Unable to reverse lookup 1 PTR from a zone?

[Barry Margolin]

In article <NDBBIAMFPKPLHAHKMJEFOEGPDOAA.jkm at tbred.com>,
James K. McConnell <jkm at tbred.com> wrote:
>Hello..
>
>I have a situation where I am, from one specific host, unable to lookup
>one record from a reverse-lookup zone.  This host is running Red Hat 5.2,
>and I'm using nslookup from the 8.1.2 rpm to query a 8.2.2p5 nameserver,
>which is running on Red Hat 6.2.
>
>Specifically, I am able to lookup every record in the zone
>21.168.192.in-addr.arpa,
>with the exception of the host with the IP address of 192.168.21.2.  I've
>enabled tracing with ndc, and seen the following in the logs when I try
>to lookup 192.168.21.2:
>
>Jun  5 12:31:47 ns2 named[6442]: datagram from [198.190.167.2].18892, fd 22,
>len 43
>Jun  5 12:31:47 ns2 named[6442]: req: nlookup(2.21.168.192.in-addr.arpa) id
>23669 type=12 class=1
>Jun  5 12:31:47 ns2 named[6442]: req: found '2.21.168.192.in-addr.arpa' as
>'2.21.168.192.in-addr.arpa' (cname=0)
>Jun  5 12:31:47 ns2 named[6442]: ns_req: answer -> [198.190.167.2].18892
>fd=22 id=23669 size=173 rc=0
....
>It appears to me that I have one of two problems.  First, the 8.1.2
>resolver may have a bug, and I should upgrade it to 8.2.2p5.  I plan to
>do this, but I'd prefer to track down this problem first.  Second, it
>may be possible that the response never makes it back to the host
>that is requesting information.  I've strace'd the nslookup, and it
>simply tells me I'm getting a timeout.  When I dumpdb on the server,
>I can clearly see this record is loaded, and I receive a response for
>this record from every other host I've tried.

And the log messages show the server is sending the response.

>What can I do to track down this problem?  Why should this affect only
>one record?  Any assistance is appreciated.  I can provide any information
>that may be necessary to track down this problem.

Have you used tcpdump on the client to see whether the response packet is
being received.

It could be a network hardware problem, being tickled by the particular
pattern of bytes in this response.

-- 
Barry Margolin, barmar at genuity.net
Genuity, Burlington, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.