Plötzlich ein unbekannter upstream server im Dashboard

mx2k · January 19, 2023, 11:32pm

Beobachtetes und erwartetes Verhalten

Neuerdings beobachte ich Queries an einen unbekannten Upstream Server names "Other".

Habe das mal angeklickt, scheinbar will ein Samsung TV mit Netflix-Servern als Upstream kommunizieren.

Gibt es hierzu eine plausible Erklärung? Der Samsung TV hat bisher immer den Pi-Hole als einzigen DNS Server verwendet und wie der jetzt auf die Idee kommt, in Pi-Hole als "other" Upstream Server aufzutauchen, ist mir unbekannt.

Anbei ein Debug Token, falls benötigt.

Debug Token:

https://tricorder.pi-hole.net/bKpUFXU7/

rdwebdesign · January 20, 2023, 3:56am

This is not recent. It was introduced 1 year ago.

On the past, there was always queries not fitting on blocked, cached or answered categories, but these queries were not showed on the graphic, causing small differences between the total queries and the queries showed on the graphic.

To fix this, the "Others" category was introduced on this pull request:

github.com/pi-hole/FTL

Add others section to upstream servers pie chart

pi-hole:development ← pi-hole:tweak/upstream_pie_others

opened 08:18PM - 19 Jan 22 UTC

DL6ER

+39 -22

**By submitting this pull request, I confirm the following:** - [X] I have re…ad and understood the [contributors guide](https://github.com/pi-hole/pi-hole/blob/master/CONTRIBUTING.md). - [X] I have checked that [another pull request](https://github.com/pi-hole/FTL/pulls) for this purpose does not exist. - [X] I have considered, and confirmed that this submission will be valuable to others. - [X] I accept that this submission may not be used, and the pull request closed at the will of the maintainer. - [X] I give this submission freely, and claim no ownership to its content. **How familiar are you with the codebase?:** ## 10 --- There are queries which are neither sent upstream nor are they cached or blocked. These are incorrectly ignored in the upstream server pie chart leading to a mismatch of the blocked percentage compared to the value reported at the top. Even when both are correct (their difference is caused by different reference frames), this is confusing. To compensate, we add a new type `other` which summarizes all these queries, causing the two reference frames to be identical.

Note:
Sorry for the answer in English, but I don't think you would understand if I tried to answer in German.

jfb · January 20, 2023, 4:30am

Your second screen capture doesn't show a Netflix server as an upstream. Where do you see that?

Are there any entries in your dnsmasq log (/var/log/pihole/pihole.log) that shows queries forwarded to any upstream DNS servers other than unbound or your Fritzbox?

What is the output of the following command which will show the upstream DNS server use by IP.

echo ">forward-dest >quit" | nc localhost 4711

Bucking_Horn · January 20, 2023, 10:22am

Als Ergänzung zu den Erläuterungen von rdwebdesign und jfb:

'other' gruppiert solche DNS-Anfragen, die aus irgendeinem Grund nicht an einen Upstream weitergeleitet wurden.
Für die DNS-Anfragen aus Deinem Screenshot zeigt 'already forwarded' in der Spalte Status, dass Dein Samsung-Q60 Client eine DNS-Anfrage für eine Domäne auf nflixso.net an Pi-hole gestellt hat. Diese wurde von Pi-hole bereits zuvor an einen Upstream weitergeleitet. Pi-hole sendet in einem solchen Fall keine neue Anfrage an einen Upstream, sondern wartet einfach das Ergebnis dieser noch laufenden Anfrage ab.

Ein unbekannter Upstream ist hier also nicht im Spiel.

system · February 10, 2023, 10:22am

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.