date:20131105

Re: Message parser reports malformed message packet

2013-11-05 Thread Matus UHLAR - fantomas


On 04.11.13 16:49, Fábio Gomes wrote:

  I'm having issues trying to resolve www.sondait.tasker.com.br. The result 
from dig +trace is as follows:


[...]

tasker.com.br.  86400   IN  NS  ns1.locaweb.com.br.
tasker.com.br.  86400   IN  NS  ns2.locaweb.com.br.
tasker.com.br.  86400   IN  NS  ns3.locaweb.com.br.
;; Received 153 bytes from 200.160.0.10#53(200.160.0.10) in 34 ms

;; Warning: Message parser reports malformed message packet.
;; Truncated, retrying in TCP mode.
;; Connection to 201.76.40.2#53(201.76.40.2) for www.sondait.tasker.com.br 
failed: connection refused.
;; Connection to 187.45.246.2#53(187.45.246.2) for www.sondait.tasker.com.br 
failed: connection refused.
;; Connection to 189.126.108.2#53(189.126.108.2) for www.sondait.tasker.com.br 
failed: connection refused.


funny response:

www.sondait.tasker.com.br. 3600 IN  CNAME   
trial-1910070769.sa-east-1.elb.amazonaws.com.
.   518400  IN  NS  a.root-servers.net.
.   518400  IN  NS  b.root-servers.net.
.   518400  IN  NS  c.root-servers.net.
.   518400  IN  NS  d.root-servers.net.
.   518400  IN  NS  e.root-servers.net.
.   518400  IN  NS  f.root-servers.net.
.   518400  IN  NS  g.root-servers.net.
.   518400  IN  NS  h.root-servers.net.
.   518400  IN  NS  i.root-servers.net.
.   518400  IN  NS  j.root-servers.net.
.   518400  IN  NS  k.root-servers.net.
.   518400  IN  NS  l.root-servers.net.
.   518400  IN  NS  m.root-servers.net.
;; Received 520 bytes from 201.76.40.2#53(201.76.40.2) in 235 ms

I would expect root NS referrals to be in additional section, therefore not
causing truncation.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux - It's now safe to turn on your computer.
Linux - Teraz mozete pocitac bez obav zapnut.
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

RE: Message parser reports malformed message packet

2013-11-05 Thread Fábio Gomes

Thank you, Mark.

I'm gonna try to contact the domain owners as well, but I noticed my enterprise 
DNS can get a correct answer for that domain. Is there any way I can force 
different response from localweb servers until I got this permanently fixed? 
Like force UDP packet sizes or disable EDNS for that domain? Could you also, 
please, share the tcpdump line you used to get that package details?

Regards


 To: flg...@hotmail.com
 CC: bind-us...@isc.org
 CC: postmas...@locaweb.com.br
 From: ma...@isc.org
 Subject: Re: Message parser reports malformed message packet
 Date: Tue, 5 Nov 2013 08:09:05 +1100


 Their nameservers are broken. They are generating malformed
 responses. They are sending partial records when the answer does
 not fit. Note this ends halfway through a A record. Only the owner
 name, class, type and the first two octets of the ttl are present
 from the last RR.

 Any records / rrsets added to a DNS QUERY response should be
 *complete*.

 I have CC'd postmas...@locaweb.com.br but you may want to try other
 channels to inform them that they have broken nameservers.

