Bind & FORMERR resolving domain

**Fox!MURDER** · 07.03.2008, 15:44

Původně odeslal Rainbow

U mna to hodilo:

Kód:

version.bind    text = "9.3.2-P1"

Mozno je to cluster alebo co.

Ale kazdopadne to ten microsoft resolvovat nema.

a 62.24.64.2 ma vracet version "Apache" a zadnej cluster tam urcite neni ... takze hadam, ze mu vazne nekdo leze do DNS trafficu ...

**georgejares** · 07.03.2008, 15:50

Tak doufam, ze to nezerou ty zas.... sloane.cz

Ja taky nekde cestou lezu pres ne.

Konkretne:geo0-1-s144.c1.pop1.pra.sloane.cz

Jinak jsem nainstaloval bind 8.4.7 (posledni osmicku) a vse funguje spravne, vse se resolvuje. Bohuzel ale o nem pisou, ze ma dost bezpecnostnich der.

Ted mi dochazi, ze to zrat nemuzou, ponevadz to ke mne prijde.
Ta odpoved proste prijde fyzicky az k mymu serveru. Viz data z etherealu, co jsem posilal.
Podle mne ty servery odpovidaj v nejakem divnem formatu.
Z tech logu je videt, ze bind disabling EDNS0, ale ve skutecnosti se stale pta v EDNS0.

George

**Fox!MURDER** · 07.03.2008, 16:04

Původně odeslal georgejares

Tak doufam, ze to nezerou ty zas.... sloane.cz

Ja taky nekde cestou lezu pres ne.

Konkretne:geo0-1-s144.c1.pop1.pra.sloane.cz

Jinak jsem nainstaloval bind 8.4.7 (posledni osmicku) a vse funguje spravne, vse se resolvuje. Bohuzel ale o nem pisou, ze ma dost bezpecnostnich der.

Ted mi dochazi, ze to zrat nemuzou, ponevadz to ke mne prijde.
Ta odpoved proste prijde fyzicky az k mymu serveru. Viz data z etherealu, co jsem posilal.
Podle mne ty servery odpovidaj v nejakem divnem formatu.
Z tech logu je videt, ze bind disabling EDNS0, ale ve skutecnosti se stale pta v EDNS0.

George

oni to nezerou, oni odpovidaji za ty nameservery ...
192.5.5.241 ti proste nema odpovedet nic jinyho, nez TLD servery ... a ono to vraci rovnou resolvnute A a CNAME. Zaroven to vraci spatne odpovedi z 62.24.64.2, kde jsem si 100%ne jist, ze neni zadna zakernost ....

**NeMeM9aA** · 07.03.2008, 16:39

Původně odeslal Fox!MURDER

oni to nezerou, oni odpovidaji za ty nameservery ...
192.5.5.241 ti proste nema odpovedet nic jinyho, nez TLD servery ... a ono to vraci rovnou resolvnute A a CNAME. Zaroven to vraci spatne odpovedi z 62.24.64.2, kde jsem si 100%ne jist, ze neni zadna zakernost ....

Eh, tak tohle jsem opravdu necekal a neprisel bych na to. Zkusim bind v 8 verzi, protoze to mam na bezpecne malinke LAN, kde bezpecnostni diry nejsou tak velky problem.

**Rainbow** · 07.03.2008, 18:15

Pravdepodobne niekto niekde presmeruva vsetok traffic na porte 53. Treba to riesit s providerom.

**Fox!MURDER** · 07.03.2008, 18:31

Původně odeslal NeMeM9aA

Eh, tak tohle jsem opravdu necekal a neprisel bych na to. Zkusim bind v 8 verzi, protoze to mam na bezpecne malinke LAN, kde bezpecnostni diry nejsou tak velky problem.

vyzkousej schvalne

traceroute -p 53 192.5.5.241
traceroute -p 53 62.24.64.2

treba se prozradi ten zloduch ...

jinak v8 je taky reseni a na v9 by jednak melo jit globalne vypnout edns (je na to k dispozici patch) a druhak vypnout formerr (pokusi se z odpovedi vypacit co nejvic dat, i kdyz je ve spatnym formatu) ... muzes zkusit jeste toto ...

**georgejares** · 07.03.2008, 18:36

tak co si o tom myslite...

[root@server ~]# traceroute -p 53 192.5.5.241
traceroute to 192.5.5.241 (192.5.5.241), 30 hops max, 40 byte packets
1 f.root-servers.net (192.5.5.241) 5.243 ms 88.146.251.206 (88.146.251.206)
6.464 ms 10.572 ms
2 10.11.0.97 (10.11.0.97) 12.316 ms 12.873 ms 17.618 ms
3 10.11.0.13 (10.11.0.13) 17.598 ms 19.452 ms 20.429 ms
4 10.11.0.94 (10.11.0.94) 20.409 ms 22.386 ms 22.366 ms
5 ge0-1-s144.c1.pop1.pra.sloane.cz (88.146.176.33) 24.281 ms 24.264 ms 26.5
43 ms
6 v102.tr2.pop1.pra.sloane.cz (62.240.161.197) 26.523 ms 9.341 ms 15.677 ms
7 f-root1-nix.nic.cz (194.50.100.181) 17.707 ms 17.932 ms 20.431 ms
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
[root@server ~]# traceroute 192.5.5.241
traceroute to 192.5.5.241 (192.5.5.241), 30 hops max, 40 byte packets
1 88.146.251.206 (88.146.251.206) 5.129 ms 8.318 ms 8.318 ms
2 10.11.0.97 (10.11.0.97) 12.666 ms 14.656 ms 16.442 ms
3 10.11.0.13 (10.11.0.13) 18.213 ms 21.584 ms 21.729 ms
4 10.11.0.94 (10.11.0.94) 23.163 ms 23.119 ms 25.029 ms
5 ge0-1-s144.c1.pop1.pra.sloane.cz (88.146.176.33) 25.007 ms 26.194 ms 28.030 ms
6 v102.tr2.pop1.pra.sloane.cz (62.240.161.197) 26.126 ms 23.174 ms 20.695 ms
7 f-root1-nix.nic.cz (194.50.100.181) 22.532 ms 5.858 ms 14.436 ms
8 f.root-servers.net (192.5.5.241) 16.818 ms 16.803 ms 18.518 ms

George

**Fox!MURDER** · 07.03.2008, 18:51

Původně odeslal georgejares

tak co si o tom myslite...

