Netgear time-g.netgear.com + time-f.netgear.com - flooding....

Thu Nov 5 12:05:17 UTC 2020

So as can be seen in a short snippet of a tcpdump with the customer IP replaced with 'customer', we have had multiple customers over the last several years who run into this issue:

<many more, see attached log>
14:23:58.147601 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147603 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147613 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147613 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147616 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147617 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147618 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
<many more>

Yes, they are effectively flooding our DNS recursive instance: long live QPS limits so they do not get many answers, returning with TC=1 or actually valid answers or spoofed answers with an IP we can monitor does not cause any traffic to go there either, thus it really looks like a runaway DNS querier.

Considering the source port is the same, it is likely the same process too that is causing this.
And even though we have two recursive addresses (2x IPv4, 2x IPv6 :), they stick to the same IP, always IPv4 even if the customer has IPv6 on the device (all customers get IPv6 of course :).

The helpdesk contacts these people, and nicely asks them to upgrade, but typically a reboot resolves it for a while.

Thus major questions:

* Has anybody seen similar situations in their recursives? (and what could you do about it)
* Is this a on-device (netgear) issue or is this part of some kind of DoS attempt?

It seems to be on-device; which could mean a botnet on device of course if that has infiltrated the device and as they seem to typically be older devices...

Unfortunately I have not been able to get access to a console or other way to investigate what is running/causing this on-device; customers typically unfortunately rarely even know of this magic "DNS" thing. Fortunately a great helpdesk is able to talk to the customers and convince them to solve things ... as....

The fun part is, those customers typically have called in and complained about slowness of their internet, which makes sense, as that device sending these is flooding their uplink (typically it goes at almost linerate, or what it seems to be the max the NAT device CPU can handle). Thus, they are happy that afterwards their internet is fast again....

Fun side-detail, apparently AS15600 is considered "Best ISP in Switzerland" by the German Connect "Breitbandfestnetztest 2020" test:
https://www.connect.de/vergleich/breitbandfestnetz-anbieter-schweiz-vergleich-test-2020-3201266.html

which interestingly enough found out that our DNS is "slow": "langsame DNS-Auflösungszeiten" (slow DNS resolution times), apparently they got 46ms on average.
which likely has to do with the centralized DNS: customer is sometimes already >20ms away from our DNS recursors which currently exist anycasted in two datacenters where they need to get to first, will be looking on pushing that more to the edge :)

Noting that AS15600 is a mix of DOCSIS and fiber and magically the two pure fiber ISPs have ~17ms and the Cable ones are 40ms++.

Should be addressed for next year's round though :)

