Bind & FORMERR resolving domain

[Fox!MURDER]

Jak uz jsem tady asi psal - s tcpdump nemam zkusenosti a ani s analyzou tcp/ip trafficu, tak nemam tuseni, jestli se mi podarilo zachytit spravne informace spravnym zpusobem.

Pouzil jsem nasledujici prikazy:

# named -g -c /etc/bind/named.conf.minimal

# tcpdump udp port 53 > udp.dump

# tcpdump udp port 53 > udp.dump

# ping update.microsoft.com

Log z bindu, konfiguracni soubor bindu a dumpy prikladam zazipovane:

log

dik.
potreboval bych spis

tcpdump -s 65000 -w formerr.dump port 53

[NeMeM9aA]

Ve vasem pripade bych zacal v named.conf

query-source port 53;
query-source-v6 port 53;

at se to pta jen na portu 53. I kdyz to jste predpokladam zkousel.
Z TCP a UDP lou to vypada, ze si server povidaji, ale tezko rici jak.

George

Vyzkousel jsem, ale v tomhle evidentne problem neni :/

dik.
potreboval bych spis

tcpdump -s 65000 -w formerr.dump port 53

Tu je to lepe dle navodu (taky me to mohlo dojit na poprve.....).

[Fox!MURDER]

jak na to tak koukam, nemate nahodou stejnyho ISP, stejnej firewall v ceste, nebo nejakou jinou podobnou vychytavku?
totiz divna vec je, ze vam obema na ty dotazy odpovidaj primo root servery ... to normalne nedelaj - hadam, ze nekdo chyta veskerej provoz na 53/UDP a smeruje ho na nejakej vlastni stroj ...

[NeMeM9aA]

Ja jsem pripojeny pres http://www.tlapnet.cz/ - nevim presne pres koho jsou pripojeni oni. Tracepath jako prvni zajimavou adresu hodi fe0-1-s154.c1.pop1.pot.sloane.cz .

[Fox!MURDER]

erm. vyzkousej prosim tohle v nslookupu ...

server 192.5.5.241

update.microsoft.com

set q=txt
set class=chaos

version.bind

[NeMeM9aA]

Default server: 192.5.5.241
Address: 192.5.5.241#53
> update.microsoft.com
Server:         192.5.5.241
Address:        192.5.5.241#53

Non-authoritative answer:
update.microsoft.com    canonical name = update.microsoft.com.nsatc.net.
update.microsoft.com.nsatc.net  canonical name = www.update.microsoft.com.
www.update.microsoft.com        canonical name = www.update.microsoft.com.nsatc.net.
Name:   www.update.microsoft.com.nsatc.net
Address: 65.55.184.125
> set q=txt
> set class=chaos
> version.bind
Server:         192.5.5.241
Address:        192.5.5.241#53

** server can't find version.bind: NOTIMP

na lokale nefunguje:

nslookup
> server 192.168.1.50
Default server: 192.168.1.50
Address: 192.168.1.50#53
> update.microsoft.com
Server:         192.168.1.50
Address:        192.168.1.50#53

** server can't find update.microsoft.com: SERVFAIL
>

[Fox!MURDER]

Default server: 192.5.5.241
Address: 192.5.5.241#53
> update.microsoft.com
Server:         192.5.5.241
Address:        192.5.5.241#53

Non-authoritative answer:
update.microsoft.com    canonical name = update.microsoft.com.nsatc.net.
update.microsoft.com.nsatc.net  canonical name = www.update.microsoft.com.
www.update.microsoft.com        canonical name = www.update.microsoft.com.nsatc.net.
Name:   www.update.microsoft.com.nsatc.net
Address: 65.55.184.125
> set q=txt
> set class=chaos
> version.bind
Server:         192.5.5.241
Address:        192.5.5.241#53

** server can't find version.bind: NOTIMP

na lokale nefunguje:

nslookup
> server 192.168.1.50
Default server: 192.168.1.50
Address: 192.168.1.50#53
> update.microsoft.com
Server:         192.168.1.50
Address:        192.168.1.50#53

** server can't find update.microsoft.com: SERVFAIL
>

> server 192.5.5.241
Default server: 192.5.5.241
Address: 192.5.5.241#53
> update.microsoft.com
Server:         192.5.5.241
Address:        192.5.5.241#53

Non-authoritative answer:
*** Can't find update.microsoft.com: No answer
> set q=txt
> set class=chaoss
unknown query class: chaoss
> set class=chaos
> version.bind
Server:         192.5.5.241
Address:        192.5.5.241#53

version.bind    text = "9.3.4"

takhle to ma vypadat v realu... zkus totez hodit treba jeste na nameserver 62.24.64.2