There are some prombles in the query log

[Mark Andrews]

> On 25 May 2022, at 16:40, 马可 via bind-users <bind-users at lists.isc.org> wrote:
> 
> I filled confused when I read the query log,
> 
> 02-Aug-2021 14:45:49.477 queries: client @0x7f40b00104c8 192.168.100.126#38290 (235.91.251.148.origin.asn.cymru.com): query: 235.91.251.148.origin.asn.cymru.com IN A +E(0) (192.168.100.8)
> 02-Aug-2021 14:45:49.507 queries: client @0x7f40b4000cc8 192.168.100.126#39323 (235.93.70.216.origin.asn.cymru.com): query: 235.93.70.216.origin.asn.cymru.com IN A +E(0) (192.168.100.8)
> 02-Aug-2021 14:45:49.704 queries: client @0x7f40b4000cc8 192.168.100.126#55226 (236.112.24.104.origin.asn.cymru.com): query: 236.112.24.104.origin.asn.cymru.com IN A +E(0) (192.168.100.8)
> 02-Aug-2021 14:45:49.808 queries: client @0x7f40b4000cc8 192.168.100.126#40445 (236.130.13.85.origin.asn.cymru.com): query: 236.130.13.85.origin.asn.cymru.com IN A +E(0) (192.168.100.8)
> 02-Aug-2021 14:45:49.868 queries: client @0x7f40b00104c8 192.168.100.126#41471 (236.133.255.54.origin.asn.cymru.com): query: 236.133.255.54.origin.asn.cymru.com IN A +E(0) (192.168.100.8)
> 02-Aug-2021 14:45:49.915 queries: client @0x7f40b4000cc8 192.168.100.126#55357 (236.138.233.54.origin.asn.cymru.com): query: 236.138.233.54.origin.asn.cymru.com IN A +E(0) (192.168.100.8)
> As shown above, the queries come from the client whose ip is 192.168.100.126, there are several questions for me:
> 
> 	• All queries are from the same client whose ip is 192.168.100.126, but why the port which each query from is so different?

Because the application has created a new socket and that has been assigned a new port by the operating system.

> 	• I disabled the recursion of bind 9 ,but all the Recursion Desired flag was set '+', this confused me.

Recursion Desired is not the same thing as Recursion Available.  When you disable recursion you are determining if recursion is available or not.  Usually, but not always, recursive server ask queries with recursion desired off and other clients ask with recursion desired on, again not always.

> 	• The client object identifiers are not the same although all queries are from the same client.
> One more thing, I use dlz to allows zone data to be retrieved from postgresql.

The client identifier is the address of the structure managing this request.  It has no relationship to the <address,port> tuple other than to temporarily record that information while processing the request.

> -- 
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> 
> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
> 
> 
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka at isc.org