Bind & FORMERR resolving domain

[Rainbow]

Vyskusal si to aj cez nslookup alebo dig?

[NeMeM9aA]

edit: uz zacinam nachazet urcite souvislosti. Bouzel neni moc casu. Zitra dam vedet.

edit2: tenhle post byl informacne pusty, takze jsem ho vicemene zrusil. Stale ale plati, ze zitra odpoledne postnu vysledky meho boje s bindem.

[Fox!MURDER]

ja bych zkusil tcpdumpnout, co do toho leze a projit to wiresharkem, jestli neprijdes na nejakou podivnost v tech paketech ...

[georgejares]

Mam ten samy problem.
Jestli jste se jeste nezblaznil, (ja to cekam kazdou chvili), tak zde mam nekolik postrehu, co jsem nasel na internetu. Pokud jste sam prisel na zpusob opravy, dejte prosim vedet.
Takze:

Problem muze souviset s nekolika vecmi:

1) je nastaven firewall, ktery nepropousti UDP pakety na portu 53 delsi nez 512 bytu
2)jakysy EDNS0 protokol, coz je asi nejaka nova verze jazyka, kterou mezi sebou mluvi DNS servery je spatne interpretovan na starych serverech. Bind 9.x.x by to mel poznat a zacit se ptat starym protokolem. dokonce to pise i v logu, ale podle mne se proste nezepta.

Vse co jsem nasel na INETu se toci okolo techto dvou veci.
Sam jsem vyzkousel toto:
vypnout firewall - bez vysledku
pouzil jsem packet sniffer, abych videl, co prichazi za odpovedi a odpoved prisla, ovsem u serveru, ktere muj DNS nerozlustil byli opravdu delky odpovedi vetsi nez 512 bytu. Tedy, odpovedi prisly vzdy, ale v logu jsem mel stejne oblibenou hlasku "FORMERR"

Nevim, co kde nastavit. Jedna se o cersve nainstalovanou FEDORU 8, ihned jsem stahnul vsechny aktualizace a dela to toto.

Asi se zastrelim, jestli na to do rana neprijdu.

George

[NeMeM9aA]

Ah, diky za postrehy. Ja jsem to teda zatim nevyresil a to hlavne asi proto, ze jsem to neresil (nainstaloval jsem tedy wireshark, ale pri cteni man stranky jsem zacal byt nejaky unaveny .... ).

Ted jsem vymenil komplet router s firewallem, tak uvidim co to udela.

edit: tak firewall to nebyl - FORMERR stale - tentokrat wikipedia.org. Prapodivne. Snad se k tomu o vikendu dostanu.

[Fox!MURDER]

nahodte sem prosim jeden z vas (nebo oba) ten dump s dotazem i odpovedi - nejlip veskerou komunikaci na 53/TCP a 53/UDP za par minut kolem toho FORMERR... diky

[georgejares]

Zde je log (messages)

---------------------------------------------------------------------

Mar 7 09:06:08 server named[7163]:last message repeated 47 times
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.36.148.17#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 128.8.10.90#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.203.230.10#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 199.7.83.42#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 198.41.0.4#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.33.4.12#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.5.5.241#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.112.36.4#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.228.79.201#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.58.128.30#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 193.0.14.129#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 128.63.2.53#53
Mar 7 09:06:08 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 202.12.27.33#53
Mar 7 09:06:08 server named[7163]: too many timeouts resolving 'www.bckolin.cz/A' (in '.'?): disabling EDNS
Mar 7 09:06:23 server named[7163]:last message repeated 47 times
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.203.230.10#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 128.63.2.53#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.228.79.201#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 199.7.83.42#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.58.128.30#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 128.8.10.90#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 193.0.14.129#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.5.5.241#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 198.41.0.4#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.33.4.12#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.112.36.4#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 202.12.27.33#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.36.148.17#53
Mar 7 09:06:23 server named[7163]: too many timeouts resolving 'www.bckolin.cz/A' (in '.'?): disabling EDNS
Mar 7 09:06:23 server named[7163]:last message repeated 47 times
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.5.5.241#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.33.4.12#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.203.230.10#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.58.128.30#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 128.8.10.90#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 193.0.14.129#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 128.63.2.53#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 198.41.0.4#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.228.79.201#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 199.7.83.42#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.112.36.4#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 202.12.27.33#53
Mar 7 09:06:23 server named[7163]: FORMERR resolving 'www.bckolin.cz/A/IN': 192.36.148.17#53
Mar 7 09:06:23 server named[7163]: too many timeouts resolving 'www.bckolin.cz/A' (in '.'?): disabling EDNS

---------------------------------------------------------------------

Dnes jsem udelal dalsi pokus. Pripojil jsem hub na eth, ktery je pripojen do internetu. Chytal jsem to ethereal-em, odpovedi jsou v poradku. Ty odpovedi opravdu chodi.

