Possible DNS caching problem

I just upgraded to Lion. I am a web deveoper and I just changed the DNS settings for a new website. While everyone else in my office is seeing the new wesite at the domain, I am stuck seeing the old. I have tried the DNS cache flushing techniques below (in addition to restarting, clearing cache, etc), but none have helped:
sudo killall -HUP mDNSResponder
dscachutil -flushcache
In the terminal 'host domain.com' still points to the old server too.
Seems like OSX is holding on to the old DNS settings. Any ideas?

Select  ▹ System Preferences ▹ Network ▹ Advanced ▹ Proxies. If any boxes are checked, uncheck them, apply your changes, and try again. You must apply the changes before they take effect.

Similar Messages

DNS caching problem when configuring Windows clients for SCAN

I have a Windows 2008 R2 server running apps that connect to a RAC cluster database using the SCAN address. The SCAN address however always returns the same IP when you ping it from that server. If I flush the DNS cache I get a different address, but again the same one all the time. I believe this is caused by the fact that DNS caching is enabled on Windows by default. This has caused problems when one of the RAC nodes goes south and the cached SCAN IP is not responding. The applications lose their connections, try to reconnect, but can't because they keep using the same dead SCAN IP.
I suggested we disable the DNS Client service on those machines so that the SCAN name correctly cycles through the addresses but the Windows admin says not to do this. Is there a documented practice somewhere that this is OK to do for Windows RAC clients? Or is there a way to disable caching just on the SCAN name but leave it enabled from every other host name?
TIA

What happened was the SCAN VIP did not fail over. The node VIP did not fail over. The database instance was running but I could not connect to it even locally as sysdba. I got the message "protocol adapter error". This normally only occurs on Windows for local connections when either (a) the Oracle service is not running, or (b) you didn't set the ORACLE_SID variable correctly. Neither was true.
I tried "crsctl stop crs" but it could not stop the listeners.
I rebooted the server. During the reboot, neither the VIP no SCAN VIPs failed over. It's almost as if CRS either didnt recognize tat the other node had been shutdown, or it didn't care.
I have never seen this happen before.
For the record this is Oracle RAC 11.2.0.1.

Host fingerprint always changing, possibly dns resolve problem?

Hello,
I have a server that i try to connect which key fingerprint changes form time to time, and it stops me to connect (i get wrong password disconnect, although i am using an RSA key). Since its a physical machine lets exclude the part of any traffic shaping by the VPS provider. Also normally when i cant connect i cant see anything on the sshd logs of the machine. So this probably is a dns resolve problem ? Any recommendation or knowledge that you can share with me to help me solve this problem ?

presumbly the previous stats were from the test socket as new stats are just the same
any exchnage problems http://usertools.plus.net/exchanges/mso.php
http://usertools.plus.net/exchanges/?
http://btbusiness.custhelp.com/app/service_status
http://bt.custhelp.com/app/answers/detail/a_id/15036
http://community.plus.net/exchange-information/
If you like a post, or want to say thanks for a helpful answer, please click on the Ratings star on the left-hand side of the post.
If someone answers your question correctly please let other members know by clicking on ’Mark as Accepted Solution’.

DNS Cache Problems AGAIN!

I give up on trying to fix my iMac's DNS issues.
I have tried the dscacheutil -flushcache and still I can not reach certain websites.
These same websites I can reach on my Parallel's XP install and the very same iMac.
Again suggestions would be greatly appreciated.
Would sure like to know what Apple updates keep breaking the DNS?

There's lots missing from this post if you're trying to find answers. If you're just ranting, that's OK, but it's nice to say so that others don't waste time trying to help.
Assuming you are looking for answers, let's start with the obvious.
Are the Windows VM and the Mac using the same DNS server settings? If not, why not? and what happens if you set the Mac to the same settings as the Windows VM?
What sites are you having trouble connecting to?
What makes you say the problem is DNS, vs. some other issue?
Are you using a proxy server on the Mac? (i.e. it's the proxy server that's blocking access rather than a DNS issue).
You imply the problem lies with Apple updates. What makes you say this? Were you previously able to access the sites in question?

