DNS queries “DomainServer.dom.local.dev.null” by QNAP NAS

We encounter strange DNS queries intiated by a QNAP NAS:

DomainServer.dom.local.dev.null

DomainServer.dom.local (name is obfuscated here) is the valid name of the domain controller. But the NAS adds .dev.null to the name.

This looks to me as if a default DNS name is configured which is added automatically. But I can not find such a setting on the NAS.

Can someone explain this?

From the DNS log of the domain controller

Devices in the log

192.168.0.1 = domain controller (DomainServer.dom.local)

192.168.0.16 = QNAP NAS

192.168.0.254 = Sophos UTM

15.01.2019 11:53:39 2728 PACKET  000000E796562170 UDP Rcv 192.168.0.16    4c9e   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)

UDP question info at 000000E796562170

  Socket = 556

  Remote addr 192.168.0.16, port 56856

  Time Query=533586, Queued=0, Expire=0

  Buf length = 0x0fa0 (4000)

  Msg length = 0x0031 (49)

  Message:

    XID       0x4c9e

    Flags     0x0100

      QR        0 (QUESTION)

      OPCODE    0 (QUERY)

      AA        0

      TC        0

      RD        1

      RA        0

      Z         0

      CD        0

      AD        0

      RCODE     0 (NOERROR)

    QCOUNT    1

    ACOUNT    0

    NSCOUNT   0

    ARCOUNT   0

    QUESTION SECTION:

    Offset = 0x000c, RR count = 0

    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"

      QTYPE   AAAA (28)

      QCLASS  1

    ANSWER SECTION:

      empty

    AUTHORITY SECTION:

      empty

    ADDITIONAL SECTION:

      empty



15.01.2019 11:53:39 2728 PACKET  000000E7932A4220 UDP Snd 192.168.0.254   4eb1   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)

UDP question info at 000000E7932A4220

  Socket = 11688

  Remote addr 192.168.0.254, port 53

  Time Query=0, Queued=0, Expire=0

  Buf length = 0x0fa0 (4000)

  Msg length = 0x003c (60)

  Message:

    XID       0x4eb1

    Flags     0x0100

      QR        0 (QUESTION)

      OPCODE    0 (QUERY)

      AA        0

      TC        0

      RD        1

      RA        0

      Z         0

      CD        0

      AD        0

      RCODE     0 (NOERROR)

    QCOUNT    1

    ACOUNT    0

    NSCOUNT   0

    ARCOUNT   1

    QUESTION SECTION:

    Offset = 0x000c, RR count = 0

    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"

      QTYPE   AAAA (28)

      QCLASS  1

    ANSWER SECTION:

      empty

    AUTHORITY SECTION:

      empty

    ADDITIONAL SECTION:

    Offset = 0x0031, RR count = 0

    Name      "(0)"

      TYPE   OPT  (41)

      CLASS  4000

      TTL    32768

      DLEN   0

      DATA   

        Buffer Size  = 4000

        Rcode Ext    = 0

        Rcode Full   = 0

        Version      = 0

        Flags        = 80 DO

Edit

The qnap has the latest firmware installed

We checked the config files and the gui and found no dev/null entry

Not all DNS requests comming from the QNAP are containing the .dev.null; the most requests are regular, like: (12)NameOfServer(3)dom(5)local(0) => NameOfServer.dom.local

edited Jan 23 at 16:13

asked Jan 16 at 13:01

marsh-wiggle

1,80841640

3

Are you sure that in some configuration script somewhere there isn't a miswritten /dev/null?

– harrymc
Jan 18 at 16:39

@harrymc indeed, this was my first attempt after reading "dev null". But we couldn't find any entry. Neither in the GUI nor in configs which were checked by our linux guys. (This is why it came up and we are a little woried: serverfault.com/questions/949361/…)

– marsh-wiggle
Jan 18 at 17:01

1

Did you check the NAS /etc/resolv.conf?

– harrymc
Jan 18 at 17:10

@harrymc only nameserver 192.168.0.1 in resolv.conf

– marsh-wiggle
Jan 22 at 13:49

Is the QNAP firmware updated?

– harrymc
Jan 22 at 14:04

|
show 2 more comments

We encounter strange DNS queries intiated by a QNAP NAS:

DomainServer.dom.local.dev.null

DomainServer.dom.local (name is obfuscated here) is the valid name of the domain controller. But the NAS adds .dev.null to the name.

This looks to me as if a default DNS name is configured which is added automatically. But I can not find such a setting on the NAS.

