🚀 go-pugleaf

In article <3999A50C.69DBDBD8@house-from-hell.demon.co.uk>,
	Ian Northeast <ian@house-from-hell.demon.co.uk> writes:

> DNS is probably the commonest cause of unwanted dialups. Windows boxes
> have a nasty tendency in my experience to look up DNS names for no
> apparant reason. I dialed into my home NT RAS server[1] from work today
> and it promptly looked up "www.uk.ibm.com". No, I do not work for IBM.

Indeed; the first part of any conversation with a remote network resource
name will be to work out what address the name corresponds to, so it's not
unexpected to see DNS lookups going out first ...

I had many problems with Windows 95 and dial-on-demand. These were mainly
due to the MS Networking netbios name service browsing around for other
Windows resources. These can be fixed by setting up the Samba server
carefully, if you use one, and ensuring that the Windows clients don't try
to be Browse Masters. IP Chains can put a stop on any leaks; just block
out the netbios service across your dialup or virtual link. I'm a fan of
IP Chains, as you may have guessed!

I recall that Microsoft Outlook Express also seemed to make the unpleasant
assumption that, if you are 'online', e.g. to read pages from a local web
server, you don't mind it making connections to web sites without you
asking - obviously this brings up the link!

> To trap this run a caching nameserver with query logging turned on. Then
> you can look in the system log to see what looked up what just before
> the dialup. This is how I tamed my dial-on-demand ISDN before it broke
> the bank.

You are quite right of course; IP chains running into a syslog followed
with tail -f can tell you a lot about what comes after the DNS requests,
but it's the nameserver logging that tells you what is being looked up in
the first place.

-- 
Regards,

Richard