bind with qname min. fails to continue recursing on one specific query
Greg Choules
gregchoules+bindusers at googlemail.com
Mon Mar 27 21:58:46 UTC 2023
Hi Jason.
I just tried this on my server (9.18.11) and it does indeed appear to be
qname minimisation. The following servers (NS for tn.gov) just don't
respond to the query "_.edison.tn.gov":
dns4.tn.gov: type A, class IN, addr 170.141.167.222
dns5.tn.gov: type A, class IN, addr 170.141.168.22
QM can't be disabled per destination server, only globally.
I would recommend you contact the NS administrators and inform them they
have a problem. According to the SOA the RNAME is
named-mgr at wannms.state.tn.us
Cheers, Greg
On Mon, 27 Mar 2023 at 18:54, <jmurray at pdknox.org> wrote:
> Hi,
>
> Recursive queries to a pair of matching bind 9.16 servers on openbsd 7.0
> are timing out unexpectedly for only two names: "www.edison.tn.gov" and "
> www.tn.gov". Both bind instances are otherwise working fine, and have
> been for some time.
>
> The query returns a CNAME, and there's a delegation to another set of
> nameservers on tn.gov, but as you can see below in the pcap and the
> named.run excerpt, bind never seems to follow up.
>
> If I disable qname minimization this is no longer an issue, but I'd rather
> not, and I don't understand the behavior at all.
>
> Queries for either tn.gov subdomain from other hosts on other networks to
> which I have access (all using Unbound for recursion unfortunately) are
> working as expected. And I'm seeing no other unexplained failures. I keep
> thinking I should be able to find some other domain which will trigger this
> behavior, but haven't yet.
>
> According to users this has been going on since last Wednesday or late
> last Friday. The domains were resolving week before last based on my own
> experience, but I don't have logs from more than a few days ago, so I can't
> demonstrate that conclusively.
>
> There's some relevant text from named.run below, also a bit of a packet
> capture, and I'm happy to supply whatever else may be helpful. Trimmed
> named.conf just a bit, marked where I've done so. All material is from
> before I thought to turn off qname minimisation.
>
> I'm totally lost, any thoughts or suggestions are very very welcome.
>
> Thanks,
>
> Jason
>
>
> ### named.conf:
>
> acl internals {
> 127.0.0.0/8;
> 10.0.0.0/8;
> 172.16.28.0/24;
> 128.25.10.0/24;
> 172.16.20.16/28;
> };
>
> acl nameservers {
> 172.16.20.23/32;
> 172.16.20.22/32;
> 172.16.20.30/32;
> };
>
> logging {
> channel rpz.log {
> file "/var/log/rpz.log" versions 3 size 5m;
> severity info;
> print-time yes;
> print-severity yes;
> print-category yes;
> };
> channel updates.log {
> file "/var/log/ddns.log" versions 3 size 5m;
> severity info;
> print-time yes;
> print-severity yes;
> print-category yes;
> };
> channel query.log {
> file "/var/log/query.log" versions 1 size 5m;
> severity debug 3;
> print-time yes;
> print-severity yes;
> print-category yes;
> };
> category queries { query.log; };
> category update { updates.log; };
> category rpz { rpz.log; };
> category lame-servers { null; };
