One Client sends too many request

Help Community Help
1

Please follow the below template, it will help us to help you!

If you are Experiencing issues with a Pi-hole install that has non-standard elements (e.g you are using nginx instead of lighttpd, or there is some other aspect of your install that is customised) - please use the Community Help category.

Background:

Ubuntu 21.10 (GNU/Linux 5.13.0-35-generic x86_64)
Running on virtual machine on a FreeNas box
Unbounded + DoH setup per Pi-Hole guild.
DHCP on router.

Expected behavior

Find out why computer all of sudden is sending so much request. Is it because pi-hole can't answer some request and there is retry logic somewhere? One clients sends 10x more than all my other device seems excessive.
If I can't find out why so much queries are being send. Limit this one laptop only to process web browser queries maybe (just A and AAAA records)

Actual Behaviour:

I am seeing pi-hole all of sudden processing so much query from one laptop (about 10x in compares to other client) and causing different warnings on pi-hole system:
Maximum number of concurrent DNS queries reached (max: 150)
reducing DNS packet size for nameserver 127.0.0.1 to 1232

4

This is solved. Here is what you do in a similar situation.
In Pi-hole admin. Use the query for long-term data where it queries the DB. See "Top list" for last 24 hours. Look at the domains that was requested the most.

In query for long-term data, query for for logs for the same period. Filter by domains from the top list. Sort by client IP. Now you see the problem client is sending too much request to pi-hole.

On that client, if it is a Mac, create custom DNS resolver by creating files under '/etc/resolver'. For example:
If I want all request for apple.com to go to another DNS resolver. I will do:
sudo nano /etc/resolver/apple.com
inside the file put:
nameserver 8.8.8.8
save file by ctr+x

This will also send all traffic for www.apple.com; dev.apple.com all to the custom dns resolver.

Slowly tune all the domain by adding them under /etc/resolver/. Problem solved.

5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.