hi
after a secend of flush the DNS cache this what i had( In Pic) : zvqgmwiav.net unknown 0.0.0.0
zvqgmwiav.cc unknown 0.0.0.0
zrafqswyb.cc unknown 0.0.0.0
and the list go on, when i stop the tracking in ip-firewall-connections
the site stop appearing.
the problem couse site browsing slow and the DNS cache get full in about 10 Min !
is it kind of worm or what?
if it is how to stop it ,
note :
the 0.0.0.0 address and the sites scr address dose not appears in connections list and torch .
It’s probably a worm. ROS does not offer adjusting negative cache lifetime…if you don’t like it tough it up (or make request to MT). If you are inclined on using the caching DNS server you can run a workaround script that will delete negative cache responses every 5 minutes or so.
hi
i did upgade to v 4.10, but still have the same problem
send the problem to mikrotik support was not useful i still bothering them up
and i can’t find such script also i can’t write
MikroTik RouterOS does not offer advanced DNS server setup, it just forwards the DNS requests from client to the configured server, when there is huge number of DNS requests from client, DNS requests are mostly UDP, the most secure way drop them from the specific client.
xezen,
what could be the solution for it, when computer sends tons of DNS requests for 0.0.0.0 address.
MikroTik RouterOS DNS cache is just cache, you can filter DNS requests by firewall, but you could not distinguish good requests from bad requests.
Lowering negative-cache lifetime would lessen the number of useless entries giving more room for valid records. With higher percentage of useful records OP could lower cache size speeding up DNS lookup.
IMO current negative-cache lifetime value invites problems. For example, if DNS cache size is 10000 entries the cache would fill up with useless junk at minimum rate of 10000 bad queries/24h . With lower lifetime, say 5 minutes, the rate would have to be 10000/5 minutes or 172,800,000/24h.
Hello dears
I have the same problem mkr848
The memory is quickly filled with negative entries and begins to fail internet customers solve problems in directions.
I could not detect the failure. If you can see this topic to see what I can do I’m going to thank .
I have already sent the file to support@mikrotik.com supout.rif
(or make request to MT). If you are inclined on using the caching DNS server you can run a workaround script that will delete negative cache responses every 5 minutes or so.