[root@server ~]# traceroute -p 53 192.5.5.241
traceroute to 192.5.5.241 (192.5.5.241), 30 hops max, 40 byte packets
1 f.root-servers.net (192.5.5.241) 5.243 ms 88.146.251.206 (88.146.251.206)
6.464 ms 10.572 ms
2 10.11.0.97 (10.11.0.97) 12.316 ms 12.873 ms 17.618 ms
3 10.11.0.13 (10.11.0.13) 17.598 ms 19.452 ms 20.429 ms
4 10.11.0.94 (10.11.0.94) 20.409 ms 22.386 ms 22.366 ms
5 ge0-1-s144.c1.pop1.pra.sloane.cz (88.146.176.33) 24.281 ms 24.264 ms 26.5
43 ms
6 v102.tr2.pop1.pra.sloane.cz (62.240.161.197) 26.523 ms 9.341 ms 15.677 ms
7 f-root1-nix.nic.cz (194.50.100.181) 17.707 ms 17.932 ms 20.431 ms
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
[root@server ~]# traceroute 192.5.5.241
traceroute to 192.5.5.241 (192.5.5.241), 30 hops max, 40 byte packets
1 88.146.251.206 (88.146.251.206) 5.129 ms 8.318 ms 8.318 ms
2 10.11.0.97 (10.11.0.97) 12.666 ms 14.656 ms 16.442 ms
3 10.11.0.13 (10.11.0.13) 18.213 ms 21.584 ms 21.729 ms
4 10.11.0.94 (10.11.0.94) 23.163 ms 23.119 ms 25.029 ms
5 ge0-1-s144.c1.pop1.pra.sloane.cz (88.146.176.33) 25.007 ms 26.194 ms 28.030 ms
6 v102.tr2.pop1.pra.sloane.cz (62.240.161.197) 26.126 ms 23.174 ms 20.695 ms
7 f-root1-nix.nic.cz (194.50.100.181) 22.532 ms 5.858 ms 14.436 ms
8 f.root-servers.net (192.5.5.241) 16.818 ms 16.803 ms 18.518 ms

George

zkus jeste to druhe ip prosim ....

**georgejares** · 07.03.2008, 18:57

traceroute to 62.24.64.2 (62.24.64.2), 30 hops max, 40 byte packets
1 ns1.dkm.cz (62.24.64.2) 9.349 ms 88.146.251.206 (88.146.251.206) 9.325 ms 11.579 ms
2 10.11.0.97 (10.11.0.97) 12.819 ms 17.459 ms 17.439 ms
3 10.11.0.13 (10.11.0.13) 19.160 ms 19.143 ms 20.853 ms
4 10.11.0.94 (10.11.0.94) 20.869 ms 22.271 ms 22.250 ms
5 ge0-1-s144.c1.pop1.pra.sloane.cz (88.146.176.33) 24.021 ms 24.005 ms 27.386 ms
6 v102.tr2.pop1.pra.sloane.cz (62.240.161.197) 28.782 ms 11.505 ms 11.754 ms
7 nix2.dkm.cz (194.50.100.36) 13.626 ms 13.690 ms 16.422 ms
8 cz-prg01a-ra1-ge-0-0-0-v50.aorta.net (213.46.172.1

16.405 ms 20.985 ms 20.966 ms
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * *
[root@server ~]# traceroute 62.24.64.2
traceroute to 62.24.64.2 (62.24.64.2), 30 hops max, 40 byte packets
1 88.146.251.206 (88.146.251.206) 5.221 ms 5.194 ms 6.935 ms
2 10.11.0.97 (10.11.0.97) 15.744 ms 15.800 ms 21.700 ms
3 10.11.0.13 (10.11.0.13) 22.657 ms 24.094 ms 24.075 ms
4 10.11.0.94 (10.11.0.94) 26.070 ms 26.048 ms 28.005 ms
5 ge0-1-s144.c1.pop1.pra.sloane.cz (88.146.176.33) 28.081 ms 29.484 ms 29.464 ms
6 v102.tr2.pop1.pra.sloane.cz (62.240.161.197) 31.363 ms 25.742 ms 26.354 ms
7 nix2.dkm.cz (194.50.100.36) 27.506 ms 6.146 ms 14.565 ms
8 cz-prg01a-ra1-ge-0-0-0-v50.aorta.net (213.46.172.1

14.546 ms 16.756 ms 18.449 ms
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 *
[root@server ~]#