Greets,
 Jeroen

-------------- next part --------------
14:23:58.027299 IP customer.32769 > 212.60.63.246.53: 35852+ A? time-g.netgear.com. (36)
14:23:58.027300 IP customer.32769 > 212.60.61.246.53: 35852+ A? time-g.netgear.com. (36)
14:23:58.027301 IP customer.32769 > 212.60.63.246.53: 35852+ A? time-g.netgear.com. (36)
14:23:58.027304 IP customer.32769 > 212.60.63.246.53: 35852+ A? time-g.netgear.com. (36)
14:23:58.027791 IP customer.32769 > 212.60.63.246.53: 35852+ A? time-g.netgear.com. (36)
14:23:58.027799 IP customer.32769 > 212.60.61.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.027808 IP customer.32769 > 212.60.63.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.027808 IP customer.32769 > 212.60.61.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.027810 IP customer.32769 > 212.60.63.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.027811 IP customer.32769 > 212.60.61.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.027813 IP customer.32769 > 212.60.63.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.028356 IP customer.32769 > 212.60.63.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.035003 IP customer.32769 > 212.60.63.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.035003 IP customer.32769 > 212.60.61.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.035026 IP customer.32769 > 212.60.61.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.035027 IP customer.32769 > 212.60.63.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.035029 IP customer.32769 > 212.60.61.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.035031 IP customer.32769 > 212.60.63.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.035032 IP customer.32769 > 212.60.61.246.53: 47842+ A? time-g.netgear.com. (36)
14:23:58.035128 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035128 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035136 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035139 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035598 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035609 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035611 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035614 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035622 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035625 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.035628 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.036208 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.036222 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043166 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043172 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043175 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043177 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043178 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043181 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043181 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043202 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043205 IP customer.32769 > 212.60.61.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043755 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.043764 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.043935 IP customer.32769 > 212.60.63.246.53: 20617+ A? time-g.netgear.com. (36)
14:23:58.043952 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.043955 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.044371 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051230 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051230 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051240 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051241 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051243 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051244 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051246 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051694 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051703 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051719 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051810 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051811 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051821 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051824 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.051827 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.052405 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.052405 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.052417 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059140 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059148 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059163 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059166 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059166 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059168 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059171 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059611 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059723 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059735 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059738 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059741 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.059809 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.060234 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067271 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067278 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067286 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067286 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067289 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067289 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067292 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067961 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067964 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067974 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067975 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.067978 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.074956 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.074961 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.074972 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.074975 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.074976 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.074977 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.074979 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075550 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075554 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075565 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075567 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075568 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075570 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075571 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075574 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075577 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075583 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.075586 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083105 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083242 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083243 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083251 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083254 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083256 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083257 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083259 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083267 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083273 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083702 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083704 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083715 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083717 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083718 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083721 IP customer.32769 > 212.60.63.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.083722 IP customer.32769 > 212.60.61.246.53: 34544+ A? time-g.netgear.com. (36)
14:23:58.091218 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091231 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091232 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091235 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091237 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091238 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091241 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091252 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091255 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091262 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091550 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091553 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091564 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091565 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091567 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091569 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091570 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.091578 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099175 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099180 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099190 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099192 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099194 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099196 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099197 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099768 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099777 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099779 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099783 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099785 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099794 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099797 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099801 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.099956 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107198 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107201 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107218 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107230 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107231 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107234 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107236 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107247 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107250 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107255 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107257 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107270 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107273 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107276 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107671 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107679 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107688 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107688 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107692 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107696 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107699 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107783 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.107799 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.108377 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115134 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115135 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115144 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115148 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115150 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115153 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115154 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115600 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115602 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115611 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115615 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115617 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115618 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.115621 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.122810 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.122810 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.122821 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.122824 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.122828 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123416 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123418 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123431 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123435 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123436 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123439 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123440 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123447 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123451 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123458 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123462 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123883 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123885 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.123899 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.130755 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.130755 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.130767 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.130770 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131242 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131249 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131254 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131257 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131258 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131261 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131262 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131364 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131364 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131373 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131375 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131375 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131378 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131381 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131832 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131834 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131845 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.131846 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.132431 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139176 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139177 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139189 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139191 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139191 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139195 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139195 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139282 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139292 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139298 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139875 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139876 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139887 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139887 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.139890 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.140427 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.140435 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.146992 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147003 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147004 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147011 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147014 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147109 IP customer.32769 > 212.60.61.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147116 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147123 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147124 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147125 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147127 IP customer.32769 > 212.60.63.246.53: 53947+ A? time-g.netgear.com. (36)
14:23:58.147131 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147601 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147603 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147613 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147613 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147616 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147617 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.147618 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.148167 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.148279 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.159721 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.159722 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.159736 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.159737 IP customer.32769 > 212.60.61.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.159738 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.159740 IP customer.32769 > 212.60.61.246.53: 45163+ A? time-g.netgear.com. (36)
14:23:58.159741 IP customer.32769 > 212.60.63.246.53: 17710+ A? time-g.netgear.com. (36)
14:23:58.160189 IP customer.32769 > 212.60.63.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160197 IP customer.32769 > 212.60.61.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160200 IP customer.32769 > 212.60.61.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160201 IP customer.32769 > 212.60.63.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160203 IP customer.32769 > 212.60.61.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160204 IP customer.32769 > 212.60.63.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160205 IP customer.32769 > 212.60.61.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160219 IP customer.32769 > 212.60.63.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160414 IP customer.32769 > 212.60.61.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160537 IP customer.32769 > 212.60.63.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160538 IP customer.32769 > 212.60.61.246.53: 32774+ A? time-g.netgear.com. (36)
14:23:58.160549 IP customer.32769 > 212.60.63.246.53: 32774+ A? time-g.netgear.com. (36)

-------------- next part --------------