[137274] in North American Network Operators' Group
Re: Self-referential whois queries
daemon@ATHENA.MIT.EDU (John Kristoff)
Thu Feb 10 15:18:45 2011
Date: Thu, 10 Feb 2011 14:17:59 -0600
From: John Kristoff <jtk@cymru.com>
To: Rubens Kuhl <rubensk@gmail.com>
In-Reply-To: <AANLkTi=WCKfh+vGG9c2TphYtdWe9TJH0TdDGYNk40T9o@mail.gmail.com>
Cc: Nanog <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Thu, 10 Feb 2011 17:27:26 -0200
Rubens Kuhl <rubensk@gmail.com> wrote:
> I'm noticing an increase in getting "query rate exceeded" at whois
> services that might be connected to a symptom described by ARIN at
> NANOG 48/ARIN XXV and ARIN XXVI where machines ask for the whois
> record of their own IP address.
>
> Are there any clues of what is causing this ?
Some spam bots do these automated self-referential queries, but if you
are seeing those rate exceeded messages when you perform queries from
your client, you may simply be probably bumping up against a limit for
the source host or network in question.
John