**Fox!MURDER** · 07.03.2008, 19:03

hm. ty tracerouty vypadaj ok. takhle na to asi neprijdem

edit: jeste muzem zkusit

Kód:

dig +norec @F.ROOT-SERVERS.NET HOSTNAME.BIND CHAOS TXT

**georgejares** · 07.03.2008, 19:17

[root@server log]# dig +norec @F.ROOT-SERVERS.NET HOSTNAME.BIND CHAOS TXT

; <<>> DiG 9.4.2 <<>> +norec @F.ROOT-SERVERS.NET HOSTNAME.BIND CHAOS TXT
; (2 servers found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOTIMP, id: 7414
;; flags: qr ra; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; Query time: 8 msec
;; SERVER: 192.5.5.241#53(192.5.5.241)
;; WHEN: Fri Mar 7 19:05:45 2008
;; MSG SIZE rcvd: 12

Ted trochu ztracim souvislosti, o co ti jde.
Nicmene mezi tim zkousim dale, a prisel jsem na to, ze ani ten bind v8 neni tak OK. neumi prelozit treba "www.microchip.com"
v ethereal vidim, ze se udp na 53 dotaze 198.175.253.201 na zminenou domenu, prijde odpoved a hned potom se TCP na p53 snazi spojit se stejnym serverem, ale ten nepotvrdi ani SYN, takze ke spojeni nedojde. To uz mi hlava nebere. Nicmene, toto je asi zase jiny problem.
Vratim asi zpatky bind v9 a zkusim, co jsi radil, ale nevim jak.
Prosim tedy trosku podrobneji, jak vypnout FORMERR, jestli to vis z hlavy, jinak taky budu hledat.
Patch snad zvladnu, i kdyz mi fedora8 defaultne cpe verzi bindu 9.5.xxx, tak tam radsi nainstaluju oficialni posledni stabilni 9.4.xxx

Mimochodem, ty traceroutery mi nepripadaj moc v pohode, kdyz
traceroute -p 53 192.5.5.241
skonci na serveru xxxxx.nic.cz
nic.cz je snad spravce TLD .cz a ne router

Diky
George

**NeMeM9aA** · 07.03.2008, 19:26

traceroute mam stejny jako georgejares (tedy ten konec samozrejme)

**Fox!MURDER** · 07.03.2008, 19:39

Původně odeslal georgejares

[root@server log]# dig +norec @F.ROOT-SERVERS.NET HOSTNAME.BIND CHAOS TXT

Ted trochu ztracim souvislosti, o co ti jde.
Nicmene mezi tim zkousim dale, a prisel jsem na to, ze ani ten bind v8 neni tak OK. neumi prelozit treba "www.microchip.com"
v ethereal vidim, ze se udp na 53 dotaze 198.175.253.201 na zminenou domenu, prijde odpoved a hned potom se TCP na p53 snazi spojit se stejnym serverem, ale ten nepotvrdi ani SYN, takze ke spojeni nedojde. To uz mi hlava nebere. Nicmene, toto je asi zase jiny problem.
Vratim asi zpatky bind v9 a zkusim, co jsi radil, ale nevim jak.
Prosim tedy trosku podrobneji, jak vypnout FORMERR, jestli to vis z hlavy, jinak taky budu hledat.
Patch snad zvladnu, i kdyz mi fedora8 defaultne cpe verzi bindu 9.5.xxx, tak tam radsi nainstaluju oficialni posledni stabilni 9.4.xxx

Mimochodem, ty traceroutery mi nepripadaj moc v pohode, kdyz
traceroute -p 53 192.5.5.241
skonci na serveru xxxxx.nic.cz
nic.cz je snad spravce TLD .cz a ne router

Diky
George

http://wilmer.gaast.net/downloads/bi...ns-global.diff (imho to pujde pouzit i na novejsi verze .... potreba zkusit)
ten formerr ted nemuzu najit ... vyhrabal jsem to nekde ve zdrojacich ...

skoda, ze me to tady nedela ... bych se na to docela rad sam podival

Edit: to ze traceroute konci v nic.cz je naprosto ok ... http://www.isc.org/ops/f-root/prg1.php

ale i ty prazsky servery odpovidaji na hostname.bind... (tim by mel server prozradit, jak se ve skutecnosti jmenuje) - podle me je neco zacarovane nekde u vas v siti ...
kterej hop mate prvni spolecnej ? ty sloany ?

Kód:

; <<>> DiG 9.4.2 <<>> +norec @F.ROOT-SERVERS.NET HOSTNAME.BIND CHAOS TXT
; (2 servers found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOTIMP, id: 7414
;; flags: qr ra; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; Query time: 8 msec
;; SERVER: 192.5.5.241#53(192.5.5.241)
;; WHEN: Fri Mar  7 19:05:45 2008
;; MSG SIZE  rcvd: 12

**georgejares** · 08.03.2008, 21:48

Zdravim,
tak jsem dnes udelal pokus:

Kód:

dig @MUJSERVER www.bckolin.cz

dig @DNSSERVERMYHOPROVIDERA www.bckolin.cz

Prvni samozrejme neodpovedel, druhy ano.
Co je ale zajimave, ze pomoci etherealu jsem zjistil, ze obe odpovedi jsou naprosto stejne. Jediny rozdil je v tom, ze v prvnim pripade odpovida root.server programu "bind" a ve druhem pripade odpovida DNSSERVERMYHOPROVIDERA programu "dig".

Souvislost mezi odpovedmi, ktere bind pobere a nepobere je asi takova, ze odpovedi delsi nez 512 octets (jestli to chapu dobre, tak 256 bytu) hlasi jako formerr. To znamena, jako by bind mel nejakej interni filtr na udppakety delsi nez 521 oktetu. Nevim ale kde. Firewall to nemuze byt, protoze potom by to neprolezlo ani pro "dig". Nenapada mne, co dalsiho bych k tomu dodal. Podle mne je to problem v bindu.