> category edns-disabled { null; };
> };
>
> options {
> directory "/tmp";
> listen-on { 172.16.20.22; 172.16.20.30; };
> check-names master warn ;
> allow-transfer { nameservers; };
> also-notify { 172.16.20.30; 172.16.20.23; };
> allow-query { any; };
> allow-recursion { internals; };
> recursion 1;
> dnssec-validation no;
> #dnssec-validation auto;
> #response-policy { zone rpz.local; };
> #response-policy { zone rpz.local; } break-dnssec yes;
> };
>
> key "example.org" {
> # trimmed
> };
>
> key "rndc-key" {
> # trimmed
> };
>
> key "external" {
> # trimmed
> };
>
> controls {
> inet 127.0.0.1 port 953
> allow { 127.0.0.1; } keys { "rndc-key"; };
> };
>
> view "internal" {
> match-clients { !key external; internals; };
> allow-recursion { internals; };
> allow-query { any; };
> recursion yes;
> zone "." {
> type hint;
> file "/etc/named.ca";
> };
> #zone "rpz.local" {
> # type master;
> # file "/master/rpz.local.hosts";
> # allow-query { localhost; };
> # allow-transfer { nameservers; };
> # notify yes;
> #};
> zone "example.org" {
> type master;
> file "/master/example.org.internal.hosts";
> allow-update { key "example.org"; };
> allow-transfer { nameservers; };
> notify yes;
> };
> #trimmed spare zones
> };
>
> view "external" {
> match-clients { key external; any; };
> server 172.16.20.23 {
> keys external;
> provide-ixfr yes;
> };
> allow-transfer { nameservers; };
> allow-query { any; };
> allow-recursion { none; };
> recursion no;
> zone "." {
> type hint;
> file "/etc/named.ca";
> };
> zone "example.org" {
> type master;
> file "/master/example.org.external.hosts";
> allow-transfer { nameservers; };
> notify yes;
> };
> #trimmed spare zones
> };
>
>
> ### trace:
>
> ; <<>> dig 9.10.8-P1 <<>> +trace www.tn.gov
> ;; global options: +cmd
> . 518400 IN NS a.root-servers.net.
> . 518400 IN NS b.root-servers.net.
> . 518400 IN NS c.root-servers.net.
> . 518400 IN NS d.root-servers.net.
> . 518400 IN NS e.root-servers.net.
> . 518400 IN NS f.root-servers.net.
> . 518400 IN NS g.root-servers.net.
> . 518400 IN NS h.root-servers.net.
> . 518400 IN NS i.root-servers.net.
> . 518400 IN NS j.root-servers.net.
> . 518400 IN NS k.root-servers.net.
> . 518400 IN NS l.root-servers.net.
> . 518400 IN NS m.root-servers.net.
> . 518400 IN RRSIG NS 8 0 518400
> 20230409050000 20230327040000 951 .
> t+KnpQ8krckGR1TKbbnXS0SpqIrkwc6BaloU5aYOAPTLKHIKUqIEF9Iy
> QmO6dRmqnc83gemskilawqXVZhVj7gxESBCUjagPGBiNIk4gviuUQRVN
> G+/RhghXu9hj/CXUNEBZOjPK4pqzSu6c16ke5Vqq08HNQ/BGLmKvqaeT
> Qbr4X90/Q4CUw96KsikR4CLnTE7cH4uVDMSiKCq0tffU0mpoNW9b7Tmu
> impzaelhnrQf8LFuoXjjZZYqh1wLvrA1idHIcNxGThlTjXEP0do//jx2
> Lu+b6qg0DXhvKq9V13j/buoykYIUqQfwptaRE47A0tuYkxJ2vIdDcPBw WrwP7Q==
> ;; Received 1097 bytes from 198.41.0.4#53(198.41.0.4) in 31 ms
>
> gov. 172800 IN NS a.gov-servers.net.
> gov. 172800 IN NS b.gov-servers.net.
> gov. 172800 IN NS c.gov-servers.net.
> gov. 172800 IN NS d.gov-servers.net.
> gov. 86400 IN DS 7698 8 2
> 6BC949E638442EAD0BDAF0935763C8D003760384FF15EBBD5CE86BB5 559561F0
> gov. 86400 IN RRSIG DS 8 1 86400
> 20230409050000 20230327040000 951 .