Possible result cache problem 11GR1;;Plz Help me :)

Hello,
I just finished installing Oracle 11g Enterprise Edition on my laptop,under windows XP 32 Bit,
Just run to test the result cache ,It seems the result cache does not work for me ;
Please see the demonstration below and help me to undertsand:
(I am the only person connected to the database and I only have one session conneted )
Connected to Oracle Database 11g Enterprise Edition Release 11.1.0.6.0
Connected as SYS
SQL> set timi on
SQL> select * from v$version;
BANNER
Oracle Database 11g Enterprise Edition Release 11.1.0.6.0 - Production
PL/SQL Release 11.1.0.6.0 - Production
CORE     11.1.0.6.0     Production
TNS for 32-bit Windows: Version 11.1.0.6.0 - Production
NLSRTL Version 11.1.0.6.0 - Production
Executed in 0.031 seconds
SQL> ----result cache demonstration
SQL> ----clear the server result cache
SQL> exec dbms_result_cache.Flush
PL/SQL procedure successfully completed
Executed in 0 seconds
SQL> ---run a query to load the server result cache
SQL>
SQL> SELECT /*+ result_cache */
2   H.DEPARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID, COUNT(*)
3    FROM HR.DEPARTMENTS H
4   GROUP BY H.DEPARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID
5 ;
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
           10 Administration                        200          1
           30 Purchasing                            114          1
           50 Shipping                              121          1
           60 IT                                    103          1
           70 Public Relations                      204          1
          200 Operations                                         1
          210 IT Support                                         1
          230 IT Helpdesk                                        1
           90 Executive                             100          1
          100 Finance                               108          1
          140 Control And Credit                                 1
          150 Shareholder Services                               1
          160 Benefits                                           1
          220 NOC                                                1
          250 Retail Sales                                       1
          130 Corporate Tax                                      1
          110 Accounting                            205          1
          270 Payroll                                            1
           40 Human Resources                       203          1
          170 Manufacturing                                      1
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
          260 Recruiting                                         1
           20 Marketing                             201          1
          120 Treasury                                           1
           80 Sales                                 145          1
          180 Construction                                       1
          190 Contracting                                        1
          240 Government Sales                                   1
27 rows selected
Executed in 0.282 seconds
SQL> --*-response time is 0.282 seconds*
SQL> ---Show the result information from v$result_cache_objects : is the result cache is valid ?
SQL> --- The space used also?
SQL>
SQL> SELECT ID,
2         NAME,
3         TYPE,
4         STATUS,
5         BLOCK_COUNT,
6         ROW_COUNT * ROW_SIZE_AVG AS SPACE_FOR_ROWS,
7         SPACE_OVERHEAD
8    FROM V$RESULT_CACHE_OBJECTS V
9 ;
        ID NAME                                                                             TYPE       STATUS    BLOCK_COUNT SPACE_FOR_ROWS SPACE_OVERHEAD
         0 HR.DEPARTMENTS                                                                   Dependency Published           1              0              0
         1 SELECT /*+ result_cache */                                                       Result     Published           1            675            320
            H.DEPARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID, COUNT(*)
             FROM HR.DEPARTMENTS H
            GROUP BY H.DEPAR
Executed in 0.141 seconds
SQL> ---we run again our query
SQL>
SQL> SELECT /*+ result_cache */
2   H.DEPARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID, COUNT(*)
3    FROM HR.DEPARTMENTS H
4   GROUP BY H.DEPARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID
5 ;
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
           10 Administration                        200          1
           30 Purchasing                            114          1
           50 Shipping                              121          1
           60 IT                                    103          1
           70 Public Relations                      204          1
          200 Operations                                         1
          210 IT Support                                         1
          230 IT Helpdesk                                        1
           90 Executive                             100          1
          100 Finance                               108          1
          140 Control And Credit                                 1
          150 Shareholder Services                               1
          160 Benefits                                           1
          220 NOC                                                1
          250 Retail Sales                                       1
          130 Corporate Tax                                      1
          110 Accounting                            205          1
          270 Payroll                                            1
           40 Human Resources                       203          1
          170 Manufacturing                                      1
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
          260 Recruiting                                         1
           20 Marketing                             201          1
          120 Treasury                                           1
           80 Sales                                 145          1
          180 Construction                                       1
          190 Contracting                                        1
          240 Government Sales                                   1
27 rows selected
*Executed in 0.297 seconds*
SQL> Why the first is faster than the second?
thanks a lot,
Edited by: Ora-Wiss on Apr 3, 2010 2:17 PM

