what is *.id.opendns.com

Follow

nick64

August 26, 2013 14:37

My daily report is showing a very high amount of requests to this domain (*.id.opendns.com). In a classroom where all the student machines are shut down for the weekend and perhaps 4 admin machines are on, there were 68,959 requests to this domain on Sunday. The next most active domain (bpb.opendns.com) had only 482 hits. What would cause this?

0

• 

  rotblitz August 26, 2013 16:36

  As far as I have seen, these *.id.opendns.com are raised in conjunction with the redirection to the OpenDNS block page, several for each instance. So I think you see also a lot of blockings in your stats, many domains and/or many requests. These are then related.

  0

  Comment actions Permalink
• 

  nick64 August 26, 2013 16:44

  I'd go with that except that almost 70,000 requests on a day where no one is in the facility seems odd. Wonder if we have a rogue computer on the network somewhere? Definitely bears looking into further.

  0

  Comment actions Permalink
• 

  rotblitz August 26, 2013 17:51

  Well, the philosophy of many networking programs is if they can't get to success, they retry even more to resolve a name and to connect to a site, until success which is never (because you blocked it), so forever. This symptom can easily explain what you're observing. You have to find out the application being unhappy not being able to connect to a certain site and to find what it is looking for.

  0

  Comment actions Permalink

Please sign in to leave a comment.