Home / server / Questions / 365613
In Process
facha
Asked: 2012-03-03 02:27:58 +0800 CST

TP-Link routers send DNS queries to 1.0.0.19. What is that?

  • 772

I've got a problem with TP-Link soho routers. The DNS forwarder of those routers tends to ignore the DNS servers obtained by DHCP and instead tries sending all DNS requests to this strange IP: 1.0.0.19? That IP doesn't respond.

Has anyone else seen that happen?

domain-name-system

2 Answers

  1. I work for an ISP and we use many TP-Link routers (740N, 841N, 941N etc.).All of these routers have that bug when the WAN interface is set to DHCP, even with the latest firmware installed.A way to deal with it is to manually enter the DNS servers in both - WAN and DHCP tabs.

    • 5

  2. That 1.0.0.19 IP address seems to belong to APNIC - http://www.apnic.net/ - the "Regional Internet Registry that allocates IP and AS numbers in the Asia Pacific region."

    The "whois" information in the APNIC web site for that IP address says that it belongs to the "APNIC Debogon project":

    http://wq.apnic.net/apnic-bin/whois.pl?searchtext=1.0.0.19

    I'm posting those "whois" results at the bottom of this post.

    What is the Debogon project? The Wikipedia article about "Bogon Filtering" - http://en.wikipedia.org/wiki/Bogon_filtering - says that "a bogon IP address is a bogus IP address, and an informal name for an IP packet on the public Internet that claims to be from an area of the IP address space reserved, but not yet allocated or delegated by the Internet Assigned Numbers Authority (IANA) or a delegated Regional Internet Registry (RIR). The areas of unallocated address space are called the bogon space."

    Having said that, I don't know why your TP-LINK router is sending all DNS requests to that IP address. I also have one TP-LINK router and I don't think it's displaying that behavior. When I get to that router, I'll check it.

    EDIT: The TP-Link that I mentioned is a wireless router "TL-WR340G" and it's connected to a cable modem. In the router web interface, in the "Network -> WAN" page, I have the "WAN Connection Type" set to "Static IP" and it is set to an IP address of the same network of the Cable Modem. The "Default Gateway" and "Primary DNS" are both set to the IP address of the Cablem Modem. I hope this helps! :-/

     APNIC found the following authoritative answer from: whois.apnic.net

% [whois.apnic.net node-5]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:        1.0.0.0 - 1.0.0.255
netname:        Debogon-prefix
descr:          APNIC Debogon Project
descr:          APNIC Pty Ltd
country:        AU
admin-c:        AR302-AP
tech-c:         AR302-AP
mnt-by:         APNIC-HM
mnt-routes:     MAINT-AU-APNIC-GM85-AP
mnt-irt:        IRT-APNICRANDNET-AU
status:         ASSIGNED PORTABLE
changed:        [email protected] 20110922
source:         APNIC

role:           APNIC RESEARCH
address:        PO Box 3646
address:        South Brisbane, QLD 4101
address:        Australia
country:        AU
phone:          +61-7-3858-3188
fax-no:         +61-7-3858-3199
e-mail:         [email protected]
remarks:        ++++++++++++++++++
remarks:        + Address blocks listed with this contact
remarks:        + are withheld from general use and are
remarks:        + only routed briefly for passive testing.
remarks:        +
remarks:        + If you are receiving unwanted traffic
remarks:        + it is almost certainly spoofed source
remarks:        + or hijacked address usage.
remarks:        +
remarks:        + http://en.wikipedia.org/wiki/IP_address_spoofing
remarks:        + http://en.wikipedia.org/wiki/Regional_internet_registry
remarks:        +
remarks:        ++++++++++++++++++
nic-hdl:        AR302-AP
tech-c:         AH256-AP
admin-c:        AH256-AP
mnt-by:         MAINT-APNIC-AP
changed:        [email protected] 20110822
source:         APNIC
    • 4