**admix** · 09.03.2008, 00:07

Ta hranice pro odpoved by mela byt 512byte a pokud je odpoved nad tuhle hranici, tak se posila truncated reply - pokud klient pozaduje uplnou informaci, musi pozadat pres tcp. Je hodne zvlastni, ze ti chodi odpovedi od root serveru, protoze ty pokud vim rekurzivni dotazy vubec neumoznuji

**georgejares** · 09.03.2008, 09:46

A proc tedy vsude pisou 512 oktets.
V etherealu jsem videl i UDP pakety delsi nez 512 bytu.
Jeste o ktere delce se mluvi, o delce celeho IP paketu, celeho UDP paketu nebo celeho DNS paketu...

**georgejares** · 09.03.2008, 12:52

Ty odpovedi od rootserveru chodi, nektere muj bind pobere, jine ne.
Ted mi zacala fungovat jedna domena, ale jine zas ne.
Souvislost s delkou paketu rusim. Nicmene, ted se muj bind nedotazuje root server, ale b.ns.nic.cz. Od nej prichazeji odpovedi, ktere muj bind pobira i nepobira. V etherealu to vypada vse vpohode, odpovedi jsou korektni a uplne a bez chyb.

Jinak by mne jeste zajimalo, jak ten bind vubec funguje.
Konfigurak mam ted z oficialnich stranek pro :

Kód:

// Two corporate subnets we wish to allow queries from.
acl corpnets { 192.168.1.1/24; 127.0.0.1; };
options {
    directory "/var/named";           // Working directory
    allow-query { corpnets; };
//    query-source      port 53;
    edns-udp-size 1024;
    max-udp-size 1024;
//    check-names ignore;
    check-mx ignore;
    check-wildcard no;
    check-integrity no;
    check-mx-cname ignore ;
    check-srv-cname ignore;
    check-sibling no;

};
// Provide a reverse mapping for the loopback address 127.0.0.1
zone "0.0.127.in-addr.arpa" {
    type master;
    file "named.localhost";
    notify no;
};

a v named.localhost mam:

Kód:

$TTL 1D
@       IN SOA  @ rname.invalid. (
                                        0       ; serial
                                        1D      ; refresh
                                        1H      ; retry
                                        1W      ; expire
                                        3H )    ; minimum
        NS      @
        A       127.0.0.1
        AAAA    ::1

Odkud si tedy bere jmena root serveru nebo serveru, kterych se ma dotazovat?

Dle navodu na offico strankach je tahle configurace pro jednoduchy caching name server.
Ovsem ta konfigurace na toto prapodivne chovani nema zadny vyznam. Bud mam od zacatku neco blbe, nebo nevim.
Jeste bych dodal ze konfigurace serveru je:
dve sitove karty, jedna s verejnou IP a druha s vnitrni siti.
Zkusim jeste starej server a koukat se co prolejza pres router, na kterym je i bind.

**georgejares** · 09.03.2008, 18:32

Dalsi souvislosti, ktere se mi jevi jako rozdilne u odpovidajicich a neodpovidajicich server jsou ty, ze:
1) odpovidajici servery maji mensi pocet Authority RSS a Aditional RSS zaznamu
2) odpovidajici servery maji mensi TTL

**Fox!MURDER** · 09.03.2008, 18:49

Původně odeslal georgejares

Dalsi souvislosti, ktere se mi jevi jako rozdilne u odpovidajicich a neodpovidajicich server jsou ty, ze:
1) odpovidajici servery maji mensi pocet Authority RSS a Aditional RSS zaznamu
2) odpovidajici servery maji mensi TTL

hmm kolik mas TTL na tech prichozich paketech? Edit: nebo obecne kolik tam je ?

**georgejares** · 09.03.2008, 19:13

Udelam takovy maly souhrn:
Jeste doplnim, ze jsem udelal pokus, kdy jsem spustil DNS na vnitrnim serveru s jednou sitovkou, ktery chodil pres branu ven (na ktere je taky DNS, ktera se chova stejne blbe jako ta vnitrni). Problemova data, ktera jsem odchytal jsou stejna na drate, ktery je mezi servrem na vnitrni siti a branou, i na drate, ktery je mezi braznou a internetem.
Abych to naznacil:

SERVER S1 , jedna sitovka 192.168.1.3 je ve vnitrni siti a bezi na nem bind
SERVER S2, dve sitovky, 192.168.1.1 pro vnitrni sit a 88.146.251.201 (verejna IP) pro internet. Slouzi jako router (a mel by slouzit i jako caching DNS server pro vnitrni sit)

Takze:
Odchytana data jsou mezi 192.168.1.3 a 192.168.1.1

Celkova komunikace:

Kód:

