From owner-freebsd-questions@FreeBSD.ORG  Sat Feb 28 05:32:50 2009
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 141A61065673
	for <freebsd-questions@freebsd.org>;
	Sat, 28 Feb 2009 05:32:50 +0000 (UTC)
	(envelope-from smithi@nimnet.asn.au)
Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [220.233.188.227])
	by mx1.freebsd.org (Postfix) with ESMTP id 8CF638FC1A
	for <freebsd-questions@freebsd.org>;
	Sat, 28 Feb 2009 05:32:49 +0000 (UTC)
	(envelope-from smithi@nimnet.asn.au)
Received: from localhost (localhost [127.0.0.1])
	by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id n1S5WlVE060250
	for <freebsd-questions@freebsd.org>;
	Sat, 28 Feb 2009 16:32:47 +1100 (EST)
	(envelope-from smithi@nimnet.asn.au)
Date: Sat, 28 Feb 2009 16:32:47 +1100 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: freebsd-questions@freebsd.org
Message-ID: <20090228161606.N71460@sola.nimnet.asn.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: Odd DNS requests
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 28 Feb 2009 05:32:50 -0000

Hi,

recently we've had a Mac notebook of some sort on our LAN, that likes to 
make these DNS queries from time to time, to no avail, as noticed on a 
filtering bridge between the LAN and the router+DNS at 192.168.0.1:

16:13:05.020397 192.168.0.59.53207 > 192.168.0.1.53:  63162+ PTR? b._dns-sd._udp.0.0.168.192.in-addr.arpa. (57) [tos 0x18]
16:13:05.021093 192.168.0.1.53 > 192.168.0.59.53207:  63162 NXDomain* 0/1/0 (128) (DF)
16:13:05.215790 192.168.0.59.64633 > 192.168.0.1.53:  61059+ PTR? db._dns-sd._udp.0.0.168.192.in-addr.arpa. (58) [tos 0x18]
16:13:05.216469 192.168.0.1.53 > 192.168.0.59.64633:  61059 NXDomain* 0/1/0 (129) (DF)
16:13:05.226242 192.168.0.59.61635 > 192.168.0.1.53:  6749+ PTR? r._dns-sd._udp.0.0.168.192.in-addr.arpa. (57) [tos 0x18]
16:13:05.226789 192.168.0.1.53 > 192.168.0.59.61635:  6749 NXDomain* 0/1/0 (128) (DF)
16:13:05.237319 192.168.0.59.56300 > 192.168.0.1.53:  21450+ PTR? dr._dns-sd._udp.0.0.168.192.in-addr.arpa. (58) [tos 0x18]
16:13:05.237842 192.168.0.1.53 > 192.168.0.59.56300:  21450 NXDomain* 0/1/0 (129) (DF)
16:13:05.248440 192.168.0.59.60806 > 192.168.0.1.53:  10032+ PTR? lb._dns-sd._udp.0.0.168.192.in-addr.arpa. (58) [tos 0x18]
16:13:05.249252 192.168.0.1.53 > 192.168.0.59.60806:  10032 NXDomain* 0/1/0 (129) (DF)

What exactly are these hoping to discover, and what needs turning off in 
the Mac's setup (OSX, most likely a recent version) to quell them?

cheers, Ian  (please cc me, I'm subscribed to the -digest)