gcom.co.th soa error

Michael Kjorling michael at kjorling.com
Mon Sep 10 14:57:09 UTC 2001


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Well, looking it up with dig proves otherwise:

	[michael at varg michael]$ dig @a.root-servers.net th ns +norec +short
	MUNNARI.OZ.AU.
	NS.EU.NET.
	NS.THNIC.NET.
	NS-AIT.THNIC.NET.
	AUTH61.NS.UU.NET.
	[michael at varg michael]$ dig @munnari.oz.au co.th ns +norec +short
	auth61.ns.uu.net.
	munnari.oz.au.
	ns.in.th.
	ns.thnic.net.
	ns-ait.thnic.net.
	[michael at varg michael]$ dig @munnari.oz.au gcom.co.th ns +norec +short
	ns3.nicsolutions.net.
	ns2.nicsolutions.net.
	[michael at varg michael]$ dig @ns3.nicsolutions.net gcom.co.th soa +norec +short
	[michael at varg michael]$ dig @ns2.nicsolutions.net gcom.co.th soa +norec +short
	[michael at varg michael]$

Looking more closely at this, I find an interesting fact:
Nicsolutions.net are engaged in cache poisoning attempts. Take a look:

	[michael at varg michael]$ dig @ns3.nicsolutions.net gcom.co.th ns +norec

	; <<>> DiG 9.2.0rc2 <<>> @ns3.nicsolutions.net gcom.co.th ns +norec
	;; global options:  printcmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53392
	;; flags: qr aa ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

	;; QUESTION SECTION:
	;gcom.co.th.                    IN      NS

	;; AUTHORITY SECTION:
	th.                     3600    IN      SOA     ns3.nicsolutions.net. administrator. 1504 900 600 86400 3600

	;; Query time: 203 msec
	;; SERVER: 209.128.97.237#53(ns3.nicsolutions.net)
	;; WHEN: Mon Sep 10 16:51:37 2001
	;; MSG SIZE  rcvd: 97

	[michael at varg michael]$ dig @ns3.nicsolutions.net th ns +norec

	; <<>> DiG 9.2.0rc2 <<>> @ns3.nicsolutions.net th ns +norec
	;; global options:  printcmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62483
	;; flags: qr aa ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

	;; QUESTION SECTION:
	;th.                            IN      NS

	;; ANSWER SECTION:
	th.                     3600    IN      NS      ns3.nicsolutions.net.
	th.                     3600    IN      NS      ns2.nicsolutions.net.

	;; ADDITIONAL SECTION:
	ns3.nicsolutions.net.   3600    IN      A       209.128.97.237
	ns2.nicsolutions.net.   3600    IN      A       209.128.111.98

	;; Query time: 201 msec
	;; SERVER: 209.128.97.237#53(ns3.nicsolutions.net)
	;; WHEN: Mon Sep 10 16:51:47 2001
	;; MSG SIZE  rcvd: 104

	[michael at varg michael]$

ns2.nicsolutions.net responds likewise.

You should talk to them and inform them about this fact. If they don't
want to fix it, switch provider.

Why is it that people always come up with this kind of crap?


Michael Kjörling


On Sep 10 2001 06:19 -0700, Kevin wrote:

> I am getting this error when I check our dns records with 'doc':
>
> Doc-2.1.4: doc gcom.co.th
> Doc-2.1.4: Starting test of gcom.co.th.   parent is co.th.
> Doc-2.1.4: Test date - Mon Sep 10 20:16:57 ICT 2001
> SYSerr: No servers for gcom.co.th. returned SOAs ...
> Summary:
>    YIKES: doc aborted while testing gcom.co.th.  parent co.th.
>    ERRORS found for gcom.co.th. (count: 2)
>    Incomplete test for gcom.co.th. (1)
> Done testing gcom.co.th.  Mon Sep 10 20:17:05 ICT 2001
>
> My supplier tells me that there is nothing wrong, all their accounts
> are the same and noone else is complaining. Is this something that I
> should worry about, or can I get on with more important things?

- -- 
Michael Kjörling - michael at kjorling.com - PGP: 8A70E33E
Manager Wolf.COM -- Programmer -- Network Administrator
"We must be the change we wish to see" (Mahatma Gandhi)

^..^     Support the wolves in Norway -- go to     ^..^
 \/   http://home.no.net/ulvelist/protest_int.htm   \/

***** Please only send me emails which concern me *****

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For my PGP key: http://michael.kjorling.com/contact/pgp.html

iD8DBQE7nNTJKqN7/Ypw4z4RAu5kAJwJ0gkyVaYGVzNnjieUlacoKwZXFwCgxf65
SqYZ2zb+NmcwU4uepGDUuI4=
=2Owy
-----END PGP SIGNATURE-----




More information about the bind-users mailing list