Bind & FORMERR resolving domain

[NeMeM9aA]

Default server: 192.5.5.241
Address: 192.5.5.241#53
> update.microsoft.com
Server:         192.5.5.241
Address:        192.5.5.241#53

Non-authoritative answer:
update.microsoft.com    canonical name = update.microsoft.com.nsatc.net.
update.microsoft.com.nsatc.net  canonical name = www.update.microsoft.com.
www.update.microsoft.com        canonical name = www.update.microsoft.com.nsatc.net.
Name:   www.update.microsoft.com.nsatc.net
Address: 65.55.184.125
> set q=txt
> set class=chaos
> version.bind
Server:         192.5.5.241
Address:        192.5.5.241#53

** server can't find version.bind: NOTIMP

na lokale nefunguje:

nslookup
> server 192.168.1.50
Default server: 192.168.1.50
Address: 192.168.1.50#53
> update.microsoft.com
Server:         192.168.1.50
Address:        192.168.1.50#53

** server can't find update.microsoft.com: SERVFAIL
>

[Fox!MURDER]

Default server: 192.5.5.241
Address: 192.5.5.241#53
> update.microsoft.com
Server:         192.5.5.241
Address:        192.5.5.241#53

Non-authoritative answer:
update.microsoft.com    canonical name = update.microsoft.com.nsatc.net.
update.microsoft.com.nsatc.net  canonical name = www.update.microsoft.com.
www.update.microsoft.com        canonical name = www.update.microsoft.com.nsatc.net.
Name:   www.update.microsoft.com.nsatc.net
Address: 65.55.184.125
> set q=txt
> set class=chaos
> version.bind
Server:         192.5.5.241
Address:        192.5.5.241#53

** server can't find version.bind: NOTIMP

na lokale nefunguje:

nslookup
> server 192.168.1.50
Default server: 192.168.1.50
Address: 192.168.1.50#53
> update.microsoft.com
Server:         192.168.1.50
Address:        192.168.1.50#53

** server can't find update.microsoft.com: SERVFAIL
>

> server 192.5.5.241
Default server: 192.5.5.241
Address: 192.5.5.241#53
> update.microsoft.com
Server:         192.5.5.241
Address:        192.5.5.241#53

Non-authoritative answer:
*** Can't find update.microsoft.com: No answer
> set q=txt
> set class=chaoss
unknown query class: chaoss
> set class=chaos
> version.bind
Server:         192.5.5.241
Address:        192.5.5.241#53

version.bind    text = "9.3.4"

takhle to ma vypadat v realu... zkus totez hodit treba jeste na nameserver 62.24.64.2

[Rainbow]

U mna to hodilo:

version.bind    text = "9.3.2-P1"

Mozno je to cluster alebo co.

Ale kazdopadne to ten microsoft resolvovat nema.

[Fox!MURDER]

U mna to hodilo:

version.bind    text = "9.3.2-P1"

Mozno je to cluster alebo co.

Ale kazdopadne to ten microsoft resolvovat nema.

a 62.24.64.2 ma vracet version "Apache" a zadnej cluster tam urcite neni ... takze hadam, ze mu vazne nekdo leze do DNS trafficu ...

[NeMeM9aA]

# nslookup
> server 62.24.64.2
Default server: 62.24.64.2
Address: 62.24.64.2#53
> update.microsoft.com
Server:         62.24.64.2
Address:        62.24.64.2#53

Non-authoritative answer:
update.microsoft.com    canonical name = update.microsoft.com.nsatc.net.
update.microsoft.com.nsatc.net  canonical name = www.update.microsoft.com.
www.update.microsoft.com        canonical name = www.update.microsoft.com.nsatc.net.
Name:   www.update.microsoft.com.nsatc.net
Address: 65.55.184.157
> set q=txt
> set class=chaos
> version.bind
Server:         62.24.64.2
Address:        62.24.64.2#53

** server can't find version.bind: NOTIMP
>

tak netusim co je spatne.

[georgejares]

Tak doufam, ze to nezerou ty zas.... sloane.cz

Ja taky nekde cestou lezu pres ne.

Konkretne:geo0-1-s144.c1.pop1.pra.sloane.cz

Jinak jsem nainstaloval bind 8.4.7 (posledni osmicku) a vse funguje spravne, vse se resolvuje. Bohuzel ale o nem pisou, ze ma dost bezpecnostnich der.

Ted mi dochazi, ze to zrat nemuzou, ponevadz to ke mne prijde.
Ta odpoved proste prijde fyzicky az k mymu serveru. Viz data z etherealu, co jsem posilal.
Podle mne ty servery odpovidaj v nejakem divnem formatu.
Z tech logu je videt, ze bind disabling EDNS0, ale ve skutecnosti se stale pta v EDNS0.

