Not entirely sure what I am expecting to happen, other than the PiHole not making 2000+ queries on the hour, every hour - this affects my ability to use the graphs as the huge number of queries swamps any diagnostics
PiHole Localhost makes around 2000 queries per hour.
All yellow spikes are from localhost. Seems to happen every hour on the hour.
These appear to be unresolved PTR requests. Pi-hole polls hourly to determine the name of clients on the network, and these cannot be resolved. If the IPv6 address is for a device on your network, your upstream DNS server (Cloudflare) will not be able to resolve it.
*** [ DIAGNOSING ]: Pi-hole log
-rw-r--r-- 1 pihole pihole 18202303 Nov 8 14:45 /var/log/pihole.log
-----head of pihole.log------
Nov 8 00:00:10 dnsmasq[29291]: reply 2a00:23c8:2f89:9800:b919:df8f:e8f2:5f06 is NXDOMAIN
Nov 8 00:00:10 dnsmasq[29291]: query[PTR] 6.0.f.5.2.f.8.e.f.8.f.d.9.1.9.b.0.0.8.9.9.8.f.2.8.c.3.2.0.0.a.2.ip6.arpa from 127.0.0.1
Nov 8 00:00:10 dnsmasq[29291]: cached 2a00:23c8:2f89:9800:b919:df8f:e8f2:5f06 is NXDOMAIN
Nov 8 00:00:10 dnsmasq[29291]: query[PTR] 6.0.f.5.2.f.8.e.f.8.f.d.9.1.9.b.0.0.0.0.e.e.d.d.c.c.b.b.a.a.d.f.ip6.arpa from 127.0.0.1
Nov 8 00:00:10 dnsmasq[29291]: forwarded 6.0.f.5.2.f.8.e.f.8.f.d.9.1.9.b.0.0.0.0.e.e.d.d.c.c.b.b.a.a.d.f.ip6.arpa to 1.1.1.1
Nov 8 00:00:10 dnsmasq[29291]: query[PTR] 6.0.f.5.2.f.8.e.f.8.f.d.9.1.9.b.0.0.0.0.e.e.d.d.c.c.b.b.a.a.d.f.ip6.arpa from 127.0.0.1
Nov 8 00:00:10 dnsmasq[29291]: forwarded 6.0.f.5.2.f.8.e.f.8.f.d.9.1.9.b.0.0.0.0.e.e.d.d.c.c.b.b.a.a.d.f.ip6.arpa to 1.1.1.1
Nov 8 00:00:10 dnsmasq[29291]: query[PTR] 9.c.e.8.d.5.2.e.e.2.f.6.d.9.d.5.0.0.0.0.e.e.d.d.c.c.b.b.a.a.d.f.ip6.arpa from 127.0.0.1
Nov 8 00:00:10 dnsmasq[29291]: forwarded 9.c.e.8.d.5.2.e.e.2.f.6.d.9.d.5.0.0.0.0.e.e.d.d.c.c.b.b.a.a.d.f.ip6.arpa to 1.1.1.1
Nov 8 00:00:10 dnsmasq[29291]: query[PTR] 9.c.e.8.d.5.2.e.e.2.f.6.d.9.d.5.0.0.0.0.e.e.d.d.c.c.b.b.a.a.d.f.ip6.arpa from 127.0.0.1
Nov 8 00:00:10 dnsmasq[29291]: forwarded 9.c.e.8.d.5.2.e.e.2.f.6.d.9.d.5.0.0.0.0.e.e.d.d.c.c.b.b.a.a.d.f.ip6.arpa to 1.1.1.1
Nov 8 00:00:10 dnsmasq[29291]: query[PTR] 9.c.e.8.d.5.2.e.e.2.f.6.d.9.d.5.0.0.8.9.9.8.f.2.8.c.3.2.0.0.a.2.ip6.arpa from 127.0.0.1
Nov 8 00:00:10 dnsmasq[29291]: forwarded 9.c.e.8.d.5.2.e.e.2.f.6.d.9.d.5.0.0.8.9.9.8.f.2.8.c.3.2.0.0.a.2.ip6.arpa to 1.1.1.1
Nov 8 00:00:11 dnsmasq[29291]: reply 2a00:23c8:2f89:9800:5d9d:6f2e:e25d:8ec9 is NXDOMAIN
Thanks for this. Is there anything I can do about this?
I suspect that there are lots of requests as at least one client seems to have tens of IPv6 addresses
I'm not sure whether those IPv6 addresses would contribute to your issue, but let's get a count of known IP addresses for a network device and see if they'd accumulate to somewhere near your 2,000 mark.
Please run the following command on your Pi-hole machine:
sqlite3 /etc/pihole/pihole-FTL.db \
"SELECT net.id, count(adr.ip), net.name \
FROM network net, network_addresses adr \
WHERE net.id = adr.network_id \
GROUP BY net.hwaddr ORDER BY 2 DESC;"
There are 476 lines (full output is attached).
Top 20 lines are:
72|8573|laptop-3mddpa6k.lan
73|3498|laptop-ugl7m7tg.lan
58|634|desktop-n128l1n.lan
60|17|galaxy-a5-2017.lan
39|16|ceolwulf.lan
22|13|galaxy-tab-a-2016.lan
7|11|android-c845dbd6791a377c.lan
54|4|amazon-ed4950d1b.lan
74|3|
6|2|colin-pc.lan
75|2|
52|1|colin-pc.lan
27|1|iphone.lan
34|1|
2|1|
37|1|
36|1|ceolwulf.lan
4|1|humax.lan
16|1|colin-pc.lan
Output.txt (4.4 KB)
You can disable IPv6 on your LAN.
Thanks. I'll do that. As my PiHole is acting as DHCP server for the LAN, presumably just unticking the Enable IPv6 support in the Advanced DHCP settings is all I need to do.
Also disable IPv6 on the router so it doesn't try to sneak in any IPv6 addresses to clients.
Many thanks to everyon for their help in sorting this problem. Not only does disabling IPv6 sort my issues with spikes in the graphs, the graphs also load vastly quicker than they did - two birds with one stone 
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.