 Mark

 0x: 4500 021c  4000 2c11 db95 c94c 2802 E.@.,L(.
 0x0010: c0a8 bf44 0035 ddf6 0208 7e6c 5f9a 8600 ...D.5~l_...
 0x0020: 0001 0001 000d 000d 0377  0773 6f6e .www.son
 0x0030: 6461 6974 0674 6173 6b65 7203 636f 6d02 dait.tasker.com.
 0x0040: 6272  0100 01c0 0c00 0500 0100 000e br..
 0x0050: 1000 2e10 7472 6961 6c2d 3139 3130 3037 trial-191007
 0x0060: 3037 3639 0973 612d 6561 7374 2d31 0365 0769.sa-east-1.e
 0x0070: 6c62 0961 6d61 7a6f 6e61 7773 0363 6f6d lb.amazonaws.com
 0x0080:  0002 0001 0007 e900 0014 0161 0c72 .a.r
 0x0090: 6f6f 742d 7365 7276 6572 7303 6e65 7400 oot-servers.net.
 0x00a0:  0200 0100 07e9  0401 62c0 7200 b.r.
 0x00b0: 0002 0001 0007 e900 0004 0163 c072  ...c.r..
 0x00c0: 0200 0100 07e9  0401 64c0 7200 0002 ..d.r...
 0x00d0: 0001 0007 e900 0004 0165 c072  0200 .e.r
 0x00e0: 0100 07e9  0401 66c0 7200 0002 0001 f.r.
 0x00f0: 0007 e900 0004 0167 c072  0200 0100 ...g.r..
 0x0100: 07e9  0401 68c0 7200 0002 0001 0007 ..h.r...
 0x0110: e900 0004 0169 c072  0200 0100 07e9 .i.r
 0x0120:  0401 6ac0 7200 0002 0001 0007 e900 j.r.
 0x0130: 0004 016b c072  0200 0100 07e9  ...k.r..
 0x0140: 0401 6cc0 7200 0002 0001 0007 e900 0004 ..l.r...
 0x0150: 016d c072 c070 0001 0001 0036 ee80 0004 .m.r.p.6
 0x0160: c629 0004 c08f 0001 0001 0036 ee80 0004 .).6
 0x0170: c0e4 4fc9 c09e 0001 0001 0036 ee80 0004 ..O6
 0x0180: c021 040c c0ad 0001 0001 0036 ee80 0004 .!.6
 0x0190: 8008 0a5a c0bc 0001 0001 0036 ee80 0004 ...Z...6
 0x01a0: c0cb e60a c0cb 0001 0001 0036 ee80 0004 ...6
 0x01b0: c005 05f1 c0da 0001 0001 0036 ee80 0004 ...6
 0x01c0: c070 2404 c0e9 0001 0001 0036 ee80 0004 .p$6
 0x01d0: 803f 0235 c0f8 0001 0001 0036 ee80 0004 .?.5...6
 0x01e0: c024 9411 c107 0001 0001 0036 ee80 0004 .$.6
 0x01f0: c03a 801e c116 0001 0001 0036 ee80 0004 .:.6
 0x0200: c100 0e81 c125 0001 0001 0036 ee80 0004 .%.6
 0x0210: c620 400c c134 0001 0001 0036 ..@..4.6



 ;; Warning: Message parser reports malformed message packet.

 ;  DiG 9.10.0a1  www.sondait.tasker.com.br @201.76.40.2 +nodnssec 
 +noedns +ignore +besteffort +all +norec
 ;; global options: +cmd
 ;; Got answer:
 ;; -HEADER- opcode: QUERY, status: NOERROR, id: 58468
 ;; flags: qr aa tc; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 13
 ;; WARNING: Message has 6 extra bytes at end

 ;; QUESTION SECTION:
 ;www.sondait.tasker.com.br. IN A

 ;; ANSWER SECTION:
 www.sondait.tasker.com.br. 3600 IN CNAME 
 trial-1910070769.sa-east-1.elb.amazonaws.com.

 ;; AUTHORITY SECTION:
 . 518400 IN NS a.root-servers.net.
 . 518400 IN NS b.root-servers.net.
 . 518400 IN NS c.root-servers.net.
 . 518400 IN NS d.root-servers.net.
 . 518400 IN NS e.root-servers.net.
 . 518400 IN NS f.root-servers.net.
 . 518400 IN NS g.root-servers.net.
 . 518400 IN NS h.root-servers.net.
 . 518400 IN NS i.root-servers.net.
 . 518400 IN NS j.root-servers.net.
 . 518400 IN NS k.root-servers.net.
 . 518400 IN NS l.root-servers.net.
 . 518400 IN NS m.root-servers.net.

