What happens when you re-use an IP that was a nameserver IP?

[Asia_Expat]

Difficult to choose a sub-forum for this topic...

I've lost a couple of weeks on some critical server load issues but I think I might have figured it out. I'd got to the stage where I had my head in the top drawer of my desk, and opening and closing the drawer on my head, trying to figure out why the load was going crazy...

Then it hit me. A week or two ago, the overloads were happening every hour or so. Now they're only happening once or twice per day... so the idea 'DNS propagation' popped into my head...

I recently swapped around my four IPs. When my host installed a new OS for me recently, he chose the wrong IP as the main server IP, which previously was actually a dedicated IP for my main/busiest website. No problem, I'll just use one of the others and shuffle accordingly...

BUT, the one I chose for my main site was the IP for the primary nameserver on the old OS... and so, I check the error logs and Apache statuses from the various overload incidents, and in most cases, the IPs that were getting stuck in infinite loops on forum threads had 'DNS' or 'NS' somewhere in their WHOIS data...

What a monumental screw up on my part. I guess all I can do is wait it out, for full propagation.

I wonder, if someone could talk about the technical side of this, and what might be happening to my server when the namservers come looking for DNS info but somehow get locked into forum threads?

[g1smd]

Thanks for sharing that. I guess the server would be swamped with requests for a while. I have no experience of doing that, but I'll bet you're not the first (nor the last).

[jdMorgan]

Interesting that it should have caused any problem, since that DNS traffic should have been on port 53, not port 80 or 443... Make sure your server accepts requests only on port 80 and port 443, and make sure there isn't a DNS daemon running and listening to port 53 as well.

Jim

[Asia_Expat]

TBH I've no idea why this is going on. I've paid a cPanel engineer to analyze this for me and he's suggested throwing up some monitoring software to see what's going on when the over loads occur. It happened again this morning (morning in my part of the world that is) and this time it was a Yahoo IP 67.195.111.246 which appears to be a NS IP that was apparently getting caught on dynamic forum URLs that are now rewritten to FURLs... server managed to send me a desperate notice that it's load was at 111.93 before giving up for about an hour..... ugggh, what a mess.