Question A 3rd party domain name has crept into my network... ?

[Telos]

3 years ago I stayed at a Sonesta hotel and used their wi-fi system. I may even have set up an old wif-fi router using a wired ethernet port in my room...

Since then, I get weird traffic through my network... for example, today Adguard Home sees a "relic.sonesta.com" associated with one of my NAS. Interestingly, my Synology NAS's name is "relic." [OK, I edited the real NAS name, but my NAS's name is too unique to show up with *sonesta.com]. Here is the pattern...

15:15:09
relic.sonesta.com
A
Status: NXDOMAIN
192.168.1.1

15:15:09
relic.sonesta.com
AAAA
Status: NXDOMAIN
192.168.1.1

There are many "relic.sonesta.com" entries as well as a few "orlp.lp.cs.quickconnect.to.sonesta.com"... For example...

15:03:39
orlp.lp.cs.quickconnect.to.sonesta.com
AAAA
Status: NXDOMAIN
192.168.1.1

I have never been able to locate the "sonesta.com" entry in my network. I know there are some network savvy folks here... Hopefully you might guide this newbie to purge this "sonesta" irritation for my system.

 

[Telos]

Thinking I could just block "sonesta.com" under Adguard Home... I discovered soon after that my shared folder sync failed... as "relic.sonesta.com" was blocked. ["relic" is the destination NAS].

Unblocking "sonesta.com" restored the shared folder sync.

Puzzle this out...

This too is interesting... in the case of "relic.sonesta.com" logs, there are "relic" logs of the same timestamp... for example...

20:00:29
relic
AAAA
Status: NOERROR
192.168.2.1

20:00:29
relic
A
Status: NOERROR
192.168.2.1

20:00:29
relic.sonesta.com
A
Status: NXDOMAIN
192.168.2.1

20:00:29
relic.sonesta.com
AAAA
Status: NXDOMAIN
192.168.2.1

 

[fredbert]

Can do an nslookup or dig that will provide zone server info for sonesta.com?

It could be a device or app is advertising locally, such as when devices have setup.device.com address to find the non-Internet LAN IP. Other than that a DNS service is resolving back to localhost?

WiFi profile added to your device? Brain dumping now.

 

[Telos]

Can do an nslookup or dig that will provide zone server info for sonesta.com?

It could be a device or app is advertising locally, such as when devices have setup.device.com address to find the non-Internet LAN IP. Other than that a DNS service is resolving back to localhost?

WiFi profile added to your device? Brain dumping now.

I wish I had the smarts to answer any of these questions. WiFi profile? Not exactly sure what this is, so I must not have one ???

Out of complete ignorance, I SSH'd into the primary NAS and entered "nslookup"
Then I entered "relic.sonesta.com", "sonesta", "sonesta.com"...
The response was:

> relic.sonesta.com
Server:         192.168.2.2
Address:        192.168.2.2#53

** server can't find relic.sonesta.com: NXDOMAIN

> sonesta
Server:         192.168.2.2
Address:        192.168.2.2#53
** server can't find sonesta: NXDOMAIN

> sonesta.com
Server:         192.168.2.2
Address:        192.168.2.2#53

Non-authoritative answer:
Name:   sonesta.com
Address: 104.16.86.34
Name:   sonesta.com
Address: 104.16.85.34

I don't know if that was remotely as you asked, but I'm willing to work through this as you have the time. I'm not sure where to start.

 

[fredbert]

Profiles would generally get added in mobile devices for [ISP?] provider WiFi services.

Yeah, doing nslookup or dig will provide info on how the request is resolved to an IP. And for you it isn't. But has something running been configured to have a default domain name (like when you setup a DHCP server and say assume un-FQDN requests are for 'this' domain).

Could be that some thing has 'sonesta.com' set as the it's local domain name and so when the device requests 'relic' it slaps on '.sonesta.com' to make it FQDN. Sometimes referred to as a search domain.

When running a local DNS service the search domain is useful because I can ping nas instead of ping nas.mydomain.com

 

[WST16]

I won’t be able to sleep the minute I notice this until I figure it out!
Three years! You’re a very patient man

NXDOMAIN means non-existent domain

What Is NXDOMAIN?

Explains NXDOMAIN (Non-Existent Domain) which used for the Internet domain name that is unable to be resolved using the ISP (or your own) DNS server due to domain name not yet registered or the remote auth dns server problem.

www.dnsknowledge.com

@fredbert suggestions are a good start.

Do you still have that old WiFi router running somewhere on the LAN?
Could be a persistent DNS cache. I really have no answer. But this is interesting, and spooky too

 

[Telos]

Do you still have that old WiFi router running somewhere on the LAN?

Not presently, but at one time I may have run the router which I had taken to the hotel.

I went through all the adaptor settings on the PC's connected to this network. The only oddity I noticed was that a desktop PC (wired ethernet connection) had an inactive wifi adaptor whose IPv4 DNS was pointed to a non-existent LAN IP that may have been related to the wifi router I took to the Sonesta hotel. I edited that out then, reset the network on that PC (including /flushdns) using a multipurpose batch file. After rebooting that PC, and then restarting the NAS, my stats are still showing requests to "relic.sonesta.com"

I backed up my router settings hoping to find a hint of "sonesta" there, but the backup file is indecipherable code. I also scanned my laptop registry for "sonesta" with no result.

I'm wondering where this beast could hide.

At this point, I can only

 

[fredbert]

At this point, I can only

...cry?
...bash the stupid thing to pieces?
...replace everything and start again?