 ;; ADDITIONAL SECTION:
 a.root-servers.net. 360 IN A 198.41.0.4
 b.root-servers.net. 360 IN A 192.228.79.201
 c.root-servers.net. 360 IN A 192.33.4.12
 d.root-servers.net. 360 IN A 128.8.10.90
 e.root-servers.net. 360 IN A 192.203.230.10
 f.root-servers.net. 360 IN A 192.5.5.241
 g.root-servers.net. 360 IN A 192.112.36.4
 h.root-servers.net. 360 IN A 128.63.2.53
 i.root-servers.net. 360 IN A 192.36.148.17
 j.root-servers.net. 360 IN A 192.58.128.30
 k.root-servers.net. 360 IN A 193.0.14.129
 l.root-servers.net. 360

Re: Message parser reports malformed message packet

2013-11-05 Thread Matus UHLAR - fantomas


On 05.11.13 10:02, Fábio Gomes wrote:

I'm gonna try to contact the domain owners as well, but I noticed my
enterprise DNS can get a correct answer for that domain.  Is there any way
I can force different response from localweb servers until I got this
permanently fixed?  Like force UDP packet sizes or disable EDNS for that
domain?  Could you also, please, share the tcpdump line you used to get
that package details?


seems their nameservers are working correctly now, with or without TCP (even
with EDNS0)

--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I'm not interested in your website anymore.
If you need cookies, bake them yourself.
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Bind server crashing (lots of EAGAIN, ENOENT, ...). With strace log.

2013-11-05 Thread K L

All,

I am hoping you can help me. I had working DNS servers, now my internal
master server stopped. Restarting takes +1min. I have reinstalled it,
rebooted the machine, that did not help. Server has 3 (virtual) cores and
does not swap when the 'crash' happens.

What I mean by crash: the process is still running, but the server is not
responding to queries. Even a `/etc/init.d/named status` takes 28 - 60
seconds.

Here is a strace log from when it happens:
http://pastebin.com/raw.php?i=7i0PgALG . Example:
6500 recvmsg(518, {msg_name(16)={sa_family=AF_INET, sin_port=htons(53),
sin_addr=inet_addr(10.0.101.50)},
msg_iov(1)=[{~\223\201\200\0\1\0\1\0\5\0\6\3ns3\5cymru\3com\0\0\1\0\1\300...,
4096}], msg_controllen=32, {cmsg_len=32, cmsg_level=SOL_SOCKET,
cmsg_type=0x1d /* SCM_??? */, ...}, msg_flags=0}, 0) = 252
6500 recvmsg(518, 0x7fd4b6588900, 0) = -1 EAGAIN (Resource temporarily
unavailable)

I am not a C programmer, but from this, what I think I see is a packet is
being delivered to named, and that fails.

What could the problem be? Is this a bind problem? OS/System problem maybe?
I don't recall any (kernel) parameters since it worked.

Regards,
kl
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Message parser reports malformed message packet

2013-11-05 Thread Mark Andrews


In message blu172-w5120e3bcb8525edd586934d3...@phx.gbl, =?iso-8859-1?B?RuFiaW
8gR29tZXM=?= writes:
 Thank you, Mark.
 
 I'm gonna try to contact the domain owners as well, but I noticed my
 enterprise DNS can get a correct answer for that domain. Is there any
 way I can force different response from localweb servers until I got
 this permanently fixed?
 Like force UDP packet sizes or disable EDNS for that domain?

You actually want to use EDNS with bigger packet sizes as you need
to get the entire response including additional records into the
UDP response.

Make sure your firewall passes fragmented packets and allows UDP
responses bigger than 512 bytes.  If your firewall in blocking
fragements or UDP responses bigger than 512 bytes then named will
be forced back to 512 bytes which will the interact badly with this
nameserver.

 Could you also,
 please, share the tcpdump line you used to get that package details?

tcpdump -s 0 -X

 Regards
 
 
  To: flg...@hotmail.com
  CC: bind-us...@isc.org
  CC: postmas...@locaweb.com.br
  From: ma...@isc.org
  Subject: Re: Message parser reports malformed message packet
  Date: Tue, 5 Nov 2013 08:09:05 +1100
 
 
  Their nameservers are broken. They are generating malformed
  responses. They are sending partial records when the answer does
  not fit. Note this ends halfway through a A record. Only the owner
  name, class, type and the first two octets of the ttl are present
  from the last RR.
 
  Any records / rrsets added to a DNS QUERY response should be
  *complete*.
 
  I have CC'd postmas...@locaweb.com.br but you may want to try other
  channels to inform them that they have broken nameservers.
 