No.     Time        Source                SourceMAC             Destination           DestMAC               Protocol Info
   6256 1204.086905 192.168.1.3           00:b0:d0:31:33:7e     192.5.5.241           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6257 1204.087648 192.168.1.3           00:b0:d0:31:33:7e     192.5.5.241           00:15:58:a7:2c:90     DNS      Standard query NS <Root>
   6259 1204.252609 192.5.5.241           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6260 1204.254732 192.168.1.3           00:b0:d0:31:33:7e     128.8.10.90           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6261 1204.336741 192.5.5.241           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response NS i.root-servers.net NS k.root-servers.net NS d.root-servers.net NS f.root-servers.net NS g.root-servers.net NS h.root-servers.net NS m.root-servers.net NS l.root-servers.net NS b.root-servers.net NS e.root-servers.net NS a.root-servers.net NS j.root-servers.net NS c.root-servers.net
   6263 1204.429027 128.8.10.90           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6264 1204.430830 192.168.1.3           00:b0:d0:31:33:7e     202.12.27.33          00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6268 1204.638181 202.12.27.33          00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6269 1204.640034 192.168.1.3           00:b0:d0:31:33:7e     192.33.4.12           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6273 1204.831800 192.33.4.12           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6274 1204.833604 192.168.1.3           00:b0:d0:31:33:7e     192.112.36.4          00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6278 1205.064535 192.112.36.4          00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6279 1205.066373 192.168.1.3           00:b0:d0:31:33:7e     192.36.148.17         00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6280 1205.239516 192.36.148.17         00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6281 1205.241426 192.168.1.3           00:b0:d0:31:33:7e     193.0.14.129          00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6282 1205.398754 193.0.14.129          00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6283 1205.400567 192.168.1.3           00:b0:d0:31:33:7e     192.203.230.10        00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6284 1205.549708 192.203.230.10        00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6285 1205.551399 192.168.1.3           00:b0:d0:31:33:7e     128.63.2.53           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6286 1205.744772 128.63.2.53           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6287 1205.746677 192.168.1.3           00:b0:d0:31:33:7e     199.7.83.42           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6288 1205.901128 199.7.83.42           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6289 1205.902991 192.168.1.3           00:b0:d0:31:33:7e     192.228.79.201        00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6290 1206.038780 192.228.79.201        00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6291 1206.040635 192.168.1.3           00:b0:d0:31:33:7e     198.41.0.4            00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6292 1206.205111 198.41.0.4            00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6293 1206.206941 192.168.1.3           00:b0:d0:31:33:7e     192.58.128.30         00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6294 1206.354802 192.58.128.30         00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6295 1206.361098 192.168.1.3           00:b0:d0:31:33:7e     192.228.79.201        00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6296 1206.473671 192.228.79.201        00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6297 1206.475364 192.168.1.3           00:b0:d0:31:33:7e     192.58.128.30         00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6298 1206.631173 192.58.128.30         00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6299 1206.632937 192.168.1.3           00:b0:d0:31:33:7e     192.203.230.10        00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6300 1206.755267 192.203.230.10        00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6301 1206.756876 192.168.1.3           00:b0:d0:31:33:7e     199.7.83.42           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6302 1206.909498 199.7.83.42           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6303 1206.911259 192.168.1.3           00:b0:d0:31:33:7e     193.0.14.129          00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6304 1207.092086 193.0.14.129          00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6305 1207.093853 192.168.1.3           00:b0:d0:31:33:7e     198.41.0.4            00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6306 1207.267025 198.41.0.4            00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6307 1207.268740 192.168.1.3           00:b0:d0:31:33:7e     128.8.10.90           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6308 1207.441030 128.8.10.90           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6309 1207.442801 192.168.1.3           00:b0:d0:31:33:7e     192.36.148.17         00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6310 1207.626405 192.36.148.17         00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6311 1207.628158 192.168.1.3           00:b0:d0:31:33:7e     192.33.4.12           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6312 1207.783978 192.33.4.12           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6313 1207.785758 192.168.1.3           00:b0:d0:31:33:7e     128.63.2.53           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6314 1207.929877 128.63.2.53           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6315 1207.931629 192.168.1.3           00:b0:d0:31:33:7e     202.12.27.33          00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6316 1208.096459 202.12.27.33          00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6317 1208.098107 192.168.1.3           00:b0:d0:31:33:7e     192.112.36.4          00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6318 1208.271924 192.112.36.4          00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   6319 1208.273662 192.168.1.3           00:b0:d0:31:33:7e     192.5.5.241           00:15:58:a7:2c:90     DNS      Standard query A www.bckolin.cz
   6320 1208.395349 192.5.5.241           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150
   8175 1677.803934 192.168.1.3           00:b0:d0:31:33:7e     192.228.79.201        00:15:58:a7:2c:90     DNS      Standard query A www.idnes.cz
   8179 1678.311981 192.228.79.201        00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c1.idnes.cz A 194.79.52.192
   8180 1678.314656 192.168.1.3           00:b0:d0:31:33:7e     192.203.230.10        00:15:58:a7:2c:90     DNS      Standard query A c1.idnes.cz
   8181 1678.459115 192.203.230.10        00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response A 194.79.52.192
   8529 1687.909254 192.168.1.3           00:b0:d0:31:33:7e     192.168.1.1           00:15:58:a7:2c:90     DNS      Standard query A www.idnes.cz
   8531 1688.229250 192.168.1.1           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c1.idnes.cz A 194.79.52.192

a ted odpoved, kterou bind nepobral (zdekodovane etherealem):

Kód:

No.     Time        Source                SourceMAC             Destination           DestMAC               Protocol Info
   6259 1204.252609 192.5.5.241           00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c150un.forpsi.com A 81.2.194.150

