adguardhome send many packages to whois.arin.net:43

[purplegrape]

Today I found my adguardhome send many packages to whois.arin.net:43
is it behaved as designed ？

version： v0.106.3

command ountput ：lsof -P -p 1691

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
adguardho 1691 root cwd DIR 252,2 42 100716824 /var/lib/adguardhome
adguardho 1691 root rtd DIR 252,2 4096 64 /
adguardho 1691 root txt REG 252,2 21987328 100716819 /usr/bin/adguardhome
adguardho 1691 root mem-W REG 252,2 32768 100717044 /var/lib/adguardhome/data/stats.db
adguardho 1691 root mem-W REG 252,2 32768 100716761 /var/lib/adguardhome/data/sessions.db
adguardho 1691 root 0r CHR 1,3 0t0 23 /dev/null
adguardho 1691 root 1u unix 0xffff9c8577963c00 0t0 34030 socket
adguardho 1691 root 2u unix 0xffff9c8577963c00 0t0 34030 socket
adguardho 1691 root 3u a_inode 0,14 0 11342 [eventpoll]
adguardho 1691 root 4r FIFO 0,13 0t0 34032 pipe
adguardho 1691 root 5w FIFO 0,13 0t0 34032 pipe
adguardho 1691 root 6r a_inode 0,14 0 11342 inotify
adguardho 1691 root 7u a_inode 0,14 0 11342 [eventpoll]
adguardho 1691 root 8r FIFO 0,13 0t0 34033 pipe
adguardho 1691 root 9w FIFO 0,13 0t0 34033 pipe
adguardho 1691 root 10uW REG 252,2 32768 100716761 /var/lib/adguardhome/data/sessions.db
adguardho 1691 root 11uW REG 252,2 32768 100717044 /var/lib/adguardhome/data/stats.db
adguardho 1691 root 12u netlink 0t0 32971 NETFILTER
adguardho 1691 root 13u netlink 0t0 32972 NETFILTER
adguardho 1691 root 14r REG 252,2 759056 637374 /var/lib/adguardhome/data/filters/1621308198.txt
adguardho 1691 root 15r REG 252,2 720154 234662 /var/lib/adguardhome/data/filters/1.txt
adguardho 1691 root 16r REG 252,2 319876 11757 /var/lib/adguardhome/data/filters/2.txt
adguardho 1691 root 17r REG 252,2 1885803 637364 /var/lib/adguardhome/data/filters/1621308199.txt
adguardho 1691 root 18u IPv6 34043 0t0 TCP *:3000 (LISTEN)
adguardho 1691 root 19u IPv6 34045 0t0 TCP *:6443 (LISTEN)
adguardho 1691 root 20u IPv6 32973 0t0 UDP *:53
adguardho 1691 root 21u IPv6 32974 0t0 TCP *:53 (LISTEN)
adguardho 1691 root 22u IPv6 32975 0t0 TCP *:853 (LISTEN)
adguardho 1691 root 23u IPv6 32976 0t0 UDP *:784
adguardho 1691 root 24u IPv4 48872 0t0 TCP 11-22-33-44:43466->whois.arin.net:43 (SYN_SENT)
adguardho 1691 root 25u IPv6 48274 0t0 TCP 11-22-33-44:6443->11.110.22.220:58838 (ESTABLISHED)

iptables log

[ 2498.625709] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.212.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=42061 DF PROTO=TCP SPT=49076 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2503.806548] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.5.26.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=3185 DF PROTO=TCP SPT=46134 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2504.833625] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.5.26.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=3186 DF PROTO=TCP SPT=46134 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2506.881610] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.5.26.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=3187 DF PROTO=TCP SPT=46134 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2510.913555] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.5.26.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=3188 DF PROTO=TCP SPT=46134 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2515.992077] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.71.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=14436 DF PROTO=TCP SPT=43490 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2516.993497] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.71.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=14437 DF PROTO=TCP SPT=43490 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2519.041467] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.71.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=14438 DF PROTO=TCP SPT=43490 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2523.073420] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.71.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=14439 DF PROTO=TCP SPT=43490 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2528.155972] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.212.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=41991 DF PROTO=TCP SPT=49082 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2529.217358] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.212.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=41992 DF PROTO=TCP SPT=49082 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2531.265330] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.212.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=41993 DF PROTO=TCP SPT=49082 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2535.297287] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.212.0.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=41994 DF PROTO=TCP SPT=49082 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0
[ 2540.411146] iptables log: IN= OUT=eth0 SRC=10.1.0.102 DST=199.5.26.46 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=10343 DF PROTO=TCP SPT=46140 DPT=43 WINDOW=64240 RES=0x00 SYN URGP=0 UID=0 GID=0

[ainar-g]

Hello! Yes, it is our client sourcing feature working as intended. We plan to make any sources of information about clients disableable in #3020, so you may want to subscribe to that issue.

[andylau004]

ask one querstion ,,

in AdGuardHome.yaml config file, below options, just for enrich request client information ?

clients:
  runtime_sources:
    whois: true
    arp: true

thkx for reply