Reverse DNS lookups on 172.17.0.1?

[ben-sec]

Hi!

Why do all my SO nodes do thousands of reverse DNS lookups on the IP 172.17.0.1 (docker0 interface)? Even a fresh install, not connected to my SO grid, is behaving like that.

Cheers, Ben

[ben-sec]

No ideas?

[0nnyx]

Probably due to bad SO configuration/implementation. Docker doesn't flood dns requests by default.
Likewise, SO floods dns requests for the mgmt IP, which isn't supposed to happen either.
You can stop this crap by adding these line in /etc/hosts to make the entries static :

172.17.0.1   1.0.17.172.in-addr.arpa
<MGMT IP>   <reversed MGMT IP>.in-addr.arpa securityonion.<domain>

[ben-sec]

Thanks!