Noticed lot of "A" record queries for
time-b.netgear.com/time-c.netgear.comon dns servers.
Has anyone noticed similar behavior on any of your dns servers? Anyone
aware about a known issue with netgear home routers which can create bulk
dns queries?
-Basil
Yo Basil!
Hmm... Even though similar issue was identified in 2003, looks like still
there are devices in market with those old firmwares or similar
behavior. sheesh !! 
-Basil
Hmm... Even though similar issue was identified in 2003, looks like still
there are devices in market with those old firmwares or similar
behavior. sheesh !!-Basil
While NETGEAR does have a history of issues like this, the UofW issue is likely not related to what you are seeing - that issue stemmed from them not using DNS and hardcoding the university's NTP server.
The issue you are seeing seems to stem from their NTP code doing the Wrong Thing nonetheless...
A long long time ago in a network far far away, one of our campus NTP servers
was a machine under my desk. That machine was shut down
around 2002/06/30 22:49 and we didn't re-assign the IP address ever since
*because* it kept getting hit with NTP packets.. Yes, a decade ago.
A few months ago I ran a test of how many things were still using it. In the
first 15 minutes, 234 different IP's tried to NTP to that address, which has
been a black hole for a decade. After 3 hours, I had almost 2,000 IPs.
Interestingly enough, the *hostname* is still in use (by another machine under
my desk) - and it gets near zero hits. So it's all hardcoded IP addrs not
hostnames.
....
Interestingly enough, the *hostname* is still in use (by another machine under
my desk) - and it gets near zero hits. So it's all hardcoded IP addrs not
hostnames.
And for NTP implementations that use DNS they also often only check
DNS on startup too...and lots of people do not maintain their
servers...well, except netgear, which just hammers the bugger out of
everything (See OP)
