I was testing behavior in ocaml-dns using DNSvizor, and I noticed in tcpdump this:
08:53:52.316379 IP 172.23.0.53.9603 > 127.0.2.1.53: 21607 [1au] A? null.reynir.dk. (43)
In other words a UDP packet (containing a DNS query) was sent to 127.0.2.1 over the interface. As I understand RFC 1122 addresses in 127.0.0.0/8 MUST NOT appear outside the host.
This might belong to arp.
I was testing behavior in ocaml-dns using DNSvizor, and I noticed in tcpdump this:
In other words a UDP packet (containing a DNS query) was sent to 127.0.2.1 over the interface. As I understand RFC 1122 addresses in 127.0.0.0/8 MUST NOT appear outside the host.
This might belong to arp.