BIND srtt algorithm not working as expected

2018-05-16 Thread Paul Roberts
Hello, I am researching an issue we are seeing with significant volumes of DNS traffic being sent to non-local forwarders. I think I understand how the srtt algorithm works, but I am seeing more traffic going to the non-local forwarders than I was expecting. To give you some context, we have

Re: Logging ECS information for RPZ rewrites

2018-05-16 Thread Tony Finch
Brian Keifer wrote: > > The architecture I've been working with so far is a pair of front-end proxy > servers running keepalived to share a virtual IP and PowerDNS's dnsdist as > the actual proxy. The proxies set ECS to the client's IP address and pass > the request to one of four back-end cachin

Re: BIND srtt algorithm not working as expected

2018-05-16 Thread Tony Finch
Paul Roberts wrote: > > This seems to imply on slide 16 that with lower query rates, BIND 9.8 > has a habit of sending fairly significant volumes to DNS servers with > higher rtts. I am wondering if this is still the case in BIND 9.10 or > 9.11 and whether there is anything that can be done about

request-nsid seems to not be working (Bind 9.11.3)

2018-05-16 Thread Bob McDonald
I have a server that has request-nsid yes; specified in the options block within named.conf. However, I don't see the NSID responses in the resolver channel log file. Anyone else see this behaviour? dig +nsid seems to work. Regards, Bob ___ Please visit

Re: request-nsid seems to not be working (Bind 9.11.3)

2018-05-16 Thread Tony Finch
Bob McDonald wrote: > I have a server that has request-nsid yes; specified in the options block > within named.conf. However, I don't see the NSID responses in the resolver > channel log file. It only appears at debug level 3 or greater. Tony. -- f.anthony.n.finchhttp://dotat.at/ Malin, So

Re: request-nsid seems to not be working (Bind 9.11.3)

2018-05-16 Thread Bob McDonald
Is that a functionality change from previous versions? I seem to remember it working at the info level. I could be wrong... On Wed, May 16, 2018 at 3:09 PM, Tony Finch wrote: > Bob McDonald wrote: > > > I have a server that has request-nsid yes; specified in the options block > > within named.

Re: request-nsid seems to not be working (Bind 9.11.3)

2018-05-16 Thread Bob McDonald
from the Bv9ARM: (9.11.3) request-nsid If yes, then an empty EDNS(0) NSID (Name Server Identifier) option is sent with all queries to authoritative name servers during iterative resolution. If the authoritative server returns an NSID option in its response, then its contents are logged in the reso

Re: request-nsid seems to not be working (Bind 9.11.3)

2018-05-16 Thread Tony Finch
Bob McDonald wrote: > Is that a functionality change from previous versions? I seem to remember > it working at the info level. It appears to be due to an unintended change. I've submitted a patch to fix it https://gitlab.isc.org/isc-projects/bind9/merge_requests/290 Tony. -- f.anthony.n.finch

Observed random DNS update failures

2018-05-16 Thread nagaraju
Hello, We are facing Random update failures issue with the BIND. Here are the full details about the issue, request help in overcoming this problem 1. BIND version used is 9.11.1-P3 2. Single BIND named server is used for both DNS updates and query traffic 3. Hardware used is DL360 Gen9 hardware