Frame 6259 (320 bytes on wire, 320 bytes captured)
    Arrival Time: Mar  9, 2008 18:19:11.542858000
    Time delta from previous packet: 0.164961000 seconds
    Time since reference or first frame: 1204.252609000 seconds
    Frame Number: 6259
    Packet Length: 320 bytes
    Capture Length: 320 bytes
    Protocols in frame: eth:ip:udp:dns
Ethernet II, Src: 192.168.1.1 (00:15:58:a7:2c:90), Dst: 192.168.1.3 (00:b0:d0:31:33:7e)
    Destination: 192.168.1.3 (00:b0:d0:31:33:7e)
    Source: 192.168.1.1 (00:15:58:a7:2c:90)
    Type: IP (0x0800)
Internet Protocol, Src: 192.5.5.241 (192.5.5.241), Dst: 192.168.1.3 (192.168.1.3)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 306
    Identification: 0x0000 (0)
    Flags: 0x04 (Don't Fragment)
        0... = Reserved bit: Not set
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 60
    Protocol: UDP (0x11)
    Header checksum: 0xb619 [correct]
    Source: 192.5.5.241 (192.5.5.241)
    Destination: 192.168.1.3 (192.168.1.3)
User Datagram Protocol, Src Port: domain (53), Dst Port: domain (53)
    Source port: domain (53)
    Destination port: domain (53)
    Length: 286
    Checksum: 0x57da [correct]
Domain Name System (response)
    Transaction ID: 0x5f6d
    Flags: 0x8180 (Standard query response, No error)
        1... .... .... .... = Response: Message is a response
        .000 0... .... .... = Opcode: Standard query (0)
        .... .0.. .... .... = Authoritative: Server is not an authority for domain
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... 1... .... = Recursion available: Server can do recursive queries
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
        .... .... .... 0000 = Reply code: No error (0)
    Questions: 1
    Answer RRs: 2
    Authority RRs: 6
    Additional RRs: 6
    Queries
        www.bckolin.cz: type A, class IN
            Name: www.bckolin.cz
            Type: A (Host address)
            Class: IN (0x0001)
    Answers
        www.bckolin.cz: type CNAME, class IN, cname c150un.forpsi.com
            Name: www.bckolin.cz
            Type: CNAME (Canonical name for an alias)
            Class: IN (0x0001)
            Time to live: 3 days, 23 hours, 4 minutes, 57 seconds
            Data length: 19
            Primary name: c150un.forpsi.com
        c150un.forpsi.com: type A, class IN, addr 81.2.194.150
            Name: c150un.forpsi.com
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 8 minutes, 47 seconds
            Data length: 4
            Addr: 81.2.194.150
    Authoritative nameservers
        cz: type NS, class IN, ns b.ns.nic.cz
            Name: cz
            Type: NS (Authoritative name server)
            Class: IN (0x0001)
            Time to live: 1 day, 20 hours, 4 minutes
            Data length: 11
            Name server: b.ns.nic.cz
        cz: type NS, class IN, ns f.ns.nic.cz
            Name: cz
            Type: NS (Authoritative name server)
            Class: IN (0x0001)
            Time to live: 1 day, 20 hours, 4 minutes
            Data length: 4
            Name server: f.ns.nic.cz
        cz: type NS, class IN, ns a.ns.nic.cz
            Name: cz
            Type: NS (Authoritative name server)
            Class: IN (0x0001)
            Time to live: 1 day, 20 hours, 4 minutes
            Data length: 4
            Name server: a.ns.nic.cz
        cz: type NS, class IN, ns d.ns.nic.cz
            Name: cz
            Type: NS (Authoritative name server)
            Class: IN (0x0001)
            Time to live: 1 day, 20 hours, 4 minutes
            Data length: 4
            Name server: d.ns.nic.cz
        cz: type NS, class IN, ns c.ns.nic.cz
            Name: cz
            Type: NS (Authoritative name server)
            Class: IN (0x0001)
            Time to live: 1 day, 20 hours, 4 minutes
            Data length: 4
            Name server: c.ns.nic.cz
        cz: type NS, class IN, ns e.ns.nic.cz
            Name: cz
            Type: NS (Authoritative name server)
            Class: IN (0x0001)
            Time to live: 1 day, 20 hours, 4 minutes
            Data length: 4
            Name server: e.ns.nic.cz
    Additional records
        b.ns.nic.cz: type A, class IN, addr 217.31.205.188
            Name: b.ns.nic.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 5 minutes, 19 seconds
            Data length: 4
            Addr: 217.31.205.188
        f.ns.nic.cz: type A, class IN, addr 193.171.255.48
            Name: f.ns.nic.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 15 minutes, 6 seconds
            Data length: 4
            Addr: 193.171.255.48
        a.ns.nic.cz: type A, class IN, addr 217.31.205.180
            Name: a.ns.nic.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 24 minutes, 58 seconds
            Data length: 4
            Addr: 217.31.205.180
        d.ns.nic.cz: type A, class IN, addr 193.29.206.1
            Name: d.ns.nic.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 28 minutes, 31 seconds
            Data length: 4
            Addr: 193.29.206.1
        c.ns.nic.cz: type A, class IN, addr 195.66.241.202
            Name: c.ns.nic.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 27 minutes, 49 seconds
            Data length: 4
            Addr: 195.66.241.202
        e.ns.nic.cz: type A, class IN, addr 194.146.105.38
            Name: e.ns.nic.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 18 minutes, 59 seconds
            Data length: 4
            Addr: 194.146.105.38

a odpoved, kterou bind pobral

Kód:

No.     Time        Source                SourceMAC             Destination           DestMAC               Protocol Info
   8179 1678.311981 192.228.79.201        00:15:58:a7:2c:90     192.168.1.3           00:b0:d0:31:33:7e     DNS      Standard query response CNAME c1.idnes.cz A 194.79.52.192

