TTL decrementing too fast

[alexk at tugger.net]

I was wondering if anyone has ever seen this happen.  It only happened for
a short time and has returned to normal.

The nameservers in question are a caching server running 8.1.1 and an
authoritative, non-recursive server also running 8.1.1.  

I did an SOA query on the caching server for a zone that is stored on the
authoritative server.  The default TTL for the zone was set to 300
seconds.

A dig returned this (some dig info snipped.  Phony names put in because
the nameserver no longer exhibits this behavior):

  ; <<>> DiG 8.1 <<>> @ns1-cache foo.example soa 
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
  ;; QUERY SECTION:
  ;;      foo.example, type = SOA, class = IN
  ;; ANSWER SECTION:
  foo.example.      4m30s IN SOA    ns1 hostmaster (
  ;; AUTHORITY SECTION:
  foo.example.      1d18h6m30s IN NS  ns1
  foo.example.      1d18h6m30s IN NS  NS2
  foo.example.      1d18h6m30s IN NS  NS3
  ;; ADDITIONAL SECTION:
  ns1               1d23h51m26s IN A  192.168.0.9
  NS2               1d23h51m26s IN A  192.168.0.12
  NS3               1d23h51m26s IN A  192.168.0.8

Then, 5 seconds later, I did it again, and got:

  ; <<>> DiG 8.1 <<>> @ns1 foo.example soa
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
  ;; QUERY SECTION:
  ;;      foo.example, type = SOA, class = IN
  ;; ANSWER SECTION:
  foo.example.      3m21s IN SOA    ns1 hostmaster (
  ;; AUTHORITY SECTION:
  foo.example.      1d18h6m25s IN NS  ns1
  foo.example.      1d18h6m25s IN NS  NS2
  foo.example.      1d18h6m25s IN NS  NS3
  ;; ADDITIONAL SECTION:
  ns1               1d23h51m21s IN A  192.168.0.9
  NS2               1d23h51m21s IN A  192.168.0.12
  NS3               1d23h51m21s IN A  192.168.0.8

and again 5 seconds later

  ; <<>> DiG 8.1 <<>> @ns1 foo.example soa
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
  ;; QUERY SECTION:
  ;;      foo.example, type = SOA, class = IN
  ;; ANSWER SECTION:
  foo.example.      1m18s IN SOA    ns1 hostmaster (
  ;; AUTHORITY SECTION:
  foo.example.      1d18h6m20s IN NS  ns1
  foo.example.      1d18h6m20s IN NS  NS2
  foo.example.      1d18h6m20s IN NS  NS3
  ;; ADDITIONAL SECTION:
  ns1               1d23h51m16s IN A  192.168.0.9
  NS2               1d23h51m16s IN A  192.168.0.12
  NS3               1d23h51m16s IN A  192.168.0.8

As can be seen, the TTL in the Answer section was decreasing dramatically
over the period of 15 seconds (the final dig it should have been at 4m20s)

This happened for about a good ten minutes, and then went away.

Anybody ever see anything like that before?

--
Alex Kamantauskas
alexk at tugger.net