RB1100AHx4 queries for www.mikrotik.com

RouterOS General
1

Hello

I have a RB1100AHx4 that sends lots of queries for www.mikrotik.com
The DNS on the router is not enabled.
No NAT, only routing.
No scripts, no netwatch and I am unable to find the reason why this router queries www.mikrotik.com so much.
As soon as I flush DNS cache, the record pops back in.
query.png
Any hints please?

2
  • capture some of these packets and have a look inside … dns is propably good for some information bouta source of these requests
  • disable the web-interface (if it’s enabled) of the router … there’s a link … maybe a client is triggering that link (may be you : )
3

… and you should have blacked out every other url in the screenshot … so it’s an easy guess :slight_smile:

4

As I said: “The DNS on the router is not enabled.”, thus no clients behind the router can cause this.
Somehow, the router itself queries for www.mikrotik.com

5

What does /ip cloud print show?

6

From this article, if you have internet detect on interface, the router will query Periodically the Mikrotik site: https://wiki.mikrotik.com/wiki/Manual:Detect_internet

7

As I said: “The DNS on the router is not enabled.”

.
there is no “The DNS” on the router …
there is a dns resolver in the ip stack
and a service which you can enable or not.
.
if there is no dns-server-entry in the /ip/dns-settings … you can still catch a dns-server address if a dhcp-client is active on your router
.
… so have a look inside the packets …in there, the truth you should find .iV