  Mark
 
  0x: 4500 021c  4000 2c11 db95 c94c 2802 E.@.,L(.
  0x0010: c0a8 bf44 0035 ddf6 0208 7e6c 5f9a 8600 ...D.5~l_...
  0x0020: 0001 0001 000d 000d 0377  0773 6f6e .www.son
  0x0030: 6461 6974 0674 6173 6b65 7203 636f 6d02 dait.tasker.com.
  0x0040: 6272  0100 01c0 0c00 0500 0100 000e br..
  0x0050: 1000 2e10 7472 6961 6c2d 3139 3130 3037 trial-191007
  0x0060: 3037 3639 0973 612d 6561 7374 2d31 0365 0769.sa-east-1.e
  0x0070: 6c62 0961 6d61 7a6f 6e61 7773 0363 6f6d lb.amazonaws.com
  0x0080:  0002 0001 0007 e900 0014 0161 0c72 .a.r
  0x0090: 6f6f 742d 7365 7276 6572 7303 6e65 7400 oot-servers.net.
  0x00a0:  0200 0100 07e9  0401 62c0 7200 b.r.
  0x00b0: 0002 0001 0007 e900 0004 0163 c072  ...c.r..
  0x00c0: 0200 0100 07e9  0401 64c0 7200 0002 ..d.r...
  0x00d0: 0001 0007 e900 0004 0165 c072  0200 .e.r
  0x00e0: 0100 07e9  0401 66c0 7200 0002 0001 f.r.
  0x00f0: 0007 e900 0004 0167 c072  0200 0100 ...g.r..
  0x0100: 07e9  0401 68c0 7200 0002 0001 0007 ..h.r...
  0x0110: e900 0004 0169 c072  0200 0100 07e9 .i.r
  0x0120:  0401 6ac0 7200 0002 0001 0007 e900 j.r.
  0x0130: 0004 016b c072  0200 0100 07e9  ...k.r..
  0x0140: 0401 6cc0 7200 0002 0001 0007 e900 0004 ..l.r...
  0x0150: 016d c072 c070 0001 0001 0036 ee80 0004 .m.r.p.6
  0x0160: c629 0004 c08f 0001 0001 0036 ee80 0004 .).6
  0x0170: c0e4 4fc9 c09e 0001 0001 0036 ee80 0004 ..O6
  0x0180: c021 040c c0ad 0001 0001 0036 ee80 0004 .!.6
  0x0190: 8008 0a5a c0bc 0001 0001 0036 ee80 0004 ...Z...6
  0x01a0: c0cb e60a c0cb 0001 0001 0036 ee80 0004 ...6
  0x01b0: c005 05f1 c0da 0001 0001 0036 ee80 0004 ...6
  0x01c0: c070 2404 c0e9 0001 0001 0036 ee80 0004 .p$6
  0x01d0: 803f 0235 c0f8 0001 0001 0036 ee80 0004 .?.5...6
  0x01e0: c024 9411 c107 0001 0001 0036 ee80 0004 .$.6
  0x01f0: c03a 801e c116 0001 0001 0036 ee80 0004 .:.6
  0x0200: c100 0e81 c125 0001 0001 0036 ee80 0004 .%.6
  0x0210: c620 400c c134 0001 0001 0036 ..@..4.6
 
 
 
  ;; Warning: Message parser reports malformed message packet.
 
  ;  DiG 9.10.0a1  www.sondait.tasker.com.br @201.76.40.2 +nodnssec +
 noedns +ignore +besteffort +all +norec
  ;; global options: +cmd
  ;; Got answer:
  ;; -HEADER- opcode: QUERY, status: NOERROR, id: 58468
  ;; flags: qr aa tc; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 13
  ;; WARNING: Message has 6 extra bytes at end
 
  ;; QUESTION SECTION:
  ;www.sondait.tasker.com.br. IN A
 
  ;; ANSWER SECTION:
  www.sondait.tasker.com.br. 3600 IN CNAME trial-1910070769.sa-east-1.elb.ama
 zonaws.com.
 