Can someone explain this?

From the DNS log of the domain controller

Devices in the log

192.168.0.1 = domain controller (DomainServer.dom.local)

192.168.0.16 = QNAP NAS

192.168.0.254 = Sophos UTM

15.01.2019 11:53:39 2728 PACKET  000000E796562170 UDP Rcv 192.168.0.16    4c9e   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)

UDP question info at 000000E796562170

  Socket = 556

  Remote addr 192.168.0.16, port 56856

  Time Query=533586, Queued=0, Expire=0

  Buf length = 0x0fa0 (4000)

  Msg length = 0x0031 (49)

  Message:

    XID       0x4c9e

    Flags     0x0100

      QR        0 (QUESTION)

      OPCODE    0 (QUERY)

      AA        0

      TC        0

      RD        1

      RA        0

      Z         0

      CD        0

      AD        0

      RCODE     0 (NOERROR)

    QCOUNT    1

    ACOUNT    0

    NSCOUNT   0

    ARCOUNT   0

    QUESTION SECTION:

    Offset = 0x000c, RR count = 0

    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"

      QTYPE   AAAA (28)

      QCLASS  1

    ANSWER SECTION:

      empty

    AUTHORITY SECTION:

      empty

    ADDITIONAL SECTION:

      empty



15.01.2019 11:53:39 2728 PACKET  000000E7932A4220 UDP Snd 192.168.0.254   4eb1   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)

UDP question info at 000000E7932A4220

  Socket = 11688

  Remote addr 192.168.0.254, port 53

  Time Query=0, Queued=0, Expire=0

  Buf length = 0x0fa0 (4000)

  Msg length = 0x003c (60)

  Message:

    XID       0x4eb1

    Flags     0x0100

      QR        0 (QUESTION)

      OPCODE    0 (QUERY)

      AA        0

      TC        0

      RD        1

      RA        0

      Z         0

      CD        0

      AD        0

      RCODE     0 (NOERROR)

    QCOUNT    1

    ACOUNT    0

    NSCOUNT   0

    ARCOUNT   1

    QUESTION SECTION:

    Offset = 0x000c, RR count = 0

    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"

      QTYPE   AAAA (28)

      QCLASS  1

    ANSWER SECTION:

      empty

    AUTHORITY SECTION:

      empty

    ADDITIONAL SECTION:

    Offset = 0x0031, RR count = 0

    Name      "(0)"

      TYPE   OPT  (41)

      CLASS  4000

      TTL    32768

      DLEN   0

      DATA   

        Buffer Size  = 4000

        Rcode Ext    = 0

        Rcode Full   = 0

        Version      = 0

        Flags        = 80 DO

Edit

The qnap has the latest firmware installed

We checked the config files and the gui and found no dev/null entry

Not all DNS requests comming from the QNAP are containing the .dev.null; the most requests are regular, like: (12)NameOfServer(3)dom(5)local(0) => NameOfServer.dom.local

edited Jan 23 at 16:13

asked Jan 16 at 13:01

marsh-wiggle

1,80841640

3

Are you sure that in some configuration script somewhere there isn't a miswritten /dev/null?

– harrymc
Jan 18 at 16:39

@harrymc indeed, this was my first attempt after reading "dev null". But we couldn't find any entry. Neither in the GUI nor in configs which were checked by our linux guys. (This is why it came up and we are a little woried: serverfault.com/questions/949361/…)

– marsh-wiggle
Jan 18 at 17:01

1

Did you check the NAS /etc/resolv.conf?

– harrymc
Jan 18 at 17:10

@harrymc only nameserver 192.168.0.1 in resolv.conf

– marsh-wiggle
Jan 22 at 13:49

Is the QNAP firmware updated?

– harrymc
Jan 22 at 14:04

|
show 2 more comments

We encounter strange DNS queries intiated by a QNAP NAS:

DomainServer.dom.local.dev.null

DomainServer.dom.local (name is obfuscated here) is the valid name of the domain controller. But the NAS adds .dev.null to the name.

This looks to me as if a default DNS name is configured which is added automatically. But I can not find such a setting on the NAS.

Can someone explain this?