 

[WST16]

Are you using any LDAP services?

What happens when you ping relic.sonesta.com
From the NAS that got disconnected when you blocked sonesta.com?
(should reply if it’s not blocked)

What happens when you ping relic.sonesta.com
From a host on the LAN (say a PC)?
(I’m hoping that you don’t get a reply)

In Linux I think you can use
cat /etc/resolv.conf
To find out what DNS services your DS is using.

Also check
cat /etc/host
See if anything is out of place in there.

Throwing things on the wall here.

 

[Telos]

No LDAP services that I'm aware of (none on NAS).

What happens when you ping relic.sonesta.com

From NAS
ping: relic.sonesta.com: Name or service not known

From PC
C:\WINDOWS\system32>ping relic.sonesta.com
Ping request could not find host relic

In Linux I think you can use
cat /etc/resolv.conf
To find out what DNS services your DS is using.

root@relic:~# cat /etc/resolv.conf
nameserver 192.168.2.2 <--- this is macvlan set up for Adguard.
nameserver 8.8.8.8
domain Sonesta.com <--- WHOA. Where is this coming from? I get this from both NAS.

 

[WST16]

Since pinging from the PC returns unreachable, I believe I can deduct that the problem is not “global“ on your LAN, but a pigment of your DS imagination

domain Sonesta.com <--- WHOA. Where is this coming from? I get this from both NAS.

You tell me

resolv.conf - Wikipedia

en.wikipedia.org

 

[Telos]

I have no domain on my router,

so I'm unsure how this came into being, or how to eradicate it. Can I just edit resolv.conf (can I leave domain blank), or will it repopulate? I don't even have a domain (apart from DDNS).

I'm in a bit over my head... but y'all knew that.

 

[WST16]

Here’s what my resolv.conf looks like. Clean as a whistle.

If you can edit it. Yes. Linux
If it’s ok. I don’t know. It’s your network environment.
Maybe someone else can suggest something.

I would make sure I have a good backup. Copy resolv.conf to resolv.bakup and edit resolv.conf to point to your name server only and check.
But that’s me, proceed at your own risk

However, the million dollar question (well, not million) is how did that get there?

 

[Telos]

I found this interesting...

root@relic:~# cat /etc/resolv.conf
nameserver 192.168.2.2 
nameserver 8.8.8.8
domain Sonesta.com  

root@relic:~# cat /etc/resolv.conf.static
nameserver 192.168.2.2 
nameserver 8.8.8.8

root@relic:~# cat /etc/resolv.conf.option
domain Sonesta.com

Maybe I could simply rename "resolv.conf.option" and resolv.conf would clean up on its own... or simply copy "resolve.conf.static" to resolve.conf.

I haven't found any info on resolv.conf.option or resolv.conf.static...

 

[WST16]

Might need a restart to create a new resolv.conf.
I can sell you mine if you end up with no resolv(e)

 

[fredbert]

I've done some testing...

I think 'resolv.conf.option' is generated by Control Panel's Network settings. Under General if you have enabled 'Manually configure DNS server' then what you enter here will be saved to the 'static' file.

I couldn't find where in DSM Control Panel there is a place to define a search domain so I changed it in my DHCP server on the RT2600ac. Now to see if that caused DSM to update the contents of 'resolv.conf.option'.

In Control Panel's Network settings go to the Network Interface tab and edit the LAN interface (or interfaces!). My manual values are the same as given by DHCP but I prefer having them manual. I changed from the manual option to DHCP option, save the change, and checking 'resolv.conf.option' I see that the domain instruction is now the same as the updated DHCP search domain. Changing the DHCP server's domain back and setting DSM LAN back to manual settings and it changes again.

So the inference is that DSM 'domain' value is picked up from whichever DHCP service it detects. I wonder if you just toggle your interface between manual/DHCP and back if this will flush out the domain instruction. Maybe using manual means that search domain never gets changed?

You might want to recreate the shared folder sync to see if that has some cached value?? It didn't work when you blocked sonesta.com which is odd unless the sync settings and this domain instruction are just a weird coincidence where one makes the other work but normally it shouldn't.


Where do I send the bill for consultancy

 

[WST16]

@Telos, @Telos. SynoForum to @Telos. Are you there?! Or did the thing blow up after you changed the resolv file (during save most likely)
Are you ok?
Probably wearing his tin foil hat and we can’t get through, he tends to do that In such times I guess.

 

[WST16]

Ok guys, I’ll go for a nap. Wake me up when @Telos comes back. In case his stuff blew up, delete my messages and my username (and don’t wake me up, I don’t know any of you).

 

[Telos]

Here's what seems to be working... (though I haven't restarted the NAS yet).

Toggling DHCP had no change for me. Maybe I misread... What I did was...

mv resolv.conf.option resolv.conf.option.save

Next, I unchecked "Manually configure DNS server" and "Sonesta.com" disappeared from resolv.conf. Kudos to @fredbert here.
Then I checked "Manually configure DNS server", and resolv.conf remained clean.

Then grepped /etc for "sonesta" and only "resolv.conf.option.save" came up.

Next a restart... and that worked for the NAS with manually assigned DNS. Now to reboot with DNS assigned by router...

 

[fredbert]

Maybe resolv.conf.option only gets updated if there is a DHCP search domain with which to update it ... and when you happen to be toggling the LAN settings.

If none of your other LAN devices are getting assigned a search domain then it's a fair guess to assume that DSM is just caching the last once it saw that was provided by a DHCP server. Maybe it never looks again when it has manual LAN settings.