> pG2IqTXzt6d59WSPYZhix1N+8+Ho1USjAkK0TLVNDxH/BWWm5KDO1gu+
> Ncl2v4u3JAV/0rhzsHCuuEaNwE5yYpjQ4ZBwHAerM61RApO0M8Sll+yy
> s3Fv/5LtYq0Tga03CmcOYOhqq7XZY8hcsyZKzx9kBz71bWOspEQPhqBV
> 9KdqNBIhJUEB1+UvB3h+XMHHUNp+rXU9e2XoLdg+0XCWAeAuvSgF03X4
> pLfW9n87u6rdVOPum3llk30OUcdmPksSejfNV6ql51Vb6+i5gzaiRfPo
> 8xmnnzCiznRRJinOIIRICWXPtVzzYzhHOMtyOfi7y5zFnEMrLgO4WvO4 n95HMw==
> ;; Received 632 bytes from 192.36.148.17#53(i.root-servers.net) in 51 ms
>
> tn.gov. 86400 IN NS dns5.tn.gov.
> tn.gov. 86400 IN NS dns4.tn.gov.
> tn.gov. 3600 IN DS 57846 7 2
> 8090B0ABEFE816562BBEA62C42425B20508C9D686D9B61CE8A4A1D56 B29EC37C
> tn.gov. 3600 IN DS 16161 7 2
> 688FB0A9319F5C0308CAA3F28DCC81C18B91B622626B7A626D5CCB5F 610B63F4
> tn.gov. 3600 IN DS 16161 7 1
> 0C4B91101A1D20CE97068A63C7CD4E8864A4F2F1
> tn.gov. 3600 IN DS 57846 7 1
> 85561664845E11764CC868182B2D683084E74365
> tn.gov. 3600 IN RRSIG DS 8 2 3600
> 20230401044223 20230325044223 24250 gov.
> GkK/PcYR7uUkrai1Q3T4W9fulCEVDThEIzZsxrBzujmn0hcfKNB5LCTC
> SlbheJGtNxss7xGZ+cr44XWDXcL8URc2hc0pVz4zrCTsAgqpcqv0RNJC
> ZdNXFTKKtDacEnhi4l1JCOG6nWTUeofZFlD++W4TQibRLjTehnna31/V
> M0Ppx0w5z3BeICN4wnFPSng5hXce9aGSuzVnxBiw7l61IQ==
> ;; Received 472 bytes from 69.36.153.30#53(c.gov-servers.net) in 38 ms
>
> www.tn.gov. 300 IN CNAME www.extglb.tn.gov.
> www.tn.gov. 300 IN RRSIG CNAME 7 3 300
> 20230407012735 20230308002943 16643 tn.gov.
> DPr9spOSdQs/8zK2DlnGFFk0v8H+16o7g4l7yPcMns7U6txVpnclWrp8
> UvLQiPCejVFhSZ0By7sM166vs8c0ar7VBfOzt84zW7cdtkGTZEvB2Nue
> KDw2gP00MRu7914b+4xawGyzhiuU0tcABn2nElhb2dIrwpF05InxUckq SL0=
> extglb.tn.gov. 300 IN NS sdcgtm02.tn.gov.
> extglb.tn.gov. 300 IN NS ndcgtm02.tn.gov.
> extglb.tn.gov. 300 IN NS ndcgtm01.tn.gov.
> extglb.tn.gov. 300 IN NS sdcgtm01.tn.gov.
> 7VIFF5QRM0PHTVOHKKJ31SMHH09RAE81.tn.gov. 600 IN NSEC3 1 0 100
> D317AC7ABABEF654 7VP1VJA5RP6KBKTVVS2IP1FCA30S4GF4 NS
> 7VIFF5QRM0PHTVOHKKJ31SMHH09RAE81.tn.gov. 600 IN RRSIG NSEC3 7 3 600
> 20230416173711 20230317173148 16643 tn.gov.