  ;; AUTHORITY SECTION:
  . 518400 IN NS a.root-servers.net.
  . 518400 IN NS b.root-servers.net.
  . 518400 IN NS c.root-servers.net.
  . 518400 IN NS d.root-servers.net.
  . 518400 IN NS e.root-servers.net.
  . 518400 IN NS f.root-servers.net.
  . 518400 IN NS g.root-servers.net.
  . 518400 IN NS h.root-servers.net.
  . 518400 IN NS i.root-servers.net.
  . 518400 IN NS j.root-servers.net.
  . 518400 IN NS k.root-servers.net.

RE: Message parser reports malformed message packet

2013-11-05 Thread Fábio Gomes

Continuing investigating the issue, I noticed the following lines:

 ;; Warning: Message parser reports malformed message packet.
 ;; Truncated, retrying in TCP mode.
 ;; Connection to 201.76.40.2#53(201.76.40.2) for
 www.sondait.tasker.com.br failed: connection refused.


Even if my firewalls are not allowing udp packages bigger than 512, the retry 
to port 53 should work. Right?

I'm trying to reach the my client's network team and check if their DNS servers 
are allowed to make outbound connections to port 53. Which seems it is not the 
case.

I'll reply to this thread once I contact the firewall's owner.

Thank you very much!



 To: flg...@hotmail.com
 CC: bind-us...@isc.org
 From: ma...@isc.org
 Subject: Re: Message parser reports malformed message packet
 Date: Tue, 5 Nov 2013 23:33:39 +1100


 In message blu172-w5120e3bcb8525edd586934d3...@phx.gbl, 
 =?iso-8859-1?B?RuFiaW
 8gR29tZXM=?= writes:
 Thank you, Mark.

 I'm gonna try to contact the domain owners as well, but I noticed my
 enterprise DNS can get a correct answer for that domain. Is there any
 way I can force different response from localweb servers until I got
 this permanently fixed?
 Like force UDP packet sizes or disable EDNS for that domain?

 You actually want to use EDNS with bigger packet sizes as you need
 to get the entire response including additional records into the
 UDP response.

 Make sure your firewall passes fragmented packets and allows UDP
 responses bigger than 512 bytes. If your firewall in blocking
 fragements or UDP responses bigger than 512 bytes then named will
 be forced back to 512 bytes which will the interact badly with this
 nameserver.

 Could you also,
 please, share the tcpdump line you used to get that package details?

 tcpdump -s 0 -X

 Regards

 
 To: flg...@hotmail.com
 CC: bind-us...@isc.org
 CC: postmas...@locaweb.com.br
 From: ma...@isc.org
 Subject: Re: Message parser reports malformed message packet
 Date: Tue, 5 Nov 2013 08:09:05 +1100


 Their nameservers are broken. They are generating malformed
 responses. They are sending partial records when the answer does
 not fit. Note this ends halfway through a A record. Only the owner
 name, class, type and the first two octets of the ttl are present
 from the last RR.

 Any records / rrsets added to a DNS QUERY response should be
 *complete*.

 I have CC'd postmas...@locaweb.com.br but you may want to try other
 channels to inform them that they have broken nameservers.

