
http      1252  0.0  0.4 461804 39348 ?        S     2020   0:22 php-fpm: pool www
root      2327  0.0  0.1  36400 10740 ?        S<s   2020   0:00 nginx: master process /usr/bin/nginx -g pid /run/nginx.pid; daemon on; master_process on;
root      2472  0.0  0.0      0     0 ?        S    12:29   0:00 [kworker/u8:3]
root      2939  0.0  0.0      0     0 ?        S<    2020   0:00 [iscsi_eh]
root      2974  0.0  0.0      0     0 ?        S     2020   0:00 [scsi_eh_0]
root      2991  0.0  0.0      0     0 ?        S     2020   0:00 [scsi_eh_1]
root      3034  0.0  0.0      0     0 ?        S    12:40   0:00 [kworker/2:0]
root      3072  0.0  0.0      0     0 ?        S    12:41   0:00 [kworker/u8:0]
root      3096  0.0  0.0      0     0 ?        S     2020   0:00 [scsi_eh_2]
http      3186  0.0  0.0  99636  2300 ?        S     2020   0:00 /var/packages/Apache2.4/target/usr/local/bin/httpd24
http      3190  0.0  0.0 2412032 5160 ?        Sl    2020   0:00 /var/packages/Apache2.4/target/usr/local/bin/httpd24
root      3244  0.0  0.0      0     0 ?        S<    2020   0:00 [raid5wq]
root      3289  0.0  0.0      0     0 ?        S<    2020   0:00 [deferwq]
root      3409  0.0  0.0      0     0 ?        S     2020   0:00 [khubd]
root      3414  0.0  0.0      0     0 ?        S     2020   0:00 [kethubd]
root      3585  0.0  0.0      0     0 ?        S<    2020   0:00 [etxhci_wq3]
root      3636  0.0  0.0      0     0 ?        S<    2020   0:04 [kworker/2:1H]
root      3637  0.0  0.0      0     0 ?        S<    2020   0:05 [kworker/3:1H]
root      3640  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root      3641  0.0  0.0      0     0 ?        S     2020   0:02 [md0_raid1]
root      3642  0.0  0.0      0     0 ?        S<    2020   0:05 [kworker/0:1H]
root      3643  0.0  0.0      0     0 ?        S<    2020   0:05 [kworker/1:1H]
root      3668  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root      3669  0.0  0.0      0     0 ?        S     2020   0:00 [md1_raid1]
root      3750  0.0  0.0      0     0 ?        S    12:53   0:00 [kworker/0:1]
root      3805  2.7  0.2 452484 18244 ?        S    01:44  19:11 /usr/bin/smbd -F
root      3856  0.0  0.0      0     0 ?        S<    2020   0:00 [ext4-group-desc]
root      3857  0.0  0.0      0     0 ?        S     2020   0:02 [jbd2/md0-8]
root      3858  0.0  0.0      0     0 ?        S<    2020   0:00 [ext4-dio-unwrit]
root      3901  0.0  0.0  17276   792 ?        Ss    2020   0:00 /usr/bin/cgmanager --sigstop
system    3982  0.2  0.1 1240188 9068 ?        Ssl   2020   3:07 /usr/bin/syslog-ng -F --worker-threads=4 -u system -g log
root      4291  0.0  0.0      0     0 ?        S    13:03   0:00 [kworker/u8:1]
root      4346  0.0  0.0      0     0 ?        S    13:04   0:00 [kworker/2:1]
root      4397  0.0  0.0      0     0 ?        S    13:05   0:00 [kworker/0:0]
root      4402  0.0  0.0      0     0 ?        S    13:05   0:00 [kworker/u8:2]
root      4430  0.0  0.0      0     0 ?        S<    2020   0:00 [ipv6_addrconf]
root      4498  0.0  0.0      0     0 ?        S    13:07   0:00 [kworker/u8:4]
root      4577  0.0  0.0      0     0 ?        S    13:08   0:00 [kworker/2:3]
root      4593  0.0  0.0  76140  2816 ?        Ss    2020   0:01 /usr/syno/sbin/synologaccd -f
root      4609  0.0  0.0  81568  2076 ?        SNs   2020   0:00 /usr/syno/bin/synologrotated
root      4615  0.0  0.0      0     0 ?        S    13:09   0:00 [kworker/3:2]
root      4617  0.0  0.0  13124  1200 ?        Ss    2020   0:04 /sbin/dbus-daemon --session --fork --print-address
