On 2026-09-16 11:43:35 +0200, Marco Moock wrote:
> Am 16.09.26 um 05:00 schrieb Vincent Lefevre:
> > I just know that misconfigured devices are found on the network.
>
> They need to be removed, as they disturb any other device.
> They can also be used for MITM attacks.
> You definitely do not want such machines in your productive network.
This is a network where everyone can plug their own machine.
Even though it is not allowed to disturb the network, this
happens, most often due to Apple crap.
> > There is a serious problem with nscd, as already said.
>
> I have doubt. If nscd caches a negative response (from the faulty DNS), it
> will not try again until the cache expired. Works as intended.
No, this is *not* a negative response, but a *temporary* failure.
FYI, without nscd, the gai_strerror error message from getaddrinfo
is "Temporary failure in name resolution".
^^^^^^^^^^^^^^^^^
This is not expected to be cached for a long time (due to nscd,
I got errors for hours, even though temporary failure actually
lasted for 1 second or so).
> > > Disabling IPv6 is a dead-end street.
> >
> > I don't see why. IPv6 is not supported on the network, so there
> > are no drawbacks in disabling it for hostname resolution. And if
> > it were supported, then there wouldn't have been any major issue
> > with nscd.
>
> You do not try to solve the real issue,
This is a workaround mainly due to a nscd bug.
> which will affect other machines too. That is your big problem.
I don't see how this could affect other machines. What do you mean?
> You currently have at least 2 problems:
> A faulty DNS resolver
The machine now uses another DNS server (no issues with it), as now
advised by the admin of the ENS-Lyon network in my ticket. I believe
that the issue remains with the other DNS servers (actually set up
for DMZ machines at ENS-Lyon), but this is no longer my problem.
> A misconfigured/hacked machine that sends bogus IPv6 router advertisements.
> Fix them first.
Since everyone can plug their own machine, this cannot be avoided
permanently.
--
Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