From the DNS log of the domain controller

Devices in the log

192.168.0.1 = domain controller (DomainServer.dom.local)

192.168.0.16 = QNAP NAS

192.168.0.254 = Sophos UTM

15.01.2019 11:53:39 2728 PACKET  000000E796562170 UDP Rcv 192.168.0.16    4c9e   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)

UDP question info at 000000E796562170

  Socket = 556

  Remote addr 192.168.0.16, port 56856

  Time Query=533586, Queued=0, Expire=0

  Buf length = 0x0fa0 (4000)

  Msg length = 0x0031 (49)

  Message:

    XID       0x4c9e

    Flags     0x0100

      QR        0 (QUESTION)

      OPCODE    0 (QUERY)

      AA        0

      TC        0

      RD        1

      RA        0

      Z         0

      CD        0

      AD        0

      RCODE     0 (NOERROR)

    QCOUNT    1

    ACOUNT    0

    NSCOUNT   0

    ARCOUNT   0

    QUESTION SECTION:

    Offset = 0x000c, RR count = 0

    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"

      QTYPE   AAAA (28)

      QCLASS  1

    ANSWER SECTION:

      empty

    AUTHORITY SECTION:

      empty

    ADDITIONAL SECTION:

      empty



15.01.2019 11:53:39 2728 PACKET  000000E7932A4220 UDP Snd 192.168.0.254   4eb1   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)

UDP question info at 000000E7932A4220

  Socket = 11688

  Remote addr 192.168.0.254, port 53

  Time Query=0, Queued=0, Expire=0

  Buf length = 0x0fa0 (4000)

  Msg length = 0x003c (60)

  Message:

    XID       0x4eb1

    Flags     0x0100

      QR        0 (QUESTION)

      OPCODE    0 (QUERY)

      AA        0

      TC        0

      RD        1

      RA        0

      Z         0

      CD        0

      AD        0

      RCODE     0 (NOERROR)

    QCOUNT    1

    ACOUNT    0

    NSCOUNT   0

    ARCOUNT   1

    QUESTION SECTION:

    Offset = 0x000c, RR count = 0

    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"

      QTYPE   AAAA (28)

      QCLASS  1

    ANSWER SECTION:

      empty

    AUTHORITY SECTION:

      empty

    ADDITIONAL SECTION:

    Offset = 0x0031, RR count = 0

    Name      "(0)"

      TYPE   OPT  (41)

      CLASS  4000

      TTL    32768

      DLEN   0

      DATA   

        Buffer Size  = 4000

        Rcode Ext    = 0

        Rcode Full   = 0

        Version      = 0

        Flags        = 80 DO

Edit

The qnap has the latest firmware installed

We checked the config files and the gui and found no dev/null entry

Not all DNS requests comming from the QNAP are containing the .dev.null; the most requests are regular, like: (12)NameOfServer(3)dom(5)local(0) => NameOfServer.dom.local

edited Jan 23 at 16:13

asked Jan 16 at 13:01

marsh-wiggle

1,80841640

We encounter strange DNS queries intiated by a QNAP NAS:

DomainServer.dom.local.dev.null

DomainServer.dom.local (name is obfuscated here) is the valid name of the domain controller. But the NAS adds .dev.null to the name.

This looks to me as if a default DNS name is configured which is added automatically. But I can not find such a setting on the NAS.

Can someone explain this?

From the DNS log of the domain controller

Devices in the log

192.168.0.1 = domain controller (DomainServer.dom.local)

192.168.0.16 = QNAP NAS

192.168.0.254 = Sophos UTM

15.01.2019 11:53:39 2728 PACKET  000000E796562170 UDP Rcv 192.168.0.16    4c9e   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)

UDP question info at 000000E796562170

  Socket = 556

  Remote addr 192.168.0.16, port 56856

  Time Query=533586, Queued=0, Expire=0

  Buf length = 0x0fa0 (4000)

  Msg length = 0x0031 (49)

  Message:

    XID       0x4c9e

    Flags     0x0100

      QR        0 (QUESTION)

      OPCODE    0 (QUERY)

      AA        0

      TC        0

      RD        1

      RA        0

      Z         0

      CD        0

      AD        0

      RCODE     0 (NOERROR)

    QCOUNT    1

    ACOUNT    0

    NSCOUNT   0

    ARCOUNT   0

    QUESTION SECTION:

    Offset = 0x000c, RR count = 0

    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"

      QTYPE   AAAA (28)

      QCLASS  1

    ANSWER SECTION:

      empty

    AUTHORITY SECTION:

      empty

    ADDITIONAL SECTION:

      empty



15.01.2019 11:53:39 2728 PACKET  000000E7932A4220 UDP Snd 192.168.0.254   4eb1   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)