root      4648  0.0  0.0      0     0 ?        S    13:10   0:00 [kworker/0:3]
root      4657  0.0  0.0      0     0 ?        S    13:10   0:00 [kworker/1:0]
root      4661  0.5  0.1 213004  9968 ?        Ss   13:10   0:00 sshd: root@pts/14
root      4669  0.4  0.0 199800  7812 pts/14   Ss   13:10   0:00 sudo -i
root      4672  0.0  0.0  26140  2328 pts/14   S    13:10   0:00 -ash
root      4703  0.0  0.0  27740  1464 pts/14   R+   13:10   0:00 ps waux
root      4707  0.0  0.0  13124   880 ?        Ss    2020   0:00 /sbin/dbus-daemon --system --nopidfile
root      4800  0.0  0.0 326104  4552 ?        Ssl   2020   0:00 /usr/syno/sbin/synoconfd -D
root      4822  0.0  0.0 311484  3672 ?        Ssl   2020   0:02 /usr/syno/sbin/synonetd
root      4850  0.0  0.0      0     0 ?        S     2020   0:00 [ecryptfs-kthrea]
root      5251  0.0  0.0  18024  1304 ?        Ss    2020   0:00 udevd --daemon
http      5320  1.9  0.5 802180 44704 ?        Ssl   2020  23:48 [stealth]
root      5770  0.6  0.0      0     0 ?        Z    04:33   3:33 [synoavscan] <defunct>
root      5903  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root      6505  0.0  0.0      0     0 ?        S<   03:55   0:00 [kworker/u9:0]
root      7116  0.0  0.0   8512  1900 ?        Ss    2020   0:00 /usr/sbin/dhclient -4 -d -q -lf /tmp/dhcpv4.leases.eth1 -pf /tmp/dhcpcd-eth1.pid -sf /var/run/dh
root      7204  0.0  0.0      0     0 ?        S<    2020   0:00 [bioset]
root      7208  0.0  0.0      0     0 ?        S     2020   0:04 [md2_raid1]
root      7505  0.0  0.0   8516  1932 ?        Ss    2020   0:00 /usr/sbin/dhclient -4 -d -q -lf /tmp/dhcpv4.leases.eth0 -pf /tmp/dhcpcd-eth0.pid -sf /var/run/dh
root      7784  0.0  0.0      0     0 ?        Z<s  04:36   0:00 [SYNO.Core.Deskt] <defunct>
system    7804  0.0  0.0 262852    72 ?        S    04:36   0:00 synoscgi
root      7853  0.0  0.0      0     0 ?        Z<s  04:36   0:00 [SYNO.Core.Packa] <defunct>
root      8047  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-worker]
root      8049  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-worker-hi]
root      8050  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-delalloc]
root      8051  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-flush_del]
root      8052  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-flush_met]
root      8053  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-cache]
root      8054  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-submit]
root      8055  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-fixup]
root      8056  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio]
root      8057  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio-met]
root      8059  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio-met]
root      8060  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio-rai]
root      8061  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-rmw]
root      8062  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-endio-wri]
root      8063  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-freespace]
root      8064  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-delayed-m]
root      8065  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-readahead]
root      8067  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-qgroup-re]
root      8068  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-usrquota-]