> ZxWY7y+RLEifC89LyPAtq0TQIPFuH0mrSbSCb3K44IJfqIwM8z7BuKb/
> aM7gtPmApI2zxw2XpKaN7AK+XtBXdHJ29IRJQgQTnatIc+v8rU/hws/g
> fW8C5uQkq0XOU/YAzUGjOmtNdnzSEQZVi9CCYSsw7AqhVlUYssvAMbXE M5I=
> ;; Received 576 bytes from 170.141.168.22#53(dns5.tn.gov) in 49 ms
>
>
> ### named.run:
>
> 27-Mar-2023 09:46:41.285 client @0x5c28fe12d0 10.0.2.3#26386: UDP request
> 27-Mar-2023 09:46:41.285 client @0x5c28fe12d0 10.0.2.3#26386: view
> internal: using view 'internal'
> 27-Mar-2023 09:46:41.285 client @0x5c28fe12d0 10.0.2.3#26386: view
> internal: request is not signed
> 27-Mar-2023 09:46:41.285 client @0x5c28fe12d0 10.0.2.3#26386: view
> internal: recursion available
> 27-Mar-2023 09:46:41.285 client @0x5c28fe12d0 10.0.2.3#26386 (www.tn.gov):
> view internal: query (cache) 'www.tn.gov/A/IN' approved
> 27-Mar-2023 09:46:41.285 client @0x5c28fe12d0 10.0.2.3#26386 (www.tn.gov):
> view internal: rrl=0x0, HAVECOOKIE=0, result=DNS_R_DELEGATION,
> fname=0x5c37daf000(1), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0),
> RRL_CHECKED=0
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.285 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.349 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.349 fctx 0x5cc34ea000(www.tn.gov/A): createfind for
> 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.488 client @0x5c28fe12d0 10.0.2.3#26386 (www.tn.gov):
> view internal: rrl=0x0, HAVECOOKIE=0, result=DNS_R_CNAME,
> fname=0x5c37daf000(1), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0),
> RRL_CHECKED=0
> 27-Mar-2023 09:46:41.488 client @0x5c28fe12d0 10.0.2.3#26386 (www.tn.gov):
> view internal: rrl=0x0, HAVECOOKIE=0, result=DNS_R_DELEGATION,
> fname=0x5c37dae840(1), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0),
> RRL_CHECKED=0
> 27-Mar-2023 09:46:41.488 fctx 0x5cc34cb800(www.extglb.tn.gov/A):
> createfind for 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:41.488 fctx 0x5cc34cb800(www.extglb.tn.gov/A):
> createfind for 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386: UDP request
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386: view
> internal: using view 'internal'
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386: view
> internal: request is not signed
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386: view
> internal: recursion available
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: query (cache) 'www.tn.gov/A/IN' approved
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: rrl=0x0, HAVECOOKIE=0, result=DNS_R_CNAME,
> fname=0x5c81007840(1), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0),
> RRL_CHECKED=0
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: rrl=0x0, HAVECOOKIE=0, result=DNS_R_DELEGATION,
> fname=0x5c81008000(1), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0),
> RRL_CHECKED=0
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: request failed: duplicate query
> 27-Mar-2023 09:46:46.295 client @0x5c14ce92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: reset client
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386: UDP request
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386: view
> internal: using view 'internal'
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386: view
> internal: request is not signed
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386: view
> internal: recursion available
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: query (cache) 'www.tn.gov/A/IN' approved
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: rrl=0x0, HAVECOOKIE=0, result=DNS_R_CNAME,
> fname=0x5c9a060c60(1), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0),
> RRL_CHECKED=0
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: rrl=0x0, HAVECOOKIE=0, result=DNS_R_DELEGATION,
> fname=0x5c9a060840(1), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0),
> RRL_CHECKED=0
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: request failed: duplicate query
> 27-Mar-2023 09:46:51.305 client @0x5c14cd92d0 10.0.2.3#26386 (www.tn.gov):
> view internal: reset client
> 27-Mar-2023 09:46:51.502 fctx 0x5cc34cb800(www.extglb.tn.gov/A):
> createfind for 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:51.502 fctx 0x5cc34cb800(www.extglb.tn.gov/A):
> createfind for 10.0.2.3#26386/6215 - success
> 27-Mar-2023 09:46:51.502 client @0x5c28fe12d0 10.0.2.3#26386 (www.tn.gov):
> view internal: rrl=0x0, HAVECOOKIE=0, result=ISC_R_TIMEDOUT,
> fname=0x5c37dae840(0), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0),
> RRL_CHECKED=0
> 27-Mar-2023 09:46:51.502 client @0x5c28fe12d0 10.0.2.3#26386 (www.tn.gov):
> view internal: query failed (timed out) for www.tn.gov/IN/A at
> query.c:7365
> 27-Mar-2023 09:46:51.502 client @0x5c28fe12d0 10.0.2.3#26386 (www.tn.gov):
> view internal: reset client
>
> ### pcap from bind host:
>
> 10:01:29.932858 172.16.20.30.55396 > 170.141.167.222.53: [bad udp cksum
> e0f9! -> 1d95] 51443% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(56) (ttl 64, id 3035, len 84)
> 0000: 4500 0054 0bdb 0000 4011 752f 6005 471e E..T.... at .u/`.G.
