Netgear WG511 connecting to public DNS servers
 

I've discovered that the driver for my WG511 card "WG511WLU.exe" is
connecting via TCP to port 53 on several root DNS servers. While only
a minor nusance, it is wasting my bandwidth, and putting an unneeded
load on these servers, and makes absolutely no sense whatsoever.

Is there anyone else running the WG511 2.7.0.0 driver that can confirm
this behavior? Or even better, anyone at Netgear wish to explain it?

Here's the original message I sent to Netgear back in July.

I'm a network engineer, so I run a packet sniffer on my PC
occasionally. Yesterday I noticed a very strange thing: my PC was
connecting via TCP to port 53 on several root DNS servers.
Fortunately, it's Windows XP and 'netstat -o' displays the PID of the
process that owns the socket. In this case, it's PID 376, which Task
Manager shows as belonging to WG511WLU.exe.

Why is your program trying to connect to well known TCP port 53 on root
DNS servers?

I have since blocked outgoing TCP port 53 (which AFAIK is mostly used
for DNS zone transfers and the like).

I've attached the evidence of what I've seen. The .cap file is a
capture from Ethereal, and is compatible with tcpdump/libpcap. The
..txt file is the output of my netstat -aon command. The .png file is a
screen of my task manager.
[you may find the attachements at http://hsvlees.homeip.net/netgeardns]

The Ethereal capture was taken while TCP port 53 was blocked, which is
why the connections are not being established. When the connections
were not being blocked, the connections were disconnected as soon as
they were connected, and no data was sent.

Now the standard stuff: I'm running a WG511 card. I just upgraded the
software to version 2.7.0.0. The Wireless Assistant shows my Driver
Vesion at 2.1.22.0, Firmware Version at 2.04.06.00, and Smart Wireless
Utility Version at 2.26.22.6.

dave
<><