I have been using 11g from quite some time now in my sessions and already have started sessions over 11gr2 as well and I can't recall that I ever faced this thing. And I just did show the same to you on my personal system as well. But nevermind, here is one more run with the database being restarted and the same code being run.
SQL> select * from v$version;
BANNER
Oracle Database 11g Enterprise Edition Release 11.1.0.6.0 - Production
PL/SQL Release 11.1.0.6.0 - Production
CORE    11.1.0.6.0      Production
TNS for 32-bit Windows: Version 11.1.0.6.0 - Production
NLSRTL Version 11.1.0.6.0 - Production
Elapsed: 00:00:00.00
SQL> startup force
ORACLE instance started.
Total System Global Area 171573248 bytes
Fixed Size                  1331936 bytes
Variable Size             125832480 bytes
Database Buffers           37748736 bytes
Redo Buffers                6660096 bytes
Database mounted.
Database opened.
SQL> exec dbms_result_cache.Flush;
PL/SQL procedure successfully completed.
Elapsed: 00:00:00.06
SQL> SELECT /*+ result_cache */   H.DEPARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID, COUNT(*) FROM HR.DEPARTMENTS H GROUP BY H.DEP
ARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID;
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
           10 Administration                        200          1
           30 Purchasing                            114          1
           50 Shipping                              121          1
           60 IT                                    103          1
           70 Public Relations                      204          1
          200 Operations                                         1
          210 IT Support                                         1
          230 IT Helpdesk                                        1
           90 Executive                             100          1
          100 Finance                               108          1
          140 Control And Credit                                 1
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
          150 Shareholder Services                               1
          160 Benefits                                           1
          220 NOC                                                1
          250 Retail Sales                                       1
          130 Corporate Tax                                      1
          110 Accounting                            205          1
          270 Payroll                                            1
           40 Human Resources                       203          1
          170 Manufacturing                                      1
          260 Recruiting                                         1
           20 Marketing                             201          1
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
          120 Treasury                                           1
           80 Sales                                 145          1
          180 Construction                                       1
          190 Contracting                                        1
          240 Government Sales                                   1
27 rows selected.
Elapsed: 00:00:00.15
SQL> SELECT /*+ result_cache */   H.DEPARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID, COUNT(*) FROM HR.DEPARTMENTS H GROUP BY H.DEP
ARTMENT_ID, H.DEPARTMENT_NAME, H.MANAGER_ID;
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
           10 Administration                        200          1
           30 Purchasing                            114          1
           50 Shipping                              121          1
           60 IT                                    103          1
           70 Public Relations                      204          1
          200 Operations                                         1
          210 IT Support                                         1
          230 IT Helpdesk                                        1
           90 Executive                             100          1
          100 Finance                               108          1
          140 Control And Credit                                 1
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
          150 Shareholder Services                               1
          160 Benefits                                           1
          220 NOC                                                1
          250 Retail Sales                                       1
          130 Corporate Tax                                      1
          110 Accounting                            205          1
          270 Payroll                                            1
           40 Human Resources                       203          1
          170 Manufacturing                                      1
          260 Recruiting                                         1
           20 Marketing                             201          1
DEPARTMENT_ID DEPARTMENT_NAME                MANAGER_ID   COUNT(*)
          120 Treasury                                           1
           80 Sales                                 145          1
          180 Construction                                       1
          190 Contracting                                        1
          240 Government Sales                                   1
27 rows selected.
Elapsed: 00:00:00.01
SQL>As you can see, I can't reproduce.
HTH
Aman....

Can't access some websites. Possibly DNS problem.

