DNS Queries excessive ?

[Scruff]

I have just checked a wireshark capture of my network traffic from one of our domain controllers and it's showing a shed load of DNS requests for windows update.

 

I have attached a screenshot but the packets can be about 600 in a row, this is between my two DNS servers and then it will attempt the same from both my DNS servers to one on the forward list, they never seem to cache any response as it's pretty constant

 

 

Is this even remotely normal ?

[mattx]

Did you install Wireshark onto the server to do this or did you capture the traffic from another device...?

[Scruff]

it was captured using wireshark installed on the server

[Geoff]

It's a rather strange fixation over windows update you have there. What are the machines that own the IP's in question.

[Scruff]

10.22.161.6 is primary DNS and Domain Controller (which wireshark is running on) and 10.22.161.4 is the secondary DNS server.

 

It seems very odd

[mattx]

The only thing I could come up with was a client is trying to update - but that does not make any sense in regards to the IP addresses.....

[Geoff]

Are these AD intergrated zones, or not?

[Scruff]

Yes they are......

 

*queue excitement as Geoff narrows it down logically *

[Geoff]

I suspect it's DNS updates propergating from one DNS server to the other. As a result of DHCP leases being given out. Are one of these servers the DHCP server for the domain?

[Scruff]

Yes the primary DNS server is also the DHCP server, it strikes me as odd that that many DNS queries can occur in such a short timeline (within a second or two) constantly as leases are not renewed that often

[Geoff]

You would have to post the contents of the packets (or even better, the dump file) for me to look at to be sure.

[Oops_my_bad]

Funny you should mention this - im getting failures on my clients about failing to download updated root lists from that same web host (this was after M$ released a patch that broke WSUS)

[mattx]

I suspect it's DNS updates propergating from one DNS server to the other.

 

That often ?

I suppose you could stop DNS on one of the servers to prove this...