> 0010: aa8d a7de d864 0035 0040 f9e0 c8f3 0010 .....d.5. at ......
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 000c 000a 0008 5971 94c0 ............Yq..
> 0050: 9932 9282 .2..
>
> 10:01:30.734907 172.16.20.30.54357 > 170.141.168.22.53: [bad udp cksum
> 28fa! -> 6fbf] 26020% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(72) (ttl 64, id 31451, len 100)
> 0000: 4500 0064 7adb 0000 4011 05e7 6005 471e E..dz... at ...`.G.
> 0010: aa8d a816 d455 0035 0050 fa28 65a4 0010 .....U.5.P.(e...
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 001c 000a 0018 9958 916a .............X.j
> 0050: a74b b667 0100 0000 6421 a18c e289 661d .K.g....d!....f.
> 0060: bcb1 c1fd ....
>
> 10:01:31.544914 172.16.20.30.54313 > 170.141.167.222.53: [bad udp cksum
> e0f9! -> a0ef] 29355% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(56) (ttl 64, id 50399, len 84)
> 0000: 4500 0054 c4df 0000 4011 bc2a 6005 471e E..T.... at ..*`.G.
> 0010: aa8d a7de d429 0035 0040 f9e0 72ab 0010 .....).5. at ..r...
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 000c 000a 0008 5971 94c0 ............Yq..
> 0050: 9932 9282 .2..
>
> 10:01:32.364921 172.16.20.30.53749 > 170.141.168.22.53: [bad udp cksum
> 28fa! -> 57a9] 32284% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(72) (ttl 64, id 11987, len 100)
> 0000: 4500 0064 2ed3 0000 4011 51ef 6005 471e E..d.... at .Q.`.G.
> 0010: aa8d a816 d1f5 0035 0050 fa28 7e1c 0010 .......5.P.(~...
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 001c 000a 0018 9958 916a .............X.j
> 0050: a74b b667 0100 0000 6421 a18c e289 661d .K.g....d!....f.
> 0060: bcb1 c1fd ....
>
> 10:01:33.184946 172.16.20.30.58249 > 170.141.167.222.53: [bad udp cksum
> e0f9! -> b0d8] 31291% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(56) (ttl 64, id 13338, len 84)
> 0000: 4500 0054 341a 0000 4011 4cf0 6005 471e E..T4... at .L.`.G.
> 0010: aa8d a7de e389 0035 0040 f9e0 7a3b 0010 .......5. at ..z;..
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 000c 000a 0008 5971 94c0 ............Yq..
> 0050: 9932 9282 .2..
>
> 10:01:33.994938 172.16.20.30.52629 > 170.141.168.22.53: [bad udp cksum
> 28fa! -> df64] 50932% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(72) (ttl 64, id 42050, len 100)
> 0000: 4500 0064 a442 0000 4011 dc7f 6005 471e E..d.B.. at ...`.G.
> 0010: aa8d a816 cd95 0035 0050 fa28 c6f4 0010 .......5.P.(....
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 001c 000a 0018 9958 916a .............X.j
> 0050: a74b b667 0100 0000 6421 a18c e289 661d .K.g....d!....f.
> 0060: bcb1 c1fd ....