This problem only started to occur a couple of days ago. I found that I can't access certain websites,but all the other computers in exactly the same network environment have no problem accessing them. I tried changing my DNS server settings from the servers my ISP provided to the Google DNSs, 8.8.8.8 and 4.4.4.4, and those websites I couldn't access before became accessible immediately, but some other websites, which I was able to access with the DNS provided by my ISP before, became inaccessible again. I tried using another set of DNS addresses, the same thing happened: some websites that I couldn't access before became accessible, but some others become inaccessible again. All these DNS servers that I used work perfectly on other computers in my network, so it has to be the problem of my computer. This has nothing to do with the browser, as all of the browers in my system have the same problem, even including the Internet Explorer in my VMware Windows virtual machine. I tried flushing the DNS cache with dscacheutil -flushcache, and it didn't work.
I'm using Lion 10.7.3 on MacBook Pro MC371. Please help!

Please give an example of a site you can't access now.

Possible caching problem

I have a Pag1.jsp with 2 buttons, a dropdown with a button, as well as a datatable with an action link. Everthing works fine; the buttons, action links and dropdown. The problem arises with the actionLink; on the remote jsp pages the user can hit a button which takes him back to page 1.jsp. HOWEVER, IF HE USES THE BROWSER'S BACK ARROW HE GOES BACK TO PAGE1.JSP, BUT NOW THE 2 BUTTONs NO LONGER DIRECT PROPERLY, BUT SEND HIM TO THE LAST PAGE THE ACTIONLINK DIRECTED HIM TO. This problem is only caused by the browser back arrow and is removed by going to page1.jsp and hitting the refresh button...Is this a caching problem and what can I do about? Thanks for taking the time to read this.

Hi ,
I tried reproducing your problem with information provided by you , but was not able to reproduce. I was successful in bringing up the correct JSP pages on the click of buttons. The browsers back button takes me to the previous visited page and the button ,Action Links redirect me to the right JSP pages.
Regards,
Creator Team.

Possible cache problem ftp scenario

hello,
we have the following scenario
ftp -> ftp
very simple, no integretation rep needed, interface -> none, namespace -> http://none
just pick up the file and put it on another server
strange thing is that the receiver uses for target directory the source directory of the sender to put the file
could this be a cache problem, we cleared the cache but the problem remains
regards,
Michel

Hi Michel,
Very strange problem indeed.. not convinced this is a cache problem.. have you checked the cache overview in the Integration Directory ?
If it is a cache problem, deleting, activating and recreating the ftp receiver could solve it.
Using another receiver Business System/Service will surely avoid a cache problem, as an object with a completely different key will be created.
Can you see the correct receiver channel being called in the Message Monitor ?
kr,
Peter

ADF cache problem

Hello,
I'm developing a web application with an ADF tree accessing to a Content DB repository. When I deploy the application and navigate to the tree everything look fine. The problem occurs, when the content of the repository changed outside of the web application (e.g. a file will be deleted with Oracle drive), the tree doesn't display the changes. The only way to get the right state of the tree, clear the browser cache and reload the page again. In my opinion it looks like a caching problem. Putting the following meta information in the html header also failed!
<meta http-equiv="pragma" content="no-cache"/>
<meta http-equiv="expires" content="0"/>
<meta http-equiv="cache-control" content="no-cache"/>
Is there a possibility to disable the caching of such ADF components?
Hope you can help me!
Thanks,
Alex

This will probably help you: http://www.oracle.com/technology/products/ias/web_cache/afc/index.html
Regards,
Koen Verhulst

Touchscreen TV app slows down - caching problem?

We have created an interactive Touchscreen using flash CS4 - http://www.cadstudio.co.nz/client_hlc/home.swf
The Touchscreen is already in the showroom.
Every morning it is restarted.
By midday the whole application slows down to the point were it becomes very slow.
I presume this is a caching problem.
In order to resolve this we close down IE and restart it (playing the SWF file through Internet Explore on full screen mode).
Once it has restarted it plays at the correct speed.
Does any one know of a solution to this problem?
I have thought about setting up windows 7 to reboot IE and have the flash file restart every few hours however a client may be navigating through the
display when it reboots it self. I would prefer to avoid this if possible.
Thanks.

The Touchscreen TV is offsite however i will try and monitor it with that application you sent through.
I have just read that using event listeners may cause the problem.