 Mark

 0x: 4500 021c  4000 2c11 db95 c94c 2802 E.@.,L(.
 0x0010: c0a8 bf44 0035 ddf6 0208 7e6c 5f9a 8600 ...D.5~l_...
 0x0020: 0001 0001 000d 000d 0377  0773 6f6e .www.son
 0x0030: 6461 6974 0674 6173 6b65 7203 636f 6d02 dait.tasker.com.
 0x0040: 6272  0100 01c0 0c00 0500 0100 000e br..
 0x0050: 1000 2e10 7472 6961 6c2d 3139 3130 3037 trial-191007
 0x0060: 3037 3639 0973 612d 6561 7374 2d31 0365 0769.sa-east-1.e
 0x0070: 6c62 0961 6d61 7a6f 6e61 7773 0363 6f6d lb.amazonaws.com
 0x0080:  0002 0001 0007 e900 0014 0161 0c72 .a.r
 0x0090: 6f6f 742d 7365 7276 6572 7303 6e65 7400 oot-servers.net.
 0x00a0:  0200 0100 07e9  0401 62c0 7200 b.r.
 0x00b0: 0002 0001 0007 e900 0004 0163 c072  ...c.r..
 0x00c0: 0200 0100 07e9  0401 64c0 7200 0002 ..d.r...
 0x00d0: 0001 0007 e900 0004 0165 c072  0200 .e.r
 0x00e0: 0100 07e9  0401 66c0 7200 0002 0001 f.r.
 0x00f0: 0007 e900 0004 0167 c072  0200 0100 ...g.r..
 0x0100: 07e9  0401 68c0 7200 0002 0001 0007 ..h.r...
 0x0110: e900 0004 0169 c072  0200 0100 07e9 .i.r
 0x0120:  0401 6ac0 7200 0002 0001 0007 e900 j.r.
 0x0130: 0004 016b c072  0200 0100 07e9  ...k.r..
 0x0140: 0401 6cc0 7200 0002 0001 0007 e900 0004 ..l.r...
 0x0150: 016d c072 c070 0001 0001 0036 ee80 0004 .m.r.p.6
 0x0160: c629 0004 c08f 0001 0001 0036 ee80 0004 .).6
 0x0170: c0e4 4fc9 c09e 0001 0001 0036 ee80 0004 ..O6
 0x0180: c021 040c c0ad 0001 0001 0036 ee80 0004 .!.6
 0x0190: 8008 0a5a c0bc 0001 0001 0036 ee80 0004 ...Z...6
 0x01a0: c0cb e60a c0cb 0001 0001 0036 ee80 0004 ...6
 0x01b0: c005 05f1 c0da 0001 0001 0036 ee80 0004 ...6
 0x01c0: c070 2404 c0e9 0001 0001 0036 ee80 0004 .p$6
 0x01d0: 803f 0235 c0f8 0001 0001 0036 ee80 0004 .?.5...6
 0x01e0: c024 9411 c107 0001 0001 0036 ee80 0004 .$.6
 0x01f0: c03a 801e c116 0001 0001 0036 ee80 0004 .:.6
 0x0200: c100 0e81 c125 0001 0001 0036 ee80 0004 .%.6
 0x0210: c620 400c c134 0001 0001 0036 ..@..4.6



 ;; Warning: Message parser reports malformed message packet.

 ;  DiG 9.10.0a1  www.sondait.tasker.com.br @201.76.40.2 +nodnssec +
 noedns +ignore +besteffort +all +norec
 ;; global options: +cmd
 ;; Got

Re: Message parser reports malformed message packet

2013-11-05 Thread Matus UHLAR - fantomas


;; Warning: Message parser reports malformed message packet.
;; Truncated, retrying in TCP mode.
;; Connection to 201.76.40.2#53(201.76.40.2) for
www.sondait.tasker.com.br failed: connection refused.


On 05.11.13 10:50, Fábio Gomes wrote:

Even if my firewalls are not allowing udp packages bigger than 512, the
retry to port 53 should work.  Right?


If your firewall is not allowing DNS UDP packets bigger than 512 bytes,
replace that firewall.  It's apparently the source of yor problems.  DNS UDP
packets can be bigger than 512 bytes for more than 15 years.

DNS over TCP should still work, unless your firewall blocks those too...


I'm trying to reach the my client's network team and check if their DNS
servers are allowed to make outbound connections to port 53.  Which seems
it is not the case.

I'll reply to this thread once I contact the firewall's owner.


--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
M$ Win's are shit, do not use it !
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Message parser reports malformed message packet

2013-11-05 Thread Mark Andrews


In message 20131105121905.ga22...@fantomas.sk, Matus UHLAR - fantomas writes:
 On 05.11.13 10:02, F=E1bio Gomes wrote:
 I'm gonna try to contact the domain owners as well, but I noticed my
  enterprise DNS can get a correct answer for that domain.  Is there any way
  I can force different response from localweb servers until I got this
  permanently fixed?  Like force UDP packet sizes or disable EDNS for that
  domain?  Could you also, please, share the tcpdump line you used to get
  that package details?
 
 seems their nameservers are working correctly now, with or without TCP (even
 with EDNS0)

No they are not.  EDNS hides the problem.  If you use plain DNS the
problem is still visible.

Mark

;; Warning: Message parser reports malformed message packet.
;; Truncated, retrying in TCP mode.

