topic Re: 20210? in OpenDNS

20210?

stanthemam — Fri, 18 Nov 2016 01:10:56 GMT

This number as well as 20213, 20202, 20303, 20212, 20205, and 20206 have appeared in my domain stats today, as well as "blackberry-742" no dot com or anything else. Some of them were requested 5 times, some just one. Just curious as to what these mean?

Re: 20210?

rotblitz — Fri, 18 Nov 2016 01:39:05 GMT

Maybe someone on your network issued a command like "nslookup 20213."? Or networking programs are looking up these network names because they are badly behaving or wrongly configured? Network names without TLD are rather internal network resources, e.g. a printer or NAS. This blackberry-742 is clearly an internal network name where some networking program looks up this Blackberry device.

Bad to see that your router also forwards internal name resolutions to the external service of OpenDNS instead of handling them internally.

Re: 20210?

stanthemam — Fri, 18 Nov 2016 01:49:22 GMT

Do you mean "bad" as in a virus or something of the sort?

Re: 20210?

rotblitz — Fri, 18 Nov 2016 01:55:43 GMT

No. Why should a virus look up non-existent domains like 20210? This doesn't make sense. I rather thought about a programmer mistake, i.e. a program error...

Re: 20210?

stanthemam — Fri, 18 Nov 2016 01:58:49 GMT

Fair enough! Thanks for clearing this up.

Re: 20210?

rotblitz — Fri, 18 Nov 2016 02:03:40 GMT

Just in case you meant "Bad to see that your router...":
This happens if the OpenDNS resolver addresses are configured on the LAN/DHCP side of the router or directly on the end user device. It will not happen if the OpenDNS resolver addresses are configured on the WAN side of the router. Configuring on the LAN/DHCP side can impact or break local name resolution.

Re: 20210?

rotblitz — Fri, 18 Nov 2016 02:08:35 GMT

Further, your very similar question has already been answered:
https://support.opendns.com/hc/en-us/community/posts/245046447

You don't need to raise a question for any strange domain in your stats. You'll always receive this answer.

Re: 20210?

stanthemam — Fri, 18 Nov 2016 02:16:47 GMT

Ok. I was just curious to see if maybe somebody has seen this in their logs and would be able to shed some light.

Re: 20210?

rotblitz — Fri, 18 Nov 2016 02:59:41 GMT

Yes, I've seen this kind of DNS queries very often in the stats of the networks I manage, any believable and unbelievable names and words, whatever you could think of...

Let's see if someone else can contribute to this topic...