Unknown bing.com request

How to view which process using this request.
My adguardhome show bing.com dns from localhost/openwrt every second.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
1 Like

Please draw a diagram how your DNS servers are chained. It is not openwrt on localhost suddenly getting interest in bing.com

1 Like

You can capture all DNS traffic using:

tcpdump -i wan -v port 53 or 853

And that will expose the source.

1 Like

My problem already solved, my openwrt is unofficial build, there a service for check internet is on or not each second.

From this https://github.com/lutfailham96/s905x-gpio/blob/main/internet-hg680p.sh#L17

Thankyou brother for your reply, already known which service using this request each second.

Yeah thankyou for your help.

I'm doing this

 tcpdump -i any -n 'udp port 53' -vv | grep bing.com

But still dont get a clue, then using this

for pid in $(ps | grep "bing.com" | awk '{print $1}'); do cat /proc/$pid/status; done

And know the process which doing curl to bing each second.

I found out all custom build for hg680p (maybe 1000+ installation on this device) doing curl each second to bing.com by default :smile:

Also very handy to see your DNS traffic:
cat /proc/net/nf_conntrack | grep -E ' dport=(53|853) ' | sort -nrk3


1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.