5 second lookup delay

[Kevin Darcy]

Is this a BIND 8 nameserver? BIND 8 didn't have "query restart", so in
certain situations it would basically just "drop" the query and expect the
client to retry it so that it can be completed.


- Kevin

Mark Natoli wrote:

> Hi,
>
>   I recently posted regarding a 5 second timeout seen on the first
> lookup of
> a domain that I delegated to a F5 3DNS machine.  I have an output of
> tcpdump session taken on my resolver.  Would someone be kind enough to
> take
> a look and give me a reason why the resolver would stop after returning
> an A record for the 3dns server rather than continuing to find the A
> record
> for which I orginally asked?  Only after the stub asks again 5 seconds
> later
> is the correct response given.
>
> (Where the notation of x/x/x is the
>   answer records/name server records/authority records.)
>
> 12:12:30.411017 stub.mydomain.com.37783 > resolver.mydomain.com.domain:
> 10+ A? test.orb.net. (30) (DF)
> 12:12:30.412183 resolver.mydomain.com.35839 > a.root-servers.net.domain:
> 63509 A? test.orb.net. (30) (DF)
> 12:12:30.478073 a.root-servers.net.domain > resolver.mydomain.com.35839:
> 63509-0/13/13 (459)
> 12:12:30.481512 resolver.mydomain.com.35839 > g.gtld-servers.net.domain:
> 48222 A? test.orb.net. (30) (DF)
> 12:12:30.563392 g.gtld-servers.net.domain > resolver.mydomain.com.35839:
> 48222-0/3/3 (152)
> 12:12:30.564205 resolver.mydomain.com.35839 > name.phx.gblx.net.domain:
> 3531 A?test.orb.net. (30) (DF)
> 12:12:30.648070 name.phx.gblx.net.domain > resolver.mydomain.com.35839:
> 3531-0/2/0 (84)
> 12:12:30.649351 resolver.mydomain.com.35839 > b.root-servers.net.domain:
> 4332A?3dns1.mydomain.com. (38) (DF)
> 12:12:30.649742 resolver.mydomain.com.35839 > b.root-servers.net.domain:
> 15505A? 3dns2.mydomain.com. (38) (DF)
> 12:12:30.925134 b.root-servers.net.domain > resolver.mydomain.com.35839:
> 15505-0/13/13 (470) (DF)
> 12:12:30.927759 resolver.mydomain.com.35839 > d.gtld-servers.net.domain:
> 41674A? 3dns2.mydomain.com. (38) (DF)
> 12:12:30.951781 d.gtld-servers.net.domain > resolver.mydomain.com.35839:
> 41674-0/3/3 (154)
> 12:12:30.952521 resolver.mydomain.com.35839 > ns2.mydomain.com.domain:
> 24039 A?3dns2.mydomain.com. (38) (DF)
> 12:12:31.019336 ns2.mydomain.com.domain > resolver.mydomain.com.35839:
> 24039*-1/3/3 A 3dns2.mydomain.com (170) (DF)
> 12:12:34.022020 resolver.mydomain.com.35839 > i.root-servers.net.domain:
> 4332
> A?3dns1.mydomain.com. (38) (DF)
> 12:12:34.294955 i.root-servers.net.domain > resolver.mydomain.com.35839:
> 4332-0/13/13 (470)
> 12:12:34.296557 resolver.mydomain.com.35839 > ns3.mydomain.com.domain:
> 45432 A?3dns1.mydomain.com. (38) (DF)
> 12:12:34.308598 ns3.mydomain.com.domain > resolver.mydomain.com.35839:
> 45432*-1/3/3 A 3dns1.mydomain.com (170) (DF)
> -------- why did it stop here and make the stub ask again??
> 12:12:35.404856 stub.mydomain.com.37783 > resolver.mydomain.com.domain:
> 10+ A?test.orb.net. (30) (DF)
> 12:12:35.405412 resolver.mydomain.com.35839 > 3dns2.mydomain.com.domain:
> 2769A?test.orb.net. (30) (DF)
> 12:12:35.494315 3dns2.mydomain.com.domain > resolver.mydomain.com.35839:
> 2769*-1/0/0 A 206.132.8.162 (58)
> 12:12:35.494689 resolver.mydomain.com.domain > stub.mydomain.com.37783:
> 10*1/0/0 A 206.132.8.162 (58) (DF)
>
> Thanks,
> Mark Natoli