Extreme number of queries passed to Pi-hole - dnsmasq throttling lookups

Help
1

Zero luck on my end, every device is blocked, and my router is blocked as well.
Nothing is sent back, but the queries are logged. Seems there is a DNS pb for sure.

There is something wrong about the queries though, the time is completely messed up (showing 1494609479 for today), it seems there is a huge amount of queries that cannot be flushed (70.000 entries as I just flushed the log)

  • Updated to 3.0.1 from 2.11.1 did nothing, I'm gonna try flushing the app completely from the Pi side and try again...

::: Beginning Pi-hole debug at Fri May 12 19:33:59 CEST 2017!
:::
::: This process collects information from your Pi-hole, and optionally uploads
::: it to a unique and random directory on tricorder.pi-hole.net.
:::
::: NOTE: All log files auto-delete after 48 hours and ONLY the Pi-hole developers
::: can access your data via the given token. We have taken these extra steps to
::: secure your data and will work to further reduce any personal information gathered.
:::
::: Please read and note any issues, and follow any directions advised during this process.
:::
::: ---= Detecting Installed Package Versions:
::: Pi-hole: v3.0.1 (master:v3.0.1-0-g26fcb1b)
::: Pi-hole Dashboard: v3.0.1 (master:v3.0.1-0-ge204cea)
::: lighttpd/1.4.35
::: PHP 5.6.29-0+deb8u1 (cli) (built: Dec 17 2016 06:04:43)
:::
::: ---= Detecting existence of /etc/pihole/setupVars.conf:
::: File exists, parsing...done and was successfully sourced
:::
::: ---= Detecting installed OS Distribution
:::
::: ---= Checking processor variety
:::
::: ---= Checking IPv6 Stack
::: IPv6 addresses located on eth0
::: No gateway detected.
:::
::: ---= Checking IPv4 Stack
::: IPv4 addresses located on eth0
::: Pinging default IPv4 gateway: Gateway responded.
::: Pinging Internet via IPv4: Query responded.
:::
::: ---= Daemon Process Information
::: Checking http port for lighttpd listener.
::: Correctly configured.
:::
::: ---= Daemon Process Information
::: Checking domain port for dnsmasq listener.
::: Correctly configured.
:::
::: ---= Daemon Process Information
::: Checking 4711 port for pihole-FTL listener.
::: Correctly configured.
:::
::: ---= Processes Check
::: Logging status of lighttpd, dnsmasq and pihole-FTL...
:::
::: ---= Resolver Functions Check (IPv4)
:::
::: ---= Resolver Functions Check (IPv6)
::: Checking for necessary lighttpd files.
:::
::: ---= Detecting existence of /etc/lighttpd/lighttpd.conf:
::: File exists, parsing...done
:::
::: ---= Detecting existence of /var/log/lighttpd/error.log:
::: File exists, parsing...done
:::
:::
::: ---= Detecting existence of /etc/dnsmasq.conf:
::: File exists, parsing...done
:::
::: ---= Detecting contents of /etc/dnsmasq.d/*:
:::
::: ---= File /etc/dnsmasq.d/01-pihole.conf found
::: Parsing...done
:::
::: ---= File /etc/dnsmasq.d/README found
::: Parsing...done
:::
:::
::: ---= Detecting existence of /etc/pihole/whitelist.txt:
::: File exists, parsing...done
:::
::: ---= Detecting existence of /etc/pihole/blacklist.txt:
::: File exists, parsing...done
:::
::: ---= Detecting existence of /etc/pihole/adlists.list:
::: File exists, parsing...done
:::
::: ---= Analyzing gravity.list
:::
::: ---= Analyzing pihole.log
:::
::: ---= Analyzing pihole-FTL.log

2

What version of dnsmasq are you all using. There was an update pushed out from some distributions recently and I'm trying to see if the two are related.

If you could run dnsmasq -v and if you are on Debian/Raspbian/Ubuntu also run apt-cache policy dnsmasq it would help track down the issues.

3

Dnsmasq is 2.76-5+rpil
The output is also (table versions)

I just made a full update/upgrade of the PI and did a repair, but amazingly all settings subsisted...

  • I also have 200 DNS queries/s (super weird?) when connected, and the log says "max 150DNS queries/s reached)

Switching to uninstalling pihole and reinstalling, I'll see if it wipes it completely...

4

You seem to have a rogue device that is just hammering the DNS server. What does your Admin page look like for traffic and domains?

5

image.png1002×438 35.8 KB

This is 30 minutes of logs.......Yes, 80K DNS requests.
Most requests are for Google & Facebook tho. There is only one device attached to the network (checked my router) and it's my computer.

There is also a conflicting extension on my end, because it doesn't look the same when loaded in private browsing.

I'm currently uninstalling pihole and reinstalling it, should post in 5 minutes (that Pi is slow :p)

Thank you very much for the support tho, really appreciate !

6

Split this to its own topic, as you are seeing dnsmasq throttling connections and that is a different issue to troubleshoot.

7

Still no luck after reinstall.

  • Side note : it is NOT safe to remove dependencies, as it will remove curl during uninstall.

In the end,

  • still got extreme hammering of DNS queries (mostly local services and plugins : facebook, amazon, dropbox...)
  • the interface is available at anytime, shows log queries, but doesn't seems to answer
  • dnsmasq & base still is 2.76

I'll try wiping my raspberry pi since I only have pihole on it, but maybe not tonight ^^

  • I'll try using wifi instead of ethernet on the Pi as well before that

Thanks :wink: