[ubuntu-uk] DNS - request for info/advice

Tony Arnold tony.arnold at manchester.ac.uk
Wed Jul 9 14:35:17 BST 2008


Mac wrote:
> Tony Arnold wrote:
> <snip>
>> No, nothing to do with me!
> Didn't really think it was.  In fact belongs to
> NetServices Plc
> Network Operations Centre
> Waters Edge Business Park
> Modwen Road
> Salford M5 3EZ
> United Kingdom
> You see:  Salford.  You've got to worry, haven't you?!  ;-)
>> Your DNS addresses will be determined by DHCP when your system gets its
>> IP address. Usually, that's the router. Most routers act as a DNS proxy,
>> so your DNS address is that of the router (in my case it's
>> Or it can return the DNS addresses returned by your ISP. It depends on
>> how your router is configured.
> Mmm...  Thanks for your comments.  I discovered that the Netservices DNS 
> (above) was entered as the DNS server IP address in the LAN section of 
> my router settings.

So that will be the address returned in any DHCP request to your router,
which would explain what is in resolv.conf.

> But it isn't my ISP's DNS server (the addresses for 
> which is in the main configuration screen for the router - and is the 
> one I thought I was using).

And that was got when your router did a DHCP request to your ISP to get
it's own external IP address.

> I'm now at a loss to know what has happened here.  I wonder if  I 
> changed the DNS IP address settings at some time (goodness knows why!) 
> and forgot that I had.

This is a possibility.

> But do you have any other thoughts? (If it's just the forgetfulness of 
> old age, I don't mind;  but if it looks like nefarious activity, how can 
> I check?)

Is your router set up to allow management from the WAN side? If so have
you changed the default password to something suitably obscure?

My thought would be if someone had hacked your router, they are likely
to do far more than just fudge your DNS addresses! Well, not to ones of
a bona fide DNS provider.

> I guess that NetworkManager will have picked up the DNS IP from the 
> router, and written it to /etc/resolv.conf?

Correct. Strictly it will be the DHCP bit which gets invoked by Network

Tony Arnold,                        Tel: +44 (0) 161 275 6093
Head of IT Security,                Fax: +44 (0) 870 136 1004
University of Manchester,           Mob: +44 (0) 773 330 0039
Manchester M13 9PL.                 Email: tony.arnold at manchester.ac.uk

More information about the ubuntu-uk mailing list