Frame 8179 (178 bytes on wire, 178 bytes captured)
    Arrival Time: Mar  9, 2008 18:27:05.602230000
    Time delta from previous packet: 0.508047000 seconds
    Time since reference or first frame: 1678.311981000 seconds
    Frame Number: 8179
    Packet Length: 178 bytes
    Capture Length: 178 bytes
    Protocols in frame: eth:ip:udp:dns
Ethernet II, Src: 192.168.1.1 (00:15:58:a7:2c:90), Dst: 192.168.1.3 (00:b0:d0:31:33:7e)
    Destination: 192.168.1.3 (00:b0:d0:31:33:7e)
    Source: 192.168.1.1 (00:15:58:a7:2c:90)
    Type: IP (0x0800)
Internet Protocol, Src: 192.228.79.201 (192.228.79.201), Dst: 192.168.1.3 (192.168.1.3)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 164
    Identification: 0x0000 (0)
    Flags: 0x04 (Don't Fragment)
        0... = Reserved bit: Not set
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 60
    Protocol: UDP (0x11)
    Header checksum: 0x6bf0 [correct]
    Source: 192.228.79.201 (192.228.79.201)
    Destination: 192.168.1.3 (192.168.1.3)
User Datagram Protocol, Src Port: domain (53), Dst Port: domain (53)
    Source port: domain (53)
    Destination port: domain (53)
    Length: 144
    Checksum: 0x6e0c [correct]
Domain Name System (response)
    Transaction ID: 0x7fa3
    Flags: 0x8180 (Standard query response, No error)
        1... .... .... .... = Response: Message is a response
        .000 0... .... .... = Opcode: Standard query (0)
        .... .0.. .... .... = Authoritative: Server is not an authority for domain
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... 1... .... = Recursion available: Server can do recursive queries
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
        .... .... .... 0000 = Reply code: No error (0)
    Questions: 1
    Answer RRs: 2
    Authority RRs: 2
    Additional RRs: 2
    Queries
        www.idnes.cz: type A, class IN
            Name: www.idnes.cz
            Type: A (Host address)
            Class: IN (0x0001)
    Answers
        www.idnes.cz: type CNAME, class IN, cname c1.idnes.cz
            Name: www.idnes.cz
            Type: CNAME (Canonical name for an alias)
            Class: IN (0x0001)
            Time to live: 15 minutes, 55 seconds
            Data length: 5
            Primary name: c1.idnes.cz
        c1.idnes.cz: type A, class IN, addr 194.79.52.192
            Name: c1.idnes.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 15 minutes, 55 seconds
            Data length: 4
            Addr: 194.79.52.192
    Authoritative nameservers
        idnes.cz: type NS, class IN, ns ns.mafra.cz
            Name: idnes.cz
            Type: NS (Authoritative name server)
            Class: IN (0x0001)
            Time to live: 22 minutes, 37 seconds
            Data length: 11
            Name server: ns.mafra.cz
        idnes.cz: type NS, class IN, ns ns2.mafra.cz
            Name: idnes.cz
            Type: NS (Authoritative name server)
            Class: IN (0x0001)
            Time to live: 22 minutes, 37 seconds
            Data length: 6
            Name server: ns2.mafra.cz
    Additional records
        ns.mafra.cz: type A, class IN, addr 194.79.53.77
            Name: ns.mafra.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 30 minutes, 53 seconds
            Data length: 4
            Addr: 194.79.53.77
        ns2.mafra.cz: type A, class IN, addr 194.79.55.77
            Name: ns2.mafra.cz
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 40 minutes, 22 seconds
            Data length: 4
            Addr: 194.79.55.77

Jak jsem psal, rozdily jsou v pocetu Authority RSS a Aditional RSS zaznamu
a v TTL u jednotlivych odpovedi (jedna se o TTL DNS protokolu, ne o TTL IP protokolu)
Podle mne tedy zadny firewall ani jadro samotny paket nezere.
Na 192.168.1.1 je bind v9.5.x a fedora5 (aktualizovana)
Na 192.168.1.3 je bind v9.4.x a fedora8 (posledni aktualizace)

Po rucni kompilaci bind v9.4.x stazene z isc.org se server choval stejne.
Jsem z toho magor. Musi to byt nekde v bindu. Ale dost dlouho.
Nechapu, ze takovyhle problem mam jenom ja. A NeMeM9aA.

Jestli chces, tak ti poslu root heslo a muzes se mi na to podivat (byl bych moc rad, hlavne kdyby se to vyresilo)

**Fox!MURDER** · 09.03.2008, 19:16

Původně odeslal georgejares

Udelam takovy maly souhrn:
Jeste doplnim, ze jsem udelal pokus, kdy jsem spustil DNS na vnitrnim serveru s jednou sitovkou, ktery chodil pres branu ven (na ktere je taky DNS, ktera se chova stejne blbe jako ta vnitrni). Problemova data, ktera jsem odchytal jsou stejna na drate, ktery je mezi servrem na vnitrni siti a branou, i na drate, ktery je mezi braznou a internetem.
Abych to naznacil:

SERVER S1 , jedna sitovka 192.168.1.3 je ve vnitrni siti a bezi na nem bind
SERVER S2, dve sitovky, 192.168.1.1 pro vnitrni sit a 88.146.251.201 (verejna IP) pro internet. Slouzi jako router (a mel by slouzit i jako caching DNS server pro vnitrni sit)

Takze:
Odchytana data jsou mezi 192.168.1.3 a 192.168.1.1

Celkova komunikace:
....

Jak jsem psal, rozdily jsou v pocetu Authority RSS a Aditional RSS zaznamu
a v TTL u jednotlivych odpovedi (jedna se o TTL DNS protokolu, ne o TTL IP protokolu)
Podle mne tedy zadny firewall ani jadro samotny paket nezere.
Na 192.168.1.1 je bind v9.5.x a fedora5 (aktualizovana)
Na 192.168.1.3 je bind v9.4.x a fedora8 (posledni aktualizace)

Po rucni kompilaci bind v9.4.x stazene z isc.org se server choval stejne.
Jsem z toho magor. Musi to byt nekde v bindu. Ale dost dlouho.
Nechapu, ze takovyhle problem mam jenom ja. A NeMeM9aA.