Fyzicky na dratu to vypada takto:

---------------------------------------------------------------------

3 7.177858 88.146.251.201 00:d0:b7:0b:6f:90 193.0.14.129 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
4 7.182251 193.0.14.129 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
5 7.182720 88.146.251.201 00:d0:b7:0b:6f:90 199.7.83.42 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
6 7.188227 199.7.83.42 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
7 7.189560 88.146.251.201 00:d0:b7:0b:6f:90 192.228.79.201 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
8 7.194321 192.228.79.201 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
9 7.194749 88.146.251.201 00:d0:b7:0b:6f:90 192.112.36.4 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
10 7.199582 192.112.36.4 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
11 7.201001 88.146.251.201 00:d0:b7:0b:6f:90 198.41.0.4 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
12 7.206795 198.41.0.4 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
---------------------------------------------------------------------
Zepta se vsech znamych serveru, ktere mu normalne odpovi.
Pak se zacne ptat na root servery
---------------------------------------------------------------------

29 7.256011 88.146.251.201 00:d0:b7:0b:6f:90 128.8.10.90 00:0c:42:09:9d:0e DNS Standard query AAAA B.ROOT-SERVERS.NET
30 7.256185 88.146.251.201 00:d0:b7:0b:6f:90 128.8.10.90 00:0c:42:09:9d:0e DNS Standard query AAAA C.ROOT-SERVERS.NET
31 7.256315 88.146.251.201 00:d0:b7:0b:6f:90 128.8.10.90 00:0c:42:09:9d:0e DNS Standard query AAAA D.ROOT-SERVERS.NET
32 7.256407 88.146.251.201 00:d0:b7:0b:6f:90 128.8.10.90 00:0c:42:09:9d:0e DNS Standard query AAAA E.ROOT-SERVERS.NET
33 7.256508 88.146.251.201 00:d0:b7:0b:6f:90 128.8.10.90 00:0c:42:09:9d:0e DNS Standard query AAAA G.ROOT-SERVERS.NET
34 7.256600 88.146.251.201 00:d0:b7:0b:6f:90 128.8.10.90 00:0c:42:09:9d:0e DNS Standard query AAAA I.ROOT-SERVERS.NET
35 7.256692 88.146.251.201 00:d0:b7:0b:6f:90 128.8.10.90 00:0c:42:09:9d:0e DNS Standard query AAAA L.ROOT-SERVERS.NET

---------------------------------------------------------------------
a zase normalni dotazy a odpovedi
---------------------------------------------------------------------

36 7.262006 88.146.251.201 00:d0:b7:0b:6f:90 128.8.10.90 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
37 7.264448 128.8.10.90 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response
38 7.265820 128.8.10.90 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response
39 7.267154 128.8.10.90 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response
40 7.268134 128.8.10.90 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response
41 7.268818 128.8.10.90 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response
42 7.269872 128.8.10.90 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
43 7.270309 88.146.251.201 00:d0:b7:0b:6f:90 193.0.14.129 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
44 7.270636 128.8.10.90 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response
45 7.271371 128.8.10.90 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response
46 7.276408 193.0.14.129 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
47 7.277848 88.146.251.201 00:d0:b7:0b:6f:90 192.228.79.201 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
48 7.281927 192.228.79.201 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
49 7.283347 88.146.251.201 00:d0:b7:0b:6f:90 128.63.2.53 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
50 7.288956 128.63.2.53 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
51 7.289383 88.146.251.201 00:d0:b7:0b:6f:90 192.203.230.10 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
52 7.295873 192.203.230.10 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150
53 7.297315 88.146.251.201 00:d0:b7:0b:6f:90 198.41.0.4 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz
---------------------------------------------------------------------

Jeste podrobny vypis dotazu a odpovedi (paket 3 a 4)
Dotaz:

---------------------------------------------------------------------
No. Time Source SourceMAC Destination DestMAC Protocol Info
3 7.177858 88.146.251.201 00:d0:b7:0b:6f:90 193.0.14.129 00:0c:42:09:9d:0e DNS Standard query A www.bckolin.cz

Frame 3 (85 bytes on wire, 85 bytes captured)
Arrival Time: Mar 7, 2008 09:12:59.132034000
Time delta from previous packet: 7.176552000 seconds
Time since reference or first frame: 7.177858000 seconds
Frame Number: 3
Packet Length: 85 bytes
Capture Length: 85 bytes
Protocols in frame: eth:ip:udp:dns
Ethernet II, Src: 88.146.251.201 (00:d0:b7:0b:6f:90), Dst: 88.146.251.206 (00:0c:42:09:9d:0e)
Destination: 88.146.251.206 (00:0c:42:09:9d:0e)
Source: 88.146.251.201 (00:d0:b7:0b:6f:90)
Type: IP (0x0800)
Internet Protocol, Src: 88.146.251.201 (88.146.251.201), Dst: 193.0.14.129 (193.0.14.129)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 71
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x16c9 [correct]
Source: 88.146.251.201 (88.146.251.201)
Destination: 193.0.14.129 (193.0.14.129)
User Datagram Protocol, Src Port: domain (53), Dst Port: domain (53)
Source port: domain (53)
Destination port: domain (53)
Length: 51
Checksum: 0x82cc [correct]
Domain Name System (query)
Transaction ID: 0xf3e3
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
www.bckolin.cz: type A, class IN
Name: www.bckolin.cz
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
---------------------------------------------------------------------

Odpoved

---------------------------------------------------------------------
No. Time Source SourceMAC Destination DestMAC Protocol Info
4 7.182251 193.0.14.129 00:0c:42:09:9d:0e 88.146.251.201 00:d0:b7:0b:6f:90 DNS Standard query response CNAME c150un.forpsi.com A 81.2.194.150

Frame 4 (320 bytes on wire, 320 bytes captured)
Arrival Time: Mar 7, 2008 09:12:59.136427000
Time delta from previous packet: 0.004393000 seconds
Time since reference or first frame: 7.182251000 seconds
Frame Number: 4
Packet Length: 320 bytes
Capture Length: 320 bytes
Protocols in frame: eth:ip:udp:dns
Ethernet II, Src: 88.146.251.206 (00:0c:42:09:9d:0e), Dst: 88.146.251.201 (00:d0:b7:0b:6f:90)
Destination: 88.146.251.201 (00:d0:b7:0b:6f:90)
Source: 88.146.251.206 (00:0c:42:09:9d:0e)
Type: IP (0x0800)
Internet Protocol, Src: 193.0.14.129 (193.0.14.129), Dst: 88.146.251.201 (88.146.251.201)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 306
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 61
Protocol: UDP (0x11)
Header checksum: 0x18de [correct]
Source: 193.0.14.129 (193.0.14.129)
Destination: 88.146.251.201 (88.146.251.201)
User Datagram Protocol, Src Port: domain (53), Dst Port: domain (53)
Source port: domain (53)
Destination port: domain (53)
Length: 286
Checksum: 0xdfd4 [correct]
Domain Name System (response)
Transaction ID: 0xf3e3
Flags: 0x8180 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...1 .... .... = Recursion desired: Do query recursively
.... .... 1... .... = Recursion available: Server can do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 2
Authority RRs: 6
Additional RRs: 6
Queries
www.bckolin.cz: type A, class IN
Name: www.bckolin.cz
Type: A (Host address)
Class: IN (0x0001)
Answers
www.bckolin.cz: type CNAME, class IN, cname c150un.forpsi.com
Name: www.bckolin.cz
Type: CNAME (Canonical name for an alias)
Class: IN (0x0001)
Time to live: 6 days, 8 hours, 11 minutes, 11 seconds
Data length: 19
Primary name: c150un.forpsi.com
c150un.forpsi.com: type A, class IN, addr 81.2.194.150
Name: c150un.forpsi.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 20 minutes, 16 seconds
Data length: 4
Addr: 81.2.194.150
Authoritative nameservers
cz: type NS, class IN, ns b.ns.nic.cz
Name: cz
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day, 18 hours, 58 minutes, 31 seconds
Data length: 11
Name server: b.ns.nic.cz
cz: type NS, class IN, ns f.ns.nic.cz
Name: cz
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day, 18 hours, 58 minutes, 31 seconds
Data length: 4
Name server: f.ns.nic.cz
cz: type NS, class IN, ns a.ns.nic.cz
Name: cz
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day, 18 hours, 58 minutes, 31 seconds
Data length: 4
Name server: a.ns.nic.cz
cz: type NS, class IN, ns d.ns.nic.cz
Name: cz
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day, 18 hours, 58 minutes, 31 seconds
Data length: 4
Name server: d.ns.nic.cz
cz: type NS, class IN, ns c.ns.nic.cz
Name: cz
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day, 18 hours, 58 minutes, 31 seconds
Data length: 4
Name server: c.ns.nic.cz
cz: type NS, class IN, ns e.ns.nic.cz
Name: cz
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day, 18 hours, 58 minutes, 31 seconds
Data length: 4
Name server: e.ns.nic.cz
Additional records
b.ns.nic.cz: type A, class IN, addr 217.31.205.188
Name: b.ns.nic.cz
Type: A (Host address)
Class: IN (0x0001)
Time to live: 9 minutes, 32 seconds
Data length: 4
Addr: 217.31.205.188
f.ns.nic.cz: type A, class IN, addr 193.171.255.48
Name: f.ns.nic.cz
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day, 10 hours, 19 minutes, 17 seconds
Data length: 4
Addr: 193.171.255.48
a.ns.nic.cz: type A, class IN, addr 217.31.205.180
Name: a.ns.nic.cz
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day, 13 hours, 40 minutes, 21 seconds
Data length: 4
Addr: 217.31.205.180
d.ns.nic.cz: type A, class IN, addr 193.29.206.1
Name: d.ns.nic.cz
Type: A (Host address)
Class: IN (0x0001)
Time to live: 21 hours, 10 minutes, 25 seconds
Data length: 4
Addr: 193.29.206.1
c.ns.nic.cz: type A, class IN, addr 195.66.241.202
Name: c.ns.nic.cz
Type: A (Host address)
Class: IN (0x0001)
Time to live: 6 hours, 30 minutes, 11 seconds
Data length: 4
Addr: 195.66.241.202
e.ns.nic.cz: type A, class IN, addr 194.146.105.38
Name: e.ns.nic.cz
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day, 7 hours, 23 minutes, 41 seconds
Data length: 4
Addr: 194.146.105.38
---------------------------------------------------------------------

Zduraznuji, ze toto je odchytnute "na drate". Ovsem pomoci ettercap primo v onom serveru to vypada stejne. Jen to neumi takhle pekne rozpitvat.

---------------------------------------------------------------------

Firewall vypinam prikazem /etc/rc.d/init.d/iptables stop

Po provedeni prikazu iptables -L to vypada takto:

---------------------------------------------------------------------
[root@server log]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destinati
---------------------------------------------------------------------

Pro jistotu jeste route

---------------------------------------------------------------------
[root@server log]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
88.146.251.200 * 255.255.255.248 U 0 0 0 eth0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1
link-local * 255.255.0.0 U 0 0 0 eth1
default 88.146.251.206 0.0.0.0 UG 0 0 0 eth0
---------------------------------------------------------------------
---------------------------------------------------------------------
---------------------------------------------------------------------
SELinux mam disabled.

Takze problem je podle mne nekde uvnitr bind nebo v jadru, protoze se bud ztraceji pakety pres nejaky filtr nebo je bug v bindu. Podobny problem jsem na internetu nasel docela dostkrat, ale reseni zadne. I na oficialnich strankach binda to dost banalizovali, ze uz to resili a ze je to nesmysl, ze bind automaticky prechaze z EDNS0 na normalni a pod.

Zduraznuji, ze to co je odchytnute, je na drate, ale i na karte v promiscuitnim modu. Nemuze to pozirat neco jiniha na portu 53? jak zjistim, ktere programy visi na portu 53?

Doufam, ze jsem Vas nezahltil prilis temy logy, ale at mi verite, ze nepisu nesmysly.

Zdar
George

[NeMeM9aA]

Jak uz jsem tady asi psal - s tcpdump nemam zkusenosti a ani s analyzou tcp/ip trafficu, tak nemam tuseni, jestli se mi podarilo zachytit spravne informace spravnym zpusobem.

Pouzil jsem nasledujici prikazy:

# named -g -c /etc/bind/named.conf.minimal

# tcpdump udp port 53 > udp.dump

# tcpdump udp port 53 > udp.dump

# ping update.microsoft.com

Log z bindu, konfiguracni soubor bindu a dumpy prikladam zazipovane:

log