root      8069  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-extent-re]
root      8070  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-syno_noco]
root      8072  0.0  0.0      0     0 ?        S<    2020   0:00 [btrfs-syno_high]
root      8120  0.0  0.0      0     0 ?        S     2020   0:00 [btrfs-cleaner]
root      8121  0.0  0.0      0     0 ?        S     2020   0:09 [btrfs-transacti]
root      8510  0.0  0.0 295464  3616 ?        Ssl   2020   0:00 /usr/syno/sbin/synologand
root      8529  0.0  0.0 117404  2380 ?        Ss    2020   0:00 /usr/syno/sbin/synocrond
root      8677  0.0  0.0 147788  1816 ?        Ss    2020   0:00 synostoraged
root      8683  0.0  0.0 147788  2140 ?        S     2020   0:03 /usr/syno/sbin/synostoraged
root      8684  0.0  0.0 147788  2824 ?        S     2020   0:20 /usr/syno/sbin/synostoraged
root      8685  0.0  0.0 147788  2880 ?        S     2020   0:14 /usr/syno/sbin/synostoraged
root      8820  0.0  0.0 171536  3612 ?        Ss    2020   0:01 /usr/syno/bin/s2s_daemon -d
root      9002  0.0  0.0      0     0 ?        S     2020   0:00 [scsi_eh_3]
root      9003  0.0  0.0      0     0 ?        S     2020   0:00 [usb-storage]
root      9177  0.0  0.0  73300  1696 ?        Ss    2020   0:01 /usr/syno/bin/synobackupd
root      9278  0.0  0.0 151976  3116 ?        Ss    2020   0:11 /usr/syno/sbin/hotplugd
root      9467  0.1  0.1 265900  8932 ?        Ss    2020   2:19 /usr/bin/snmpd -fLn -c /etc/snmp/snmpd.conf -p /var/run/snmpd.pid 127.0.0.1:161
root      9604  0.0  0.0  96888  3260 ?        Ss    2020   0:00 /usr/syno/sbin/synoagentregisterd
root      9617  0.0  0.0 262852  1544 ?        S<s   2020   0:23 synoscgi
root      9621  0.0  0.1 348628  8116 ?        Ss   02:10   0:03 /usr/bin/nmbd -F
root      9634  0.0  0.0 155928  4208 ?        S<s   2020   0:03 /usr/syno/sbin/synosnmpcd
root      9651  0.0  0.0 266272  3928 ?        S<s   2020   0:13 /usr/syno/sbin/synocgid -D
root      9659  0.0  0.0 130088  5724 ?        Ss    2020   0:01 /usr/syno/sbin/ddnsd
root      9664  0.0  0.0 127636  5736 ?        Ss    2020   0:02 /usr/syno/sbin/heartbeatd
root      9696  0.0  0.0  25124  1512 ?        S    02:10   0:01 avahi-daemon: running [DIMI-NAS.local]
http      9709  0.0  0.1  36404 11064 ?        S<   02:10   0:00 nginx: worker process
http      9710  0.0  0.1  36404 11328 ?        S<   02:10   0:00 nginx: worker process
http      9711  0.0  0.1  36404 11396 ?        S<   02:10   0:02 nginx: worker process
http      9712  0.0  0.1  36404 11448 ?        S<   02:10   0:03 nginx: worker process
ntp       9758  0.0  0.0  96156  2132 ?        Ssl   2020   0:03 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u ntp:ntp
root      9759  0.0  0.0 199800  3588 ?        Ss    2020   0:00 sudo -u nobody /usr/syno/bin/synowstransferd
root      9761  0.0  0.0 227128  2420 ?        S<s   2020   0:00 /usr/syno/bin/findhostd
root      9765  0.0  0.0      0     0 ?        Z<s  04:37   0:00 [SYNO.Entry.Requ] <defunct>
root      9809  0.0  0.0 174300  2876 ?        S     2020   0:01 /usr/bin/netatalk
root      9838  0.0  0.0 148260  3824 ?        Ss    2020   0:00 /usr/bin/sshd
root      9898  0.0  0.0      0     0 ?        Z<s  04:37   0:00 [SYNO.Core.Packa] <defunct>
root      9899  0.0  0.0      0     0 ?        Z<s  04:37   0:00 [SYNO.Core.UserS] <defunct>
root      9939  0.0  0.0 240360  6160 ?        S     2020   0:01 /usr/bin/afpd -d -F /etc/afp.conf
root      9940  0.0  0.0 150520  2812 ?        S     2020   0:00 /usr/bin/cnid_metad -d -F /etc/afp.conf
