Menu
What's new
By:
Filters Better Search

Any way to diagnose further these dnsmasq restart events?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

saison2023

saison2023

Regular Contributor
Hello,

Last week, I had a trouble with dnsmasq that was restarting so often that I was unable to even have Internet access because I wasn't able to have DNS resolution.
I disabled AdGuardHome because I thought it was related (a lot of AdGuardHome's event was registered when dnsmasq was crashing).

Still with AdGuardHome disabled, I had the same behavior happened yesterday, but even worst because some devices were unable to receive IP address from DHCP.

Suspecting a fault in my setup, I opted to erase everything:
  • Format hard drive (in NTFS) and unplugged it
  • Reboot the router
  • Factory reset the router using Web GUI
  • Reconfigure from scratch
After some times (doing speed test, video streaming and rebooting the router few times), I went back to amtm and activated only these scripts:
  • Skynet
  • FlexQoS
  • scMerlin
  • (I didn't install AdGuardHome because I thought it was th culprit)
Unfortunately, I was disappointed this morning to find that the dnsmasq errors are still present (refer to the latest from this morning below).

Can someone guide me to go deeper and try to find the reason?

Thanks

Jun 18 07:20:43 hostapd: eth6: STA 88:57:1d:1b:6d:36 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: eth7: STA 0c:43:f9:a2:01:9e WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl0.1: STA 80:7d:3a:64:43:50 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl0.1: STA 50:14:79:76:bd:a7 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: eth7: STA 76:a8:34:97:a9:a6 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl1.1: STA 28:73:f6:0f:f9:90 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl1.1: STA 44:3d:54:c1:97:23 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl0.1: STA 50:14:79:74:ac:ae WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: eth7: STA b2:2f:5d:b1:ea:f0 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: eth7: STA 6e:bf:55:39:7b:cf WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: eth7: STA 2a:ca:97:8f:77:4c WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: eth7: STA 3a:72:e4:3c:9d:c9 WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: eth7: STA 2a:19:e2:76:b6:11 WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: eth7: STA ca:5f:c3:8c:94:65 WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: wl0.1: STA fc:45:c3:ba:59:10 WPA: group key handshake completed (RSN)

Jun 18 07:25:06 rc_service: service 6788:notify_rc restart_dnsmasq
Jun 18 07:25:06 custom_script: Running /jffs/scripts/service-event (args: restart dnsmasq)
Jun 18 07:25:06 dnsmasq[24142]: exiting on receipt of SIGTERM
Jun 18 07:25:06 custom_config: Appending content of /jffs/configs/dnsmasq.conf.add.
Jun 18 07:25:06 dnsmasq[6842]: started, version 2.90 cachesize 1500
Jun 18 07:25:06 dnsmasq[6842]: DNSSEC validation enabled
Jun 18 07:25:06 dnsmasq[6842]: configured with trust anchor for <root> keytag 20326
Jun 18 07:25:06 dnsmasq[6842]: asynchronous logging enabled, queue limit is 5 messages
Jun 18 07:25:06 dnsmasq-dhcp[6842]: DHCP, IP range 192.168.102.2 -- 192.168.102.254, lease time 1d
Jun 18 07:25:06 dnsmasq-dhcp[6842]: DHCP, IP range 192.168.101.2 -- 192.168.101.254, lease time 1d
Jun 18 07:25:06 dnsmasq-dhcp[6842]: DHCP, IP range 172.16.1.100 -- 172.16.1.110, lease time 1d
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for use-application-dns.net
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for lan.local
Jun 18 07:25:06 dnsmasq[6842]: read /etc/hosts - 84 names
Jun 18 07:25:06 custom_script: Running /jffs/scripts/service-event-end (args: restart dnsmasq)
Jun 18 07:25:06 dnsmasq[6842]: using nameserver 9.9.9.9#53
Jun 18 07:25:06 dnsmasq[6842]: using nameserver 149.112.112.112#53
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for use-application-dns.net
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for lan.local
Jun 18 07:25:06 dnsmasq[6842]: using nameserver 9.9.9.9#53
Jun 18 07:25:06 dnsmasq[6842]: using nameserver 149.112.112.112#53
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for use-application-dns.net
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for lan.local