>
> 10:01:34.804940 172.16.20.30.63268 > 170.141.167.222.53: [bad udp cksum
> e0f9! -> a7a3] 39849% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(56) (ttl 64, id 34673, len 84)
> 0000: 4500 0054 8771 0000 4011 f998 6005 471e E..T.q.. at ...`.G.
> 0010: aa8d a7de f724 0035 0040 f9e0 9ba9 0010 .....$.5. at ......
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 000c 000a 0008 5971 94c0 ............Yq..
> 0050: 9932 9282 .2..
>
> 10:01:36.424895 172.16.20.30.56217 > 170.141.168.22.53: [bad udp cksum
> 28fa! -> 8669] 46153% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(72) (ttl 64, id 945, len 100)
> 0000: 4500 0064 03b1 0000 4011 7d11 6005 471e E..d.... at .}.`.G.
> 0010: aa8d a816 db99 0035 0050 fa28 b449 0010 .......5.P.(.I..
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 001c 000a 0018 9958 916a .............X.j
> 0050: a74b b667 0100 0000 6421 a18c e289 661d .K.g....d!....f.
> 0060: bcb1 c1fd ....
>
> 10:01:38.035027 172.16.20.30.53192 > 170.141.167.222.53: [bad udp cksum
> e0f9! -> 0633] 13223% [1au] A? _.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(56) (ttl 64, id 33306, len 84)
> 0000: 4500 0054 821a 0000 4011 feef 6005 471e E..T.... at ...`.G.
> 0010: aa8d a7de cfc8 0035 0040 f9e0 33a7 0010 .......5. at ..3...
> 0020: 0001 0000 0000 0001 015f 0665 7874 676c ........._.extgl
> 0030: 6202 746e 0367 6f76 0000 0100 0100 0029 b.tn.gov.......)
> 0040: 0200 0000 8000 000c 000a 0008 5971 94c0 ............Yq..
> 0050: 9932 9282 .2..
>
> 10:01:39.945218 172.16.20.30.58268 > 170.141.167.222.53: [bad udp cksum
> e2f9! -> 7f9c] 15558% [1au] A? www.extglb.tn.gov. ar: . OPT UDPsize=512
> DO(58) (ttl 64, id 46842, len 86)
> 0000: 4500 0056 b6fa 0000 4011 ca0d 6005 471e E..V.... at ...`.G.
> 0010: aa8d a7de e39c 0035 0042 f9e2 3cc6 0010 .......5.B..<...
> 0020: 0001 0000 0000 0001 0377 7777 0665 7874 .........www.ext
> 0030: 676c 6202 746e 0367 6f76 0000 0100 0100 glb.tn.gov......
> 0040: 0029 0200 0000 8000 000c 000a 0008 5971 .)............Yq
> 0050: 94c0 9932 9282 ...2..
>
> 10:01:39.992119 170.141.167.222.53 > 172.16.20.30.58268: 15558- q: A?
> www.extglb.tn.gov. 0/6/1 ns: extglb.tn.gov. [5m] NS ndcgtm01.tn.gov.,
> extglb.tn.gov.[|domain] (DF) (ttl 43, id 35970, len 448)
> 0000: 4500 01c0 8c82 4000 2b11 c81b aa8d a7de E..... at .+.......
> 0010: 6005 471e 0035 e39c 01ac aa2f 3cc6 8010 `.G..5...../<...
> 0020: 0001 0000 0006 0001 0377 7777 0665 7874 .........www.ext
> 0030: 676c 6202 746e 0367 6f76 0000 0100 01c0 glb.tn.gov......
> 0040: 1000 0200 0100 0001 2c00 1108 6e64 6367 ........,...ndcg
> 0050: 746d 3031 0274 6e03 676f 7600 c010 0002 tm01.tn.gov.....
> 0060: 0001 0000 012c .....,
>
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
> from this list
>
> ISC funds the development of this software with paid support
> subscriptions. Contact us at https://www.isc.org/contact/ for more
> information.
>
>
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20230327/84785f15/attachment-0001.htm>
More information about the bind-users
mailing list