root      9960  0.0  0.0 199800  3584 ?        Ss    2020   0:00 sudo -u nobody /usr/syno/bin/synowsdiscoveryd
root      9974  0.0  0.0      0     0 ?        S     2020   0:01 [Syno_HDDMon]
nobody   10000  0.0  0.0  70064  1600 ?        S     2020   0:00 /usr/syno/bin/synowstransferd
root     10028  0.0  0.1 319336  9112 ?        SNsl  2020   0:02 /usr/syno/sbin/synocontentextractd
root     10048  0.0  0.0   6248  2340 ?        SLs   2020   0:00 /usr/bin/vmtouch -lfd /var/run
root     10055  0.0  0.0   8584   700 ttyS0    Ss+   2020   0:00 /sbin/getty 115200 console
nobody   10062  0.1  0.1 244072 12812 ?        Sl    2020   1:56 /bin/python2 /usr/syno/bin/synowsdiscoveryd
root     10150  0.0  0.0      0     0 ?        S     2020   0:00 [RODSP_ODX_LOGIN]
root     10151  0.0  0.0      0     0 ?        S     2020   0:00 [RODSP_VLUN_LOGI]
root     10152  0.0  0.0      0     0 ?        S     2020   0:00 [RODSP_VDISK_LOG]
system   10201  0.0  0.0 262852    72 ?        S    04:37   0:00 synoscgi
postgres 10217  0.0  0.4 574888 33104 ?        Ss    2020   0:00 /usr/bin/postgres -D /var/services/pgsql
root     10282  0.0  0.1 424688 11408 ?        Ss    2020   0:01 /usr/bin/smbd -F
root     10427  0.0  0.0 325584  1020 ?        Ssl  03:56   0:00 /var/packages/AntiVirus/target/bin/synoavd
postgres 10435  0.0  0.0 575148   884 ?        Ss    2020   0:00 postgres: checkpointer process
postgres 10436  0.0  0.0 575148  4056 ?        Ss    2020   0:00 postgres: writer process
postgres 10437  0.0  0.0 575148   884 ?        Ss    2020   0:00 postgres: wal writer process
root     10451  0.0  0.0 245604  2756 ?        SNs   2020   0:00 /usr/syno/sbin/synocontentextractd
root     10452  0.0  0.0 245604  2760 ?        SNs   2020   0:00 /usr/syno/sbin/synocontentextractd
system   10465  0.0  0.0 262852    80 ?        S    03:56   0:00 synoscgi
root     10543  0.0  0.0      0     0 ?        S<    2020   0:00 [cifsiod]
root     10546  0.0  0.0      0     0 ?        S<    2020   0:00 [cifsoplockd]
root     10659  0.0  0.0 498400  5572 ?        S     2020   0:08 /usr/bin/smbd -F
root     10661  0.0  0.0 424660  4004 ?        S     2020   0:00 /usr/bin/smbd -F
root     10763  0.0  0.0  68868  1236 ?        SNs   2020   0:00 /usr/syno/sbin/synoindexd
root     10787  0.0  0.1 448184 10336 ?        S     2020   0:11 /usr/bin/smbd -F
root     11013  0.0  0.0   7224  1132 ?        Ss    2020   0:00 /usr/sbin/crond
root     11015  0.0  0.0 141424  3192 ?        Ss    2020   0:00 /usr/syno/bin/synodisklatencyd
root     11060  0.2  0.0 750384  4336 ?        Ssl   2020   2:58 /usr/syno/bin/scemd
root     11100  0.8  0.1 305424 11432 ?        SLl   2020  11:08 /usr/syno/sbin/synorelayd
root     11224  0.0  0.1 432312  8548 ?        Ss    2020   0:02 php-fpm: master process (/var/packages/WebStation/target/misc/php74_fpm.conf)
root     12363  0.0  0.0 520928  4200 ?        Ssl   2020   0:03 /var/packages/FileStation/target/sbin/thumbd
root     12368  0.0  0.0 447196  3676 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12369  0.0  0.0 447196  3680 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12785  0.0  0.0 603184  4592 ?        Ssl   2020   0:29 /var/packages/USBCopy/target/sbin/usb-copyd
root     12789  0.0  0.0  68888  1408 ?        SN    2020   0:00 /usr/syno/sbin/synoindexscand
root     12790  0.0  0.0  68868  1424 ?        SN    2020   0:00 /usr/syno/sbin/synoindexworkerd
root     12791  0.0  0.0  82276  2064 ?        SN    2020   0:00 /usr/syno/sbin/synoindexplugind
