what is *.id.opendns.com

[nick64]

My daily report is showing a very high amount of requests to this domain (*.id.opendns.com). In a classroom where all the student machines are shut down for the weekend and perhaps 4 admin machines are on, there were 68,959 requests to this domain on Sunday. The next most active domain (bpb.opendns.com) had only 482 hits. What would cause this?

[rotblitz]

As far as I have seen, these *.id.opendns.com are raised in conjunction with the redirection to the OpenDNS block page, several for each instance. So I think you see also a lot of blockings in your stats, many domains and/or many requests. These are then related.

[nick64]

I'd go with that except that almost 70,000 requests on a day where no one is in the facility seems odd. Wonder if we have a rogue computer on the network somewhere? Definitely bears looking into further.

[rotblitz]

Well, the philosophy of many networking programs is if they can't get to success, they retry even more to resolve a name and to connect to a site, until success which is never (because you blocked it), so forever. This symptom can easily explain what you're observing. You have to find out the application being unhappy not being able to connect to a certain site and to find what it is looking for.