Flushing the DNS cache

I'm having trouble with a Web site when I access it on my home computer, yet this same site looks fine on my Mini at work. One section of the index page generates a "can't find server" error, and the site's own logo won't display properly. It is a free hosting site. Sometimes I can upload files to it, other times I get a can't-find-server error when I try.
In answer to my query about this (to which I helpfully attached a screenshot of the incompletely loaded index page and its error messages), the host is telling me that I should "flush my DNS cache," which they say involves going into Terminal and giving the command "ookupd -flushcache" [sic]. (I've already surfed this briefly and the first result confirmed my suspicion that this doofus hasn't mastered copy-and-paste technique and the command actually should be "lookupd- flushcache".)
It's not just that their site doesn't load fully, though. They have some stuff on one of their pages that they encourage users to hotlink on personal Web sites, and I have done that with one of their banners. The banner, which was fine for months, now appears on my page as a broken icon, too, although it, like the site's home page, loads fine on my computer at work.
My first question is, is there any harm in flushing the DNS cache? The OS Daily page where I think they copied this advice from makes it sound like this is something only a Web server would need. If I do it on my home machine, could it cause problems? Could it disable my Internet connectivity?
Second, less urgent question, more for the netgeeks out there: Do you think this is a likely solution to my problem? Especially considering that the problem involves not only their site but an element on an external site linking back to them? I hate to play the sucker for some low-level geek whose main mission is to deflect my query.
Thanks
Kathi

Kathi--
Like BDAqua says, there's nothing to worry about flushing the DNS cache. It's true that most people probably don't need to do it very often, but it's something easy and harmless to try, and it might well fix problems like yours.
One handy feature of Safari, even if you don't use it for anything else, is the "Activity" window. Open it from the "View" menu, and watch as your page loads. You can see exactly which components on the page are loading, which aren't and where they should be coming from. If you double-click an element in that list, Safari will try to open it in a new window. That is sometimes enough to give a clue as to why something isn't working.
You can use Safari's activity list along with the Network Utility from your Utilities folder to try to figure out why you're not getting the page elements. Suppose a graphic is listed as coming from http://www.server1.com/images/logo.jpg, but it's not loading.
First thing I would try in the Network Utility is to see if it will respond to pings. From that example, enter "www.server1.com" on the "Ping" page of the Network Utility and see if it answers back.
To find out if it's a DNS problem, you can use Safari's list to get the addresses of the problem elements, then see if the IP addresses match up on your computer at home to the one at work. If they don't, then it could be stale DNS.
You can use the Network Utility for DNS lookups, but I think they're hard to read, and, since you're already thinking about using the Terminal to flush the DNS cache, you can use nslookup. It's really simple:
<pre class="command">nslookup www.apple.com</pre>
Will give you something like this (the first two lines will likely be different):
Server: 208.67.222.222
Address: 208.67.222.222#53
Non-authoritative answer:
www.apple.com canonical name = www.apple.com.akadns.net.
Name: www.apple.com.akadns.net
Address: 17.251.200.32
If the addresses don't match, or you get a message that it can't find anything for your server, then you know it's a DNS problem. Perhaps they've changed some addresses and your home ISP's DNS servers themselves aren't updating.
You can even use nslookup to see what different DNS servers say about an address. Just add the IP address of a DNS server after the address you want to look up:
<pre class="command">nslookup www.apple.com 208.67.220.220</pre>
Just do a search on the 'net for free DNS servers, and you'll find a bunch to choose from.
charlie

How can I clear the DNS cache?

I haven't been able to connect to my local Library since January. When I key in the URL, it starts the access routine and then after about 20 minutes, I have to kill it because nothing happens. I contacted the IT folks at the library and was told that they had made a few changes around the time my problem began so maybe the DNS cache was still pointing at the old info. He recommended that I enter TERMINAL mode and try to clear the DNS cache, using "sudo dscacheutil -flushcache" command. . I attempted this several times, even changing my applid password, and kept getting invalid responses.

I did try that and after a few trys it finally worked. It took quite awhile for the window for the library to finally come up, but it did and I am now able to get in and out with no problems with my library access. Now when I call up my bank, parts of it don't come up and it kicks me out. Now, I'll have to search for what fixes that - as it has happened before, so I know it's fixable. Thanks for you help though.

Where Is My DNS Cache And How Do I Clear It?

