Keep getting DNS name resolution failure (debug.opendns.com) on my router/modem logs

[jefflambert670]

Hi, I keep getting this message in my modem's logs "DNS name resolution failure (debug.opendns.com)" every minute or so, this is flooding my logs and I think it brings my modem down after a while. Is there any way to see what device is asking for that address? I've looked at all my device and removed any trace of opendns I could find, but still, something is trying to use it. Thanks.

[rotblitz]

Just guessing, do you run the OpenDNS (or another) Updater on any device?  This may be the culprit, although I would not know that it looks up debug.opendns.com.

Else you would have to install a sniffer within your network which is able to catch this traffic, including its source IP address identifying the device.  Or does your router log display more information than just this message?  (You may want to post a screen shot.)

[jefflambert670]

rotblitz,

Yes I was running an old OpenDNS updater at one point, but I removed it. I thought I had fixed the problem but it doesn't seem so. How do you use a sniffer and do you have a mac app that you would suggest? Tks.

[rotblitz]

Wireshark is also available for Mac OS X.  https://www.wireshark.org/
Please note, if you install it on a certain computer, it almost shows traffic from/to this one computer only.  But it is a good starting point nevertheless.

Your Mac may already come with the tools you need:

http://osxdaily.com/2015/04/23/sniff-packet-capture-packet-trace-mac-os-x-wireless-diagnostics/

https://jacobsalmela.com/2014/11/23/os-x-yosemite-secret-packet-sniffer/

https://support.apple.com/en-us/HT202013

[jefflambert670]

I've downloaded WireShark but I have no idea what I'm looking for:-( Since I know it's not from my mac, it's pretty much useless. I did try to turn off my wifi and see if it was on one of the devices connecting to wifi and it seems to be the case. Although now, after restarting it, the opendns message is no longer coming up every minute. I suspect my wife's PC which is set up for her job. They maybe have something that would call OpenDNS and I see a bunch of other DNS related issues with that computer (I know it's this computer because of the domain name that is associated with her company).

[rotblitz]

Well, then the solution will come with installing and using a network sniffer on her PC.

"I have no idea what I'm looking for:"

In the packet trace you will look for packets containing "debug.opendns.com".  This still might not give you the idea what program you are looking for.  If this PC is a Windows computer, Microsoft's Network Monitor may help further, instead of Wireshark or such tools.
https://www.microsoft.com/en-us/download/details.aspx?id=4865

[jefflambert670]

Unfortunately, since it's her work computer and she doesn't have admin access, I can't install anything on it. My first step is to try to isolate if it's really HER computer that is causing this. Contacting IT is very tedious for her so she'll do it ONLY if I can tell her that's her computer causing all this. So I have to tread carefully if you know what I mean;-)

[rotblitz]

Yes, I know what you mean. ;-)