Subject: UDP/DNS testing dnscache (from djbdns 1.05)

From: "Jeremy Kister" <[email-masked]>
Date: Fri, 12 Mar 2004 12:20:33 -0500

I recenty changed my recursive name servers from BIND 9 to dnscache.  One of
the tests i was using successfully is now failing:

Host "ns2" {
 Service UDP