About discourse.pi-hole.net query

sjip · April 7, 2020, 5:10pm

Hi i am new to Pi hole, when i look in query log i see discourse.pi-hole.net having a event every minute, actually its in 4 in top permitted domains, my browser Firefox is set to delete cookies at shut/close and it is only happening when my main computer is on.
Even after my computer have been shut down for for hours, it starts when i start my computer.
I have the same with Bing, but that i guess is something with windows.
So my question is why does discourse.pi-hole.net show up that much?

Sjip

DanSchaper · April 7, 2020, 5:11pm

It's not something on Pi-hole's end. Your browser is doing some kind of caching or pre-fetching is my guess.

DanSchaper · April 7, 2020, 5:13pm

How many hits for that domain?

sjip · April 7, 2020, 5:18pm

288 in 29 hours, some i have been online here

DanSchaper · April 7, 2020, 5:26pm

That's very minimal. The TTL on discourse is 1 hour. If 288 hits is in your top 4 then you really don't have many queries going to the Pi-hole DNS.

sjip · April 7, 2020, 5:31pm

Okay but i dont understand why i can come home, start my computer, not going to any sites, but see discourse.pi-hole.net every minute, even though i havent been on that site( here ) for several hours.

DanSchaper · April 7, 2020, 5:35pm

I don't know either. Not trying to be glib but I really don't.

sjip · April 7, 2020, 5:38pm

Hey Thx Dan you tried maybe someone else have seen this behavior

DanSchaper · April 7, 2020, 6:36pm

I'm seeing some AAAA queries happening on my Windows 10 box, but only when I have FF open. I hadn't had AAAA records for discourse before but I can add them and increase the TTL to 6 or 12 hours. Wont fix your particular issue of seeing queries when there isn't a reason but it will lower the number of queries that are happening.

jfb · April 7, 2020, 6:58pm

What is the output of grep discourse.pi-hole.net /var/log/pihole.log (output may be lengthy).

sjip · April 7, 2020, 7:00pm

I was thinking it was something with ipv6, yesterday i set up custom dns servers to 2606:4700:4700::1112 and 2606:4700:4700::1002 ipv6

sjip · April 7, 2020, 7:21pm

here is a piece of it

Apr  7 19:40:51 dnsmasq[6236]: forwarded discourse.pi-hole.net to 1.0.0.1
Apr  7 19:40:51 dnsmasq[6236]: reply discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:41:14 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:41:14 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:41:27 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:41:27 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:41:54 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:41:54 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:42:20 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:42:20 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:42:29 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:42:29 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:43:20 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:43:20 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:44:22 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:44:22 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:45:23 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:45:23 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 19:46:19 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 19:46:19 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:21:56 dnsmasq[6236]: query[A] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:21:56 dnsmasq[6236]: forwarded discourse.pi-hole.net to 1.0.0.1
Apr  7 20:21:56 dnsmasq[6236]: reply discourse.pi-hole.net is 159.203.95.226
Apr  7 20:21:56 dnsmasq[6236]: query[A] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:21:56 dnsmasq[6236]: cached discourse.pi-hole.net is 159.203.95.226
Apr  7 20:21:56 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:21:56 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:22:18 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:22:18 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:22:32 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:22:32 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:22:41 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:22:41 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:22:57 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:22:57 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:23:45 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:23:45 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:23:58 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:23:58 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:24:45 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:24:45 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:24:59 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:24:59 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:25:45 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:25:45 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:26:46 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:26:46 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:27:00 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:27:00 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:27:46 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:27:46 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:27:52 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:27:52 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:33:04 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:33:04 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:41:10 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:41:10 dnsmasq[6236]: forwarded discourse.pi-hole.net to 1.1.1.2
Apr  7 20:41:10 dnsmasq[6236]: reply discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:42:11 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:42:11 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:44:12 dnsmasq[6236]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:44:12 dnsmasq[6236]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:54:49 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:54:49 dnsmasq[7670]: forwarded discourse.pi-hole.net to 1.1.1.1
Apr  7 20:54:49 dnsmasq[7670]: reply discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:55:15 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:55:15 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:55:43 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:55:43 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:55:52 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:55:52 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:56:33 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:56:33 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:56:39 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:56:39 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:56:48 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:56:48 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:56:59 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:56:59 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:57:05 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:57:05 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:57:18 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:57:18 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:57:29 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:57:29 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:57:33 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:57:33 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6
Apr  7 20:57:40 dnsmasq[7670]: query[AAAA] discourse.pi-hole.net from 192.168.2.129
Apr  7 20:57:40 dnsmasq[7670]: cached discourse.pi-hole.net is NODATA-IPv6

jfb · April 7, 2020, 9:24pm

The client at IP 29 is making the requests. Note that the A query (IPv4) was answered, but none of the matching AAAA (IPv6) queries were answered. The client may be repeating the request pending an answer.

sjip · April 8, 2020, 5:57am

Desktop started at 4.48, went to get coffee 2-3 mins, logged in to pihole on chrome browser, waited a few minutes, started firefox, around 4.55, on start page google, and left it there.
5.03 i still only have been on pi.hole/admin with chrome and google with firefox
2020-04-08 05:03:11 AAAA discourse.pi-hole.net 192.168.2.129 OK (forwarded) IP (52.4ms)
2020-04-08 05:03:11 A discourse.pi-hole.net 192.168.2.129 OK (cached) IP (0.2ms)
2020-04-08 05:03:11 A discourse.pi-hole.net 192.168.2.129 OK (forwarded) IP (19.4ms)
At 5.21 i checked this tread on my laptop
2020-04-08 05:21:46 A discourse.pi-hole.net 192.168.2.160 OK (cached) IP (0.2ms)

Somehow it have look like it has stopped, 1½ hour after last entry from my desktop( 129 ) i cleared all cache and saved sites in firefox.
Last entry
2020-04-08 07:11:23 A discourse.pi-hole.net 192.168.2.160 OK (cached) IP (0.2ms)
Thats ½hour ago, so ill keep an eye on it, but looks like its somehow is fixed.
Thanks

jfb · October 1, 2020, 9:29pm

3 posts were split to a new topic: Unusual domains in query log