External resolution timeouts

[Kevin Darcy]

Jason L. Cook wrote:

>Hey everybody!
>
>I'm having weird timeout issues when resolving names for which my local
>nameserver is not authoritative. If I try to resolve an external name using dig
>or nslookup, my query will almost always fail the first time. However, it will
>succeed either on the first or second successive try.
>
>Debugging output on tracelevel 3 shows lots of:
>
>resquery 0x810fb90 (fctx 0x80fb378): send
>resquery 0x810fb90 (fctx 0x80fb378): sent
>resquery 0x810fb90 (fctx 0x80fb378): senddone
>fctx 0x80f0e90: timeout
>fctx 0x80f0e90: try
>fctx 0x80f0e90: query
>resquery 0x810fe08 (fctx 0x80f0e90): send
>resquery 0x810fe08 (fctx 0x80f0e90): sent
>resquery 0x810fe08 (fctx 0x80f0e90): senddone
>fctx 0x80eb8d8: timeout
>fctx 0x80eb8d8: try
>fctx 0x80eb8d8: query
>resquery 0x8110080 (fctx 0x80eb8d8): send
>fctx 0x80eb8d8: too many timeouts, disabling EDNS0
>resquery 0x8110080 (fctx 0x80eb8d8): sent
>fctx 0x80edb70: timeout
>
>I'm running BIND 9.2.2rc1 on Linux 2.4.20. Any ideas, hints, or nudges in the
>right direction would be appreciated. Thanks!
>
Based on circumstantial evidence, it seems like your Internet connection 
might have an unacceptably high latency. The nameserver might be getting 
only part of the way down the referral chain before your client times 
out the query completely. This would explain why it works on the second 
or third try; since the referral information is then cached from the 
previous query attempts. What happens if you set your lookup tool 
(preferrably dig) to a very high timeout value? Does the query still 
resolve, but just very slowly?

I suppose a lossy connection might have similar symptoms.

A sniffer trace with packet timings might be more useful than BIND tracing.

                                                                         
                                                            - Kevin