;  DiG 9.10.0a1  www.sondait.tasker.com.br +noedns @201.76.40.2 +norec
;; global options: +cmd
;; Got answer:
;; -HEADER- opcode: QUERY, status: NOERROR, id: 45899
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 13

;; QUESTION SECTION:
;www.sondait.tasker.com.br. IN  A

;; ANSWER SECTION:
www.sondait.tasker.com.br. 3600 IN  CNAME   
trial-1910070769.sa-east-1.elb.amazonaws.com.

;; AUTHORITY SECTION:
.   518400  IN  NS  a.root-servers.net.
.   518400  IN  NS  b.root-servers.net.
.   518400  IN  NS  c.root-servers.net.
.   518400  IN  NS  d.root-servers.net.
.   518400  IN  NS  e.root-servers.net.
.   518400  IN  NS  f.root-servers.net.
.   518400  IN  NS  g.root-servers.net.
.   518400  IN  NS  h.root-servers.net.
.   518400  IN  NS  i.root-servers.net.
.   518400  IN  NS  j.root-servers.net.
.   518400  IN  NS  k.root-servers.net.
.   518400  IN  NS  l.root-servers.net.
.   518400  IN  NS  m.root-servers.net.

;; ADDITIONAL SECTION:
a.root-servers.net. 360 IN  A   198.41.0.4
b.root-servers.net. 360 IN  A   192.228.79.201
c.root-servers.net. 360 IN  A   192.33.4.12
d.root-servers.net. 360 IN  A   128.8.10.90
e.root-servers.net. 360 IN  A   192.203.230.10
f.root-servers.net. 360 IN  A   192.5.5.241
g.root-servers.net. 360 IN  A   192.112.36.4
h.root-servers.net. 360 IN  A   128.63.2.53
i.root-servers.net. 360 IN  A   192.36.148.17
j.root-servers.net. 360 IN  A   192.58.128.30
k.root-servers.net. 360 IN  A   193.0.14.129
l.root-servers.net. 360 IN  A   198.32.64.12
m.root-servers.net. 360 IN  A   202.12.27.33

;; Query time: 819 msec
;; SERVER: 201.76.40.2#53(201.76.40.2)
;; WHEN: Wed Nov 06 00:03:39 EST 2013
;; MSG SIZE  rcvd: 520


 -- =
 
 Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
 Warning: I wish NOT to receive e-mail advertising to this address.
 Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
 I'm not interested in your website anymore.
 If you need cookies, bake them yourself.
 ___
 Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscri=
 be from this list
 
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Bind server crashing (lots of EAGAIN, ENOENT, ...). With strace log.

2013-11-05 Thread Alan Clegg


On Nov 5, 2013, at 7:31 AM, K L kl.forwar...@gmail.com wrote:

 Here is a strace log from when it happens: 
 http://pastebin.com/raw.php?i=7i0PgALG . Example:
 6500 recvmsg(518, {msg_name(16)={sa_family=AF_INET, sin_port=htons(53), 
 sin_addr=inet_addr(10.0.101.50)}, 
 msg_iov(1)=[{~\223\201\200\0\1\0\1\0\5\0\6\3ns3\5cymru\3com\0\0\1\0\1\300...,
  4096}], msg_controllen=32, {cmsg_len=32, cmsg_level=SOL_SOCKET, 
 cmsg_type=0x1d /* SCM_??? */, ...}, msg_flags=0}, 0) = 252
 6500 recvmsg(518, 0x7fd4b6588900, 0) = -1 EAGAIN (Resource temporarily 
 unavailable)

What about more normal bind logging?  Anything useful in there?

AlanC
-- 
Alan Clegg | +1-919-355-8851 | a...@clegg.com



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Message parser reports malformed message packet

RE: Message parser reports malformed message packet

Re: Message parser reports malformed message packet

Bind server crashing (lots of EAGAIN, ENOENT, ...). With strace log.

Re: Message parser reports malformed message packet

RE: Message parser reports malformed message packet

Re: Message parser reports malformed message packet

Re: Message parser reports malformed message packet

Re: Bind server crashing (lots of EAGAIN, ENOENT, ...). With strace log.

9 matches

Site Navigation

Mail list logo

Footer information