George

[Fox!MURDER]

Tak doufam, ze to nezerou ty zas.... sloane.cz

Ja taky nekde cestou lezu pres ne.

Konkretne:geo0-1-s144.c1.pop1.pra.sloane.cz

Jinak jsem nainstaloval bind 8.4.7 (posledni osmicku) a vse funguje spravne, vse se resolvuje. Bohuzel ale o nem pisou, ze ma dost bezpecnostnich der.

Ted mi dochazi, ze to zrat nemuzou, ponevadz to ke mne prijde.
Ta odpoved proste prijde fyzicky az k mymu serveru. Viz data z etherealu, co jsem posilal.
Podle mne ty servery odpovidaj v nejakem divnem formatu.
Z tech logu je videt, ze bind disabling EDNS0, ale ve skutecnosti se stale pta v EDNS0.

George

oni to nezerou, oni odpovidaji za ty nameservery ...
192.5.5.241 ti proste nema odpovedet nic jinyho, nez TLD servery ... a ono to vraci rovnou resolvnute A a CNAME. Zaroven to vraci spatne odpovedi z 62.24.64.2, kde jsem si 100%ne jist, ze neni zadna zakernost ....

[NeMeM9aA]

oni to nezerou, oni odpovidaji za ty nameservery ...
192.5.5.241 ti proste nema odpovedet nic jinyho, nez TLD servery ... a ono to vraci rovnou resolvnute A a CNAME. Zaroven to vraci spatne odpovedi z 62.24.64.2, kde jsem si 100%ne jist, ze neni zadna zakernost ....

Eh, tak tohle jsem opravdu necekal a neprisel bych na to. Zkusim bind v 8 verzi, protoze to mam na bezpecne malinke LAN, kde bezpecnostni diry nejsou tak velky problem.

[Rainbow]

Pravdepodobne niekto niekde presmeruva vsetok traffic na porte 53. Treba to riesit s providerom.

[Fox!MURDER]

Eh, tak tohle jsem opravdu necekal a neprisel bych na to. Zkusim bind v 8 verzi, protoze to mam na bezpecne malinke LAN, kde bezpecnostni diry nejsou tak velky problem.

vyzkousej schvalne

traceroute -p 53 192.5.5.241
traceroute -p 53 62.24.64.2

treba se prozradi ten zloduch ...

jinak v8 je taky reseni a na v9 by jednak melo jit globalne vypnout edns (je na to k dispozici patch) a druhak vypnout formerr (pokusi se z odpovedi vypacit co nejvic dat, i kdyz je ve spatnym formatu) ... muzes zkusit jeste toto ...

[georgejares]

tak co si o tom myslite...


[root@server ~]# traceroute -p 53 192.5.5.241
traceroute to 192.5.5.241 (192.5.5.241), 30 hops max, 40 byte packets
1 f.root-servers.net (192.5.5.241) 5.243 ms 88.146.251.206 (88.146.251.206)
6.464 ms 10.572 ms
2 10.11.0.97 (10.11.0.97) 12.316 ms 12.873 ms 17.618 ms
3 10.11.0.13 (10.11.0.13) 17.598 ms 19.452 ms 20.429 ms
4 10.11.0.94 (10.11.0.94) 20.409 ms 22.386 ms 22.366 ms
5 ge0-1-s144.c1.pop1.pra.sloane.cz (88.146.176.33) 24.281 ms 24.264 ms 26.5
43 ms
6 v102.tr2.pop1.pra.sloane.cz (62.240.161.197) 26.523 ms 9.341 ms 15.677 ms
7 f-root1-nix.nic.cz (194.50.100.181) 17.707 ms 17.932 ms 20.431 ms
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
[root@server ~]# traceroute 192.5.5.241
traceroute to 192.5.5.241 (192.5.5.241), 30 hops max, 40 byte packets
1 88.146.251.206 (88.146.251.206) 5.129 ms 8.318 ms 8.318 ms
2 10.11.0.97 (10.11.0.97) 12.666 ms 14.656 ms 16.442 ms
3 10.11.0.13 (10.11.0.13) 18.213 ms 21.584 ms 21.729 ms
4 10.11.0.94 (10.11.0.94) 23.163 ms 23.119 ms 25.029 ms
5 ge0-1-s144.c1.pop1.pra.sloane.cz (88.146.176.33) 25.007 ms 26.194 ms 28.030 ms
6 v102.tr2.pop1.pra.sloane.cz (62.240.161.197) 26.126 ms 23.174 ms 20.695 ms
7 f-root1-nix.nic.cz (194.50.100.181) 22.532 ms 5.858 ms 14.436 ms
8 f.root-servers.net (192.5.5.241) 16.818 ms 16.803 ms 18.518 ms





George