UDP question info at 000000E7932A4220

  Socket = 11688

  Remote addr 192.168.0.254, port 53

  Time Query=0, Queued=0, Expire=0

  Buf length = 0x0fa0 (4000)

  Msg length = 0x003c (60)

  Message:

    XID       0x4eb1

    Flags     0x0100

      QR        0 (QUESTION)

      OPCODE    0 (QUERY)

      AA        0

      TC        0

      RD        1

      RA        0

      Z         0

      CD        0

      AD        0

      RCODE     0 (NOERROR)

    QCOUNT    1

    ACOUNT    0

    NSCOUNT   0

    ARCOUNT   1

    QUESTION SECTION:

    Offset = 0x000c, RR count = 0

    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"

      QTYPE   AAAA (28)

      QCLASS  1

    ANSWER SECTION:

      empty

    AUTHORITY SECTION:

      empty

    ADDITIONAL SECTION:

    Offset = 0x0031, RR count = 0

    Name      "(0)"

      TYPE   OPT  (41)

      CLASS  4000

      TTL    32768

      DLEN   0

      DATA   

        Buffer Size  = 4000

        Rcode Ext    = 0

        Rcode Full   = 0

        Version      = 0

        Flags        = 80 DO

Edit

The qnap has the latest firmware installed

We checked the config files and the gui and found no dev/null entry

Not all DNS requests comming from the QNAP are containing the .dev.null; the most requests are regular, like: (12)NameOfServer(3)dom(5)local(0) => NameOfServer.dom.local

dns query qnap

edited Jan 23 at 16:13

asked Jan 16 at 13:01

marsh-wiggle

1,80841640

edited Jan 23 at 16:13

asked Jan 16 at 13:01

marsh-wiggle

1,80841640

edited Jan 23 at 16:13

asked Jan 16 at 13:01

marsh-wiggle

1,80841640

asked Jan 16 at 13:01

marsh-wiggle

1,80841640

asked Jan 16 at 13:01

marsh-wiggle

1,80841640

3

Are you sure that in some configuration script somewhere there isn't a miswritten /dev/null?

– harrymc
Jan 18 at 16:39

@harrymc indeed, this was my first attempt after reading "dev null". But we couldn't find any entry. Neither in the GUI nor in configs which were checked by our linux guys. (This is why it came up and we are a little woried: serverfault.com/questions/949361/…)

– marsh-wiggle
Jan 18 at 17:01

1

Did you check the NAS /etc/resolv.conf?

– harrymc
Jan 18 at 17:10

@harrymc only nameserver 192.168.0.1 in resolv.conf

– marsh-wiggle
Jan 22 at 13:49

Is the QNAP firmware updated?

– harrymc
Jan 22 at 14:04

|
show 2 more comments

3

Are you sure that in some configuration script somewhere there isn't a miswritten /dev/null?

– harrymc
Jan 18 at 16:39

@harrymc indeed, this was my first attempt after reading "dev null". But we couldn't find any entry. Neither in the GUI nor in configs which were checked by our linux guys. (This is why it came up and we are a little woried: serverfault.com/questions/949361/…)

– marsh-wiggle
Jan 18 at 17:01

1

Did you check the NAS /etc/resolv.conf?

– harrymc
Jan 18 at 17:10

@harrymc only nameserver 192.168.0.1 in resolv.conf

– marsh-wiggle
Jan 22 at 13:49

Is the QNAP firmware updated?

– harrymc
Jan 22 at 14:04

Are you sure that in some configuration script somewhere there isn't a miswritten /dev/null?

– harrymc
Jan 18 at 16:39

@harrymc indeed, this was my first attempt after reading "dev null". But we couldn't find any entry. Neither in the GUI nor in configs which were checked by our linux guys. (This is why it came up and we are a little woried: serverfault.com/questions/949361/…)

– marsh-wiggle
Jan 18 at 17:01

Did you check the NAS /etc/resolv.conf?

– harrymc
Jan 18 at 17:10

@harrymc only nameserver 192.168.0.1 in resolv.conf

– marsh-wiggle
Jan 22 at 13:49

Is the QNAP firmware updated?

– harrymc
Jan 22 at 14:04

|
show 2 more comments

0

active

oldest

votes

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1394936%2fdns-queries-domainserver-dom-local-dev-null-by-qnap-nas%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

0

active

oldest

votes

0

active

oldest

votes

draft saved

draft discarded

Thanks for contributing an answer to Super User!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Csdrhrt