Jun 18 07:46:40 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 3A:72:E4:3C:9D:C9, status: 0, reason: Disassociated due to inactivity (4), rssi:-88
Jun 18 07:46:40 hostapd: eth7: STA 3a:72:e4:3c:9d:c9 IEEE 802.11: disassociated
Jun 18 07:46:40 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 3A:72:E4:3C:9D:C9, status: 0, reason: Previous authentication no longer valid (2), rssi:-88
Jun 18 07:46:40 hostapd: eth7: STA 3a:72:e4:3c:9d:c9 IEEE 802.11: disassociated
Jun 18 07:46:41 wlceventd: wlceventd_proc_event(662): eth7: Disassoc 3A:72:E4:3C:9D:C9, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0
Jun 18 07:46:41 hostapd: eth7: STA 3a:72:e4:3c:9d:c9 IEEE 802.11: disassociated
Jun 18 07:53:37 wlceventd: wlceventd_proc_event(685): eth6: Auth 76:A8:34:97:A9:A6, status: Successful (0), rssi:0
Jun 18 07:53:37 hostapd: eth6: STA 76:a8:34:97:a9:a6 IEEE 802.11: associated
Jun 18 07:53:37 wlceventd: wlceventd_proc_event(695): eth6: ReAssoc 76:A8:34:97:A9:A6, status: Successful (0), rssi:-63
Jun 18 07:53:37 hostapd: eth6: STA 76:a8:34:97:a9:a6 RADIUS: starting accounting session B10E21AF12513244
Jun 18 07:53:37 hostapd: eth6: STA 76:a8:34:97:a9:a6 WPA: pairwise key handshake completed (RSN)
Jun 18 07:53:46 bsd: bsd: Sending act Frame to 76:a8:34:97:a9:a6 with transition target eth6 ssid 7c:10:c9:b4:cb:c0
Jun 18 07:53:47 bsd: bsd: STA:76:a8:34:97:a9:a6 no response
Jun 18 07:53:47 bsd: bsd: Sending act Frame to 76:a8:34:97:a9:a6 with transition target eth6 ssid 7c:10:c9:b4:cb:c0
Jun 18 07:53:48 bsd: bsd: STA:76:a8:34:97:a9:a6 no response
Jun 18 07:53:55 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 76:A8:34:97:A9:A6, status: 0, reason: Previous authentication no longer valid (2), rssi:-84
Jun 18 07:53:55 hostapd: eth7: STA 76:a8:34:97:a9:a6 IEEE 802.11: disassociated
Jun 18 07:53:55 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 76:A8:34:97:A9:A6, status: 0, reason: Disassociated due to inactivity (4), rssi:-84
Jun 18 07:53:55 hostapd: eth7: STA 76:a8:34:97:a9:a6 IEEE 802.11: disassociated
Jun 18 07:53:55 hostapd: eth7: STA 76:a8:34:97:a9:a6 IEEE 802.11: disassociated
Jun 18 07:53:55 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 76:A8:34:97:A9:A6, status: 0, reason: Previous authentication no longer valid (2), rssi:-84
Jun 18 07:53:56 wlceventd: wlceventd_proc_event(662): eth7: Disassoc 76:A8:34:97:A9:A6, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0
Jun 18 07:53:56 hostapd: eth7: STA 76:a8:34:97:a9:a6 IEEE 802.11: disassociated
 
Skynet restarts dnsmasq when updating the malware lists and/or refreshing the whitelists. I'm guessing Skynet updated at 07:25 AM for you.
 
dave14305 said:
Skynet restarts dnsmasq when updating the malware lists and/or refreshing the whitelists. I'm guessing Skynet updated at 07:25 AM for you.
Click to expand...
Good point.

I will check if this occurs again tomorrow morning.

Thank you for the prompt response.
 
@dave14305 This was a really good call and I was hoping this was so simple, yet I experienced another dnsmasq restart at 6:25 PM yesterday, and there was no restart at 7:25 AM today (which seemed to be related to Skynet's update).
There are no entries in the log that provide any clues before or after the event.
The "Default message log level" is set to "notice". I will give a try to change it to see if it makes a difference.
Any advice on this matter would be greatly appreciated.
Thank you.