Jestli chces, tak ti poslu root heslo a muzes se mi na to podivat (byl bych moc rad, hlavne kdyby se to vyresilo)

cim dal vic se utvrzuju v tom, ze je neco na pul cesty ...
jestli chces, tak na to mrknu ... napis na icq, jabberu (fox _at_ jabber.cz) nebo sz ...

**Fox!MURDER** · 09.03.2008, 20:20

takze ...
trochu jsem si hral a zjisteni je takove, ze misto toho, aby dotaz na domenu prisel primo, prijde ze serveru
77.48.100.254 - tj. rns2.sloane.cz ...
jeste zkusim mrknout na to, proc to vadi bindu, ale hadam ze to bude nejakej konflikt v obsahu ...

Edit3: Abych predesel zmateni to co vypada jako vystup z digu je jen vnitrni dump paketu z bindu - ne vystup z digu

Edit1: takze odhaleno i v cem je problem ... trosku jsem si pohral s kodem bindu a pridal si par debugu ...

Kód:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:  62120
;; flags: qr rd ra ; QUESTION: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;cb.icq.com.                    IN      A

;; ANSWER SECTION:
cb.icq.com.             319     IN      CNAME   cb-mv01.blue.aol.com.
cb-mv01.blue.aol.com.   1254    IN      A       64.12.164.55

;; AUTHORITY SECTION:
icq.com.                168194  IN      NS      dns-01.icq.net.
icq.com.                168194  IN      NS      dns-02.icq.net.

;; ADDITIONAL SECTION:
dns-01.icq.net.         84960   IN      A       64.12.51.134
dns-02.icq.net.         84305   IN      A       205.188.157.234

Kód:

((type[2] == dns_rdatatype_ns[2] ||type[2] == dns_rdatatype_soa[6]) &&!dns_name_issubdomain(qname[cb-mv01blueaolcom], name[icqcom])[0])

(v hranate zavorce je obsah te promenne)

muj tip na interpretaci je, ze cb-mv01.blue.aol.com je v domene aol.com pro kterou nemame autoritu v tehle odpovedi...

Edit2: to potvrzuje i druha nefcni domena:

Kód:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:  38401
;; flags: qr rd ra ; QUESTION: 1, ANSWER: 2, AUTHORITY: 6, ADDITIONAL: 6
;; QUESTION SECTION:
;www.bckolin.cz.                        IN      A

;; ANSWER SECTION:
www.bckolin.cz.         327373  IN      CNAME   c150un.forpsi.com.
c150un.forpsi.com.      1791    IN      A       81.2.194.150

;; AUTHORITY SECTION:
cz.                     164959  IN      NS      b.ns.nic.cz.
cz.                     164959  IN      NS      f.ns.nic.cz.
cz.                     164959  IN      NS      a.ns.nic.cz.
cz.                     164959  IN      NS      d.ns.nic.cz.
cz.                     164959  IN      NS      c.ns.nic.cz.
cz.                     164959  IN      NS      e.ns.nic.cz.

;; ADDITIONAL SECTION:
b.ns.nic.cz.            1281    IN      A       217.31.205.188
f.ns.nic.cz.            392     IN      A       193.171.255.48
a.ns.nic.cz.            1489    IN      A       217.31.205.180
d.ns.nic.cz.            1193    IN      A       193.29.206.1
c.ns.nic.cz.            1170    IN      A       195.66.241.202
e.ns.nic.cz.            624     IN      A       194.146.105.38

Kód:

 ((type[2] == dns_rdatatype_ns[2] ||type[2] == dns_rdatatype_soa[6]) &&!dns_name_issubdomain(qname[c150unforpsicom], name[cz])[0])

Edit4: Vsechno napovida tomu, ze sloane (nebo nekdo jiny po ceste) presmerovava traffic na 53/UDP na rns2.sloane.cz.
mam pro to nekolik 'dukazu'
a) ping na 192.5.5.241 vykazuje ttl=58
dns odpovedi z 192.5.5.241 vykazuji ttl=60
samozrejme, ze to klidne takhle muze byt na jednom stroji, ale je to silne nepravdepodobne, protoze by to moc nedavalo smysl
b) zkousel resolvovat svoji domenu (nejakablbost.murder.cz), kterou ale nikdo predtim urcite nezkousel a zkouset nebude, pac neni pouzita tak se na nejakablbost.murder.cz zeptalo rns2.sloane.cz

**georgejares** · 10.03.2008, 12:14

Takze jsem toho binda pripojil pod jinyho ISP a fungoval spravne.
Problem tedy bude u sloane.cz, jak jiz psal FOX, kteremu jeste jednou dekuji za analyzu.
Poslal jsme reklamaci s odkazem na tuto diskuzi jak svemu primemu ISP tak primo sloane.cz, tak uvidime, jak se k tomu postavi. Doufam, ze se alespon ozvou. Zatim to resim jinym NS.

**admix** · 10.03.2008, 12:20

Dej sem pak vedet, jak to dopadlo, docela by me to zajimalo

**georgejares** · 10.03.2008, 19:46

Odpoledne mi muj ISP tynecy.net poslal mailem, ze je to presmerovani zruseny.
Ovsem stale to blbne jako predtim.
Myslim, ze FOXova analyza je spravna a ted jen musim svyho ISP dokopat k tomu, aby to predelal.
Urcite napisu, jak to dopadlo.

Téma: Bind & FORMERR resolving domain

Nástroje témat

Zobrazení

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Re: Bind & FORMERR resolving domain

Informace o tématu

Users Browsing this Thread

Podobná témata

GeForce 7800GTX - Recenze atd.

domain libraries od Intelu (IPL apod.)

benchmark v doomIII

Pravidla přispívání