MDNS Spam?

MIFay

Hi! Last Monday we had a device on our network (Windows 10 Pro - Microsoft Surface) that was trying to go out to get windows updates, a robot software update and at the same time the Fingbox tried to query it for its info. It appears that the Surface and the Fingbox got stuck in a loop doing mDNS spam to the point that the network came to a crawl.

1    0.000000000    192.168.40.44    224.0.0.251    MDNS    86    Standard query 0x0000 PTR 72.40.168.192.in-addr.arpa, "QM" question
2    0.000100144    192.168.40.72    224.0.0.251    MDNS    60    Standard query response 0x0000

This was going at 7200 requests per second.

It also looks like the TTL was set to 1 second, which I'm not sure how that happened. Any ideas?

kltaylor

Yikes!
This is something that I think the internal Fing team needs to address.  Hang in there @MIFay.  Other than that, welcome to the community, and thanks for posting your question.

VioletChepil

Hi @MIFay thanks for your question and welcome.
Just checking in with the team on this one as its not something I've come across yet.

Robin

Hi @MIFay
Can you try to disable the Reverse DNS request from the Fing app and then perform a power cycle of the Fingbox and then check if anything changes.Here is how to do that: 
1. Open the Fing App 
2. Click on the avatar of you in the upper right hand corner under the clock.  This will open Account and Settings. 
3. Click on 'App Settings' 
4. Click on on the green enable beside 'Reverse DNS Lookup'.  This will disable this feature.