I'm using Timbuktu to reach my desktop iMac remotely. I subscribe to DYNDNS to detect IP changes. Recently, after a blackout, I could not reach the iMac remotely via DYNDNS. I WAS able to use the new IP (which I had someone look up for me) and Timbuktu connected just fine.
After contacting DYNDNS, they told me to clear my DNS cache, as that was probably the reason why their detecting system could not see the new IP.
My head is spinning. Can some kindly tell me where the DNS cache is on my iMac 10.4.11 and how to clear it? (For idiots, please).
Many thanks
---Gary

Yes, it's clear. Thanks.
I'm just too nervous to try this until my Mac Guru is sitting here. I can't unscramble anything I screw up...and that's a pretty good possibility based on past events.
Again, thanks
Gary

DNS Cache Failure

I'm having a problem with my Mac and DNS and it is related to http://discussions.apple.com/thread.jspa?threadID=2132856&start=0&tstart=0 however no one seems to have come up with an actual solution and I've got the problem pretty much narrowed down here.
So, the mac is all set up properly and can connect to the internet fine, however, DNS lookup fails the SECOND time I do a lookup. i.e.,
*> ping google.com*
*PINGING blah blah all ok*
*> ping google.com*
*ping: cannot resolve: unknown host*
Clearing the cache resolves this problem for one lookup:
*> ping google.com*
*PINGING blah blah all ok*
*> ping google.com*
*ping: cannot resolve: unknown host*
*> dscacheutil -flushcache*
*> ping google.com*
*PINGING blah blah all ok*
*> ping google.com*
*ping: cannot resolve: unknown host*
Accordingly, nslookup always works as it does not use the local cache.
Now, I've checked all the usual solutions: router config, dns config, router vs. direct connect, type and number of dns servers, resolve.conf, etc., etc. and cannot come up with a solution.
Surely there is a fix to this someone is aware of? +Or, if not, is there at least a way to disable local DNS caching?+

Yes, I have already looked into that.
I've tried it with one DNS and multiple DNS, both with various combinations of open DNS servers and my ISP's servers and the default router "server" and in the various orderings and options in resolv.conf. And I checked the various man pages to make sure I was covering all the options and it looks like I was.
In all cases the problem behaves exactly the same.
FWIW I have 3 windows machines, 1 Mac 10.2, 1 Mac 10, and a linux box on my network, and they all work fine with no special configuration (DHCP). Seems particular to 10.6 (well, 10.3+ at least, though I would assume it has to do with the DNS change in 10.6 from 10.5).
Message was edited by: squirlhntr

DNS cache poisoning, 4004

Can we get some details on what this signatures is looking at? Does it do anything more intelligent than look at query throughput? I'm thinking something more along the lines of these Snort rules:
#by many very smart people
# This may be a high load sig. Take time and seriously consider
# that your dns_servers var is set as narrowly as possible
alert udp any 53 -> $DNS_SERVERS any (msg:"ET CURRENT_EVENTS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) - possible Cache Poisoning Attempt"; byte_test:2,>,0,6; byte_test:2,>,0,10; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008446; rev:8;)
#this will catch large numbers of nxdomain replies, a sign that someone may be trying to poison you
alert udp any 53 -> $HOME_NET any (msg:"ET CURRENT_EVENTS Excessive NXDOMAIN responses - Possible DNS Poisoning Attempt Backscatter"; byte_test:1,&,128,2; byte_test:1,&,3,1,relative; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008470; rev:1;)

4004 just looks for a flood basically. In s347, we're making that pps rate visible. That number is currently set at 500.
I will say that dns responses with more than 1 RR are completely normal and happen all the time. I was watching some of my own dns traffic and I was getting responses with multipl RRs from things like Yahoo, Google CNN... completely normal and legitimate, nothing odd about it.
Does honing in on that make a sig any more specific - not really - its still a flood. Its the rate thats the kicker and what works for small shops, doesn't work for large shops - so you do have to have some handle of what you "normally" see. I'm not saying that looking for more might not be something that's useful, but it'll largely depend on what you normally see.
The traffic itself is legitimate, albeit crammed with bogus data.

Possible DNS caching problem

Similar Messages

Maybe you are looking for