Jun 18 18:25:05 custom_script: Running /jffs/scripts/service-event (args: restart dnsmasq)
Jun 18 18:25:05 dnsmasq[24732]: exiting on receipt of SIGTERM
Jun 18 18:25:05 custom_config: Appending content of /jffs/configs/dnsmasq.conf.add.
Jun 18 18:25:05 dnsmasq[14943]: started, version 2.90 cachesize 1500
Jun 18 18:25:05 dnsmasq[14943]: DNSSEC validation enabled
Jun 18 18:25:05 dnsmasq[14943]: configured with trust anchor for <root> keytag 20326
Jun 18 18:25:05 dnsmasq[14943]: asynchronous logging enabled, queue limit is 5 messages
Jun 18 18:25:05 dnsmasq-dhcp[14943]: DHCP, IP range 192.168.102.2 -- 192.168.102.254, lease time 1d
Jun 18 18:25:05 dnsmasq-dhcp[14943]: DHCP, IP range 192.168.101.2 -- 192.168.101.254, lease time 1d
Jun 18 18:25:05 dnsmasq-dhcp[14943]: DHCP, IP range 172.16.1.100 -- 172.16.1.110, lease time 1d
Jun 18 18:25:05 custom_script: Running /jffs/scripts/service-event-end (args: restart dnsmasq)
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for use-application-dns.net
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for lan.local
Jun 18 18:25:05 dnsmasq[14943]: read /etc/hosts - 84 names
Jun 18 18:25:05 dnsmasq[14943]: using nameserver 9.9.9.9#53
Jun 18 18:25:05 dnsmasq[14943]: using nameserver 149.112.112.112#53
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for use-application-dns.net
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for lan.local
Jun 18 18:25:05 dnsmasq[14943]: using nameserver 9.9.9.9#53
Jun 18 18:25:05 dnsmasq[14943]: using nameserver 149.112.112.112#53
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for use-application-dns.net
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for lan.local
 
dave14305 said:
Look in cron to see what runs on a schedule.
Code: 
cru l
Click to expand...
Here is my cron list:
  • 25 18 * * * sh /jffs/scripts/firewall banmalware #Skynet_banmalware#
    • Daily at 18:25
  • 10 1 * * Mon sh /jffs/scripts/firewall update #Skynet_autoupdate#
    • At 01:10 each Monday
  • 0 * * * * sh /jffs/scripts/firewall save #Skynet_save#
    • Each hour
  • 52 */12 * * * sh /jffs/scripts/firewall debug genstats #Skynet_genstats#
    • at 12:52:00 and 00:52:00
Yesterday evening at 6:25 PM is indeed Skynet.
I will continue to monitor, keeping these schedules in mind.

Thanks
 
Last edited:
You must log in or register to reply here.

Similar threads

Tyrfing
Asus RT-AX88U Stuck on Merlin Firmware 388.1
Replies
9
Views
589
Tyrfing
Tyrfing
GraniteStateColin
DNSmasq to provide DHCP IP # and DNS name for systems on LAN
Replies
19
Views
2K
Patrick9876
P
A
Ting-fire device can't get DHCP addr direct from Asus router wifi...can get address from Asus router via TP-Link extender
Replies
14
Views
897
anastrophe
A
J
Device all of a sudden is assigning itself a 169.254 IP address when coming out of standby
2
Replies
36
Views
2K
JTnola
J
H
Solved xbox one not able to sign in when connected through router running asuswrt-merlin on an rt-ac5300.
Replies
5
Views
554
Squall Leonhart
Squall Leonhart
Similar threads
Thread starter Title Forum Replies Date
P In dnsmasq, how do I stop overriding an address if the server goes down? Asuswrt-Merlin 1
P dnsmasq custom domain doesn't work on windows 10 Asuswrt-Merlin 1
C How to make dnsmasq startup wait for USB mount? Asuswrt-Merlin 4
L Setting up 2 mac addresses to same IP in dnsmasq.conf.add Asuswrt-Merlin 6
alan6854321 Dnsmasq crashes, watchdog fails to restart it Asuswrt-Merlin 47
RMerlin Beta Asuswrt-Merlin 3004.388.6_x test builds (dnsmasq 2.90) Asuswrt-Merlin 102
RMerlin CVE 2023-50868 and CVE 2023-50387 in dnsmasq when DNSSEC is enabled Asuswrt-Merlin 30
C dnsmasq processes seem to be the wrong way around Asuswrt-Merlin 1
C Running dnsmasq with a huge config file like pihole - possible/sensible? Asuswrt-Merlin 10
C Does default dnsmasq configuration store LAN names? Asuswrt-Merlin 6

Similar threads

Latest threads

Support Us - Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Staff online

Members online

Total: 640 (members: 32, guests: 608)
Top