Re: Frequent timeout

2018-09-10 Thread Alex
Hi, > >> tcpdump -s0 -n -i eth0 port domain -w /tmp/domaincapture.pcap > >> > >> You don't need all of the extra stuff because -s0 captures the full packet. > > On 06.09.18 18:42, Alex wrote: > >This is the command I ran to produce the pcap file I sent: > > > ># tcpdump -s0 -vv -i eth0 -nn -w

Re: DNSSEC will eventually generate Identical Key ID's

2018-09-10 Thread Warren Kumari
On Sun, Sep 9, 2018 at 2:30 PM Anand Buddhdev wrote: > On 09/09/2018 19:51, Mark Elkins wrote: > > > Never assume a KeyID is unique. :-) > > One of the DNSSEC RFCs specifically says that the KeyID is not meant to > be unique. I can't remember which one, and it's too late on a Sunday > evening

Scaling Bind-DLZ

2018-09-10 Thread Job
Hi, we are using with a quite good satisfaction Bind-DLZ (with Postgresql 9.6.4) on Bind9. I know, it is a quite old driver, but we know very well how does it work. Due to traffic increase, we are experiencing some visible delays when the number of concurrent queries per second reach the

Re: DNSSEC will eventually generate Identical Key ID's

2018-09-10 Thread Tony Finch
Mark Elkins wrote: > Never assume a KeyID is unique.  :-) Good tools ensure that key IDs are unique per zone. For example, if you keep generating keys for a zone with `dnssec-keygen` it will eventually get into an infinite loop perpetually generating colliding keys! Apart from the footgun that

Re: DNSSEC will eventually generate Identical Key ID's

2018-09-10 Thread Ray Bellis
On 09/09/2018 18:51, Mark Elkins wrote: > Just for the record, although I do look from a curiosity point of view > for Identical Key ID's once every few month - I've never seen them - > until now. > > Now I have them - generated by BIND within a few days of each other... > > I've been running