lame server resolving error is not being negative cache in BIND9?

[Kevin Darcy]

The basic problem appears to be slow and/or malfunctioning
reverse-DNS resolution of the address 65.217.0.1. Instead of complicating
things with "ping" (which is marginal at best on Slowlaris), why not just issue
reverse-DNS queries using "dig" or something like that? What's the response
code? What do the query times look like?


- Kevin

Jonathan Tse wrote:

> In that case, how should I explain the different from another ping with the
> "-n" option? This is a fresh one, why don't you try it out? note: I am using
> a solaris 2.6 box.
>
> For all the trials I did, the high latency is always be at the 2nd and 3rd
> packets. And if the reverse IP is resolvable, I don't have this problem.
> Welcome for any comment...
>
> >ping -s 65.217.0.1
> PING 65.217.0.1: 56 data bytes
> 64 bytes from 65.217.0.1: icmp_seq=0. time=319. ms
> 64 bytes from 65.217.0.1: icmp_seq=1. time=1898. ms
> 64 bytes from 65.217.0.1: icmp_seq=2. time=898. ms
> 64 bytes from 65.217.0.1: icmp_seq=3. time=325. ms
> 64 bytes from 65.217.0.1: icmp_seq=4. time=323. ms
>
> >ping -n -s 65.217.0.1
> PING 65.217.0.1 (65.217.0.1): 56 data bytes
> 64 bytes from 65.217.0.1: icmp_seq=0. time=331. ms
> 64 bytes from 65.217.0.1: icmp_seq=1. time=366. ms
> 64 bytes from 65.217.0.1: icmp_seq=2. time=296. ms
> 64 bytes from 65.217.0.1: icmp_seq=3. time=370. ms
>
> "Simon Waters" <Simon at wretched.demon.co.uk> wrote in message
> news:am2jl1$c2at$1 at isrv4.isc.org...
> >
> > Jonathan Tse wrote:
> > >
> > > Thanks for all the replies. Again, I want to share the difficultly that
> > > operator may face. For this case, unfortunately introduces adverse
> result
> > > and it triggered some of my customers' nerve. They complain the network
> is
> > > slow but actually because the slower answer from DNS server. Check the
> 2nd
> > > ping packet and it always be like that when every time I restart the
> ping.
> > >
> > > >ping -s 65.217.0.1
> > > PING 65.217.0.1: 56 data bytes
> > > 64 bytes from 65.217.0.1: icmp_seq=0. time=345. ms
> > > 64 bytes from 65.217.0.1: icmp_seq=1. time=1001. ms
> > > 64 bytes from 65.217.0.1: icmp_seq=2. time=338. ms
> >
> > I don't see why you think the second packet in a ping would be
> > affected by DNS look up.
> >