massive DNS TXT queries for cisco.com RAXE290

Question

Have a nighthwak&nbsp;RAXE290&nbsp;with a Pi-hole attached. Had my Pihole address put in for the DNS. Had pihole do DHCP and the box on the router was unchecked. Setup worked for years. All the sudden lately getting massive amount of queries for cisco.com and adobe.com as in millions per day. They are TXT queries and all of them are answered NODATA. Ends up making the Pihole log so big to takes up the entire SD card and freezes the system.&nbsp;&nbsp;Have done complete uninstall and reinstall of pihole. Wiped netgear router and restored using backup.&nbsp;

plemans · Answer

I have a similar setup and it works great.&nbsp;My question is that if cisco/adobe are sending the requests, what do you think the router can do?&nbsp;
Its not even handling dhcp. The pihole is.&nbsp;
So its an issue of both pihole getting to many requests and something from cisco/adobe sending them.
So how can we help?&nbsp;
&nbsp;
(btw, I've had similar issues with to many requests and it was one of my IoT devices stuck in a loop. pita to diagnose)&nbsp;

c0wsaysmoo · Answer

So that's what was driving me insane was I couldn't think of how the router was making these requests. I even turned off the wifi so there would be no connected devices (aside from the pihole) and it was still doing it. I ended up maybe fixing (?) the problem by unchecking the box for DHCP on the router but not putting in the pihole IP into the DNS on the router. On the pihole I have the DHCP box checked. Before I had the the box for the DHCP on the router unchecked but I had the pihole IP address put into the DNS slot on the router. Apparently the pihole works if it is acting as DHCP for the network.

Now the way it was setup prior worked just fine for years so why all the sudden it changed I have no idea. The ONLY thing I can think of is I switched internet providers and my previous provider provided a modem/router that I did a passthrough to my current router. Whereas my new provider just has a modem that my router plugs into. Might just be a coincidence but who knows? Either way the old setup worked on previous routers and providers.

plemans · Answer

so from reading what you just wrote, you have the Pihole managing dhcp and the router handling DNS.&nbsp;
that really ruins the point of pihole. Or I'm reading that wrong.&nbsp;
&nbsp;
What modem/gateway is the router connected to?&nbsp;
Anything hardwired that can be sending the requests?&nbsp;

c0wsaysmoo · Answer

"so from reading what you just wrote, you have the Pihole managing dhcp and the router handling DNS." correct(ish) according to this doc on the pihole-discourse, as long as the pihole is handling the DHCP it'll function correctly. Going through my queries I can attest that it seems to be working just fine. I used to be under the assumption that I needed to have the router pointed to my pihole DNS but that doesn't seem to be the case. I stumbled on this by accident as I was messing with the settings trying to narrow the problem and all the sudden it was working but I couldn't figure out why and thought it was a glitch. But going through the docs it turns out that it's not a glitch.&nbsp;&nbsp;I have astound(rcn) fiber, I am not sure on the make or model of the modem but it's small. There doesn't seem to be a way to go into the settings on it, it seems to just pass everything directly to the netgear. The only thing hardwired into the router is my raspberry pi. I have pihole installed on it and Nextcloud. Neither should be making requests and even if they were it would show up as the pihole IP and not the router IP.&nbsp;I used to have a previous netgear router and used the old settings and it worked just fine. My brother is currently using my old router with a different ISP using the old settings and he hasn't had any issues.&nbsp;

plemans · Answer

Good to hear its still working fine with that setup.&nbsp;
I'd be looking at programs on a pc/laptop that might be running rogue or sending requests. I was in a beta test that overwhelmed my pihole the one time.&nbsp;
&nbsp;

Forum Discussion

massive DNS TXT queries for cisco.com RAXE290

6 Replies