root     12792  0.0  0.0 117096  4060 ?        SN    2020   0:00 /usr/syno/sbin/synomediaparserd
root     12916  0.0  0.0 520928  3728 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12917  0.0  0.0 520928  3728 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12918  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12919  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12920  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12922  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12923  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
root     12924  0.0  0.0 520928  3724 ?        Ss    2020   0:00 /var/packages/FileStation/target/sbin/thumbd
http     12970  0.0  0.0  14960   636 ?        Ss    2020   0:00 /var/packages/WebStation/target/usr/bin/multiwatch -f 4 -- /var/packages/WebStation/target/usr/b
http     12976  0.0  0.0   8420   332 ?        S     2020   0:00 /var/packages/WebStation/target/usr/bin/fcgiwrap
http     12977  0.0  0.0   8420   332 ?        S     2020   0:00 /var/packages/WebStation/target/usr/bin/fcgiwrap
http     12978  0.0  0.0   8420   332 ?        S     2020   0:00 /var/packages/WebStation/target/usr/bin/fcgiwrap
http     12979  0.0  0.0   8420   332 ?        S     2020   0:00 /var/packages/WebStation/target/usr/bin/fcgiwrap
root     13635  0.0  0.5 543588 42652 ?        Ssl   2020   0:10 /var/packages/SynoFinder/target/sbin/synoelasticd
root     13904  0.0  0.0 293060  2848 ?        SNsl  2020   0:00 /usr/syno/bin/iscsi_snapshot_comm_core -D
root     13907  0.0  0.0 145600  2872 ?        SNs   2020   0:00 /usr/syno/bin/iscsi_snapshot_server -D
root     13915  0.0  0.0 189332  5260 ?        Ssl   2020   0:03 /usr/syno/bin/scsi_plugin_server
root     13972  0.0  0.0   4232   372 ?        SLs  02:33   0:00 /bin/vmtouch -l /usr/syno/bin/synoschedtask /usr/syno/bin/synoschedtool /usr/syno/etc/scheduled_
root     14281  0.0  0.0  99636  6696 ?        Ss    2020   0:03 /var/packages/Apache2.4/target/usr/local/bin/httpd24
root     14914  0.0  0.0   4188   308 ?        Ss    2020   0:01 /usr/bin/minissdpd -i eth0 -i eth1
root     15049  0.0  0.0 457424  7680 ?        Ss    2020   0:01 php-fpm: master process (/usr/syno/etc/packages/WebStation/php_profile/6c71a6ba-110a-4a99-8333-0
http     15070  0.0  0.0 432312   948 ?        S     2020   0:00 php-fpm: pool www
http     15071  0.0  0.0 432312   948 ?        S     2020   0:00 php-fpm: pool www
http     15945  0.0  0.3 461332 29336 ?        S     2020   0:23 php-fpm: pool www
root     19984  9.8  0.4  61092 39096 pts/15   S+   04:22  51:54 grep --color=auto -rnw / -e nslookup
root     21568  0.0  0.0 293072   204 ?        S    04:23   0:00 synoscgi_SYNO.AntiVirus.Scan_1_start_full
root     21574 98.8 12.4 1846268 1005620 ?     RNs  04:23 521:44 /var/packages/AntiVirus/target/bin/synoavscan --all
root     21800  0.0  0.0      0     0 ?        S<    2020   0:00 [kworker/u9:1]
root     22917  0.0  0.0 213004  5140 ?        Ss   03:28   0:00 sshd: root@pts/15
root     22939  0.0  0.0 199800  3588 pts/15   Ss   03:28   0:00 sudo -i
root     22941  0.0  0.0  26156  1732 pts/15   S    03:28   0:00 -ash
root     23090  0.3  0.4 2636340 38796 ?       Ssl   2020   4:46 /var/packages/CloudSync/target/sbin/syno-cloud-syncd /volume1/@cloudsync/config/daemon.conf
root     26067  0.0  0.0      0     0 ?        S    09:40   0:03 [kworker/0:2]
system   26818  0.0  0.0 262852    80 ?        S    00:56   0:00 synoscgi
system   26819  0.0  0.0 262852    80 ?        S    00:56   0:00 synoscgi
