Compression / Pointers on returned queries

[Mark Andrews]

> I am trying to query a Cisco CNR, which I was told by someone is BIND based.
> I am not sure, but thought I would mention this up front.
>  
> 
> When I query name server, I get back a reply that is sometimes 583 bytes,
> and sometimes its 457 bytes.  The times its 457 bytes its using
> compression/pointers.
> 
> What I am confused about is 1) Why does it sometimes use compression (about
> 1 out of 10 times) yet most of the time does not use compression, 2) Is
> there a way to force the compression?

	Why do you care?  As long as you get the answer in a single
	packet it makes little to no difference.  Also why are you
	asking recurive queries?  If you want to test authoritative
	servers then you should be making non-recursive queries.
	The server should also be configured not to accept recursive
	queries from anywhere.

> Here it is without compression:

	[If you are going to cut-and-paste responses please ensure
	that you don't add lines.  It's hard to read when the is a
	blank line between each original line.]

> [signal at server signal]$ dig @69.42.101.232 images.tigerdirect.com
>  
> ; <<>> DiG 9.2.4 <<>> @69.42.101.232 images.tigerdirect.com
> ; (1 server found)
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49262
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 9, ADDITIONAL: 9
>  
> ;; QUESTION SECTION:
> ;images.tigerdirect.com.                IN      A
>  
> ;; ANSWER SECTION:
> images.tigerdirect.com. 600     IN      CNAME
> images.tigerdirect.com.edgesuite.net.
> images.tigerdirect.com.edgesuite.net. 16525 IN CNAME a1125.g.akamai.net.
> a1125.g.akamai.net.     19      IN      A       72.246.25.11
> a1125.g.akamai.net.     19      IN      A       72.246.25.17

	Answer from cache.  TTL != 20.

> And here it is without compression:
> 
> [signal at server signal]$ dig @69.42.101.232 images.tigerdirect.com
> 
> ; <<>> DiG 9.2.4 <<>> @69.42.101.232 images.tigerdirect.com
> ; (1 server found)
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31016
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 9, ADDITIONAL: 9
>  
> ;; QUESTION SECTION:
> ;images.tigerdirect.com.                IN      A
>  
> ;; ANSWER SECTION:
> images.tigerdirect.com. 600     IN      CNAME
> images.tigerdirect.com.edgesuite.net.
> images.tigerdirect.com.edgesuite.net. 16559 IN CNAME a1125.g.akamai.net.
> a1125.g.akamai.net.     20      IN      A       72.246.25.17
> a1125.g.akamai.net.     20      IN      A       72.246.25.11

	Answer after retrieving address for a1125.g.akamai.net.
	TTL = 20.

	Incrementally building a response to a recursive query and
	not keeping the compression table around between fetches of
	non cached records give you this sort of response.

	Mark

> Brian 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews at isc.org