root     28727  0.0  0.0  11976  1436 ?        S     2020   0:00 /bin/sh /usr/local/mariadb10/bin/mysqld_safe --datadir=/var/packages/MariaDB10/target/mysql --pi
mysql    28863  0.0  0.6 1781284 54596 ?       Sl    2020   0:30 /usr/local/mariadb10/bin/mysqld --basedir=/usr/local/mariadb10 --datadir=/var/packages/MariaDB10
root     29521  0.0  0.0      0     0 ?        S    10:45   0:01 [kworker/3:1]
root     30333  0.0  0.0      0     0 ?        S    11:01   0:01 [kworker/3:0]
root     30377  0.0  0.0      0     0 ?        S    11:02   0:01 [kworker/1:1]
root     32190  0.0  0.0      0     0 ?        S    11:37   0:01 [kworker/2:2]

More research using Tonny's suggestion:

udp        0      0 DIMI-NAS:56353          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:48653          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53011          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53159          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53203          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53288          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:53474          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:37553          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:42539          pihole:domain           ESTABLISHED
udp        0      0 DIMI-NAS:35339          pihole:domain           ESTABLISHED
15
  • First, can you edit the question to add the versions of Pi-hole and your Synlogy DSM software are? I don’t believe you are hacked or being hacked. You are using a Synology 716+II NAS, right? If you think you are being hacked I would recommend upgrading the Synology DSM software to the latest version (6.2.3 according to this page). I honestly don’t believe your Synology is hacked but — if anything is hacked — it might be the Pi-hole itself. Jan 1, 2021 at 2:31
  • 1
    I have added the version on my question. The NAS is definetely the issue here. When I shut it down, the clutter is cleared immediately. When I block one specific IP address that connects to the NAS using UPNP then the clutter is greatly minimized. The NAS got freshly installed from scratch last night with the latest version. Although I didn't format the drives, only the system partition.
    – m33ts4k0z
    Jan 1, 2021 at 2:42
  • Thanks for adding versions! The example TCPDump should not be a screenshot; hard to read. Please just copy and paste the output as text, paste it in and format it as code. Jan 1, 2021 at 3:24
  • While it looks like the BAS is the issue, the DNS queries could be a side effect of the underlying problem - it is unlikely (but not impossible) it is running a DNS server.
    – davidgo
    Jan 1, 2021 at 3:41
  • 1
    @Giacomo1968 yes I meant NAS. I was responding to " Obviously, the NAS got compromised with some sort of malware, to act as a DNS server and respond to queries. I don't have the Synology DNS Server package installed. ". - I think the problem is not with a DNS server on the NAS.
    – davidgo
    Jan 1, 2021 at 4:20

1 Answer 1

0

Well the issue is resolved.

As @Tonny noted in the comments, the only wordpress webpage I had running on the webstation of the NAS, did have a vulnerability. Apparently, the owner of the webpage installed some cracked plugins that included malicious code and allowed an HTTP request to do nasty things in the background. I removed the virtual host connected to that webpage and for about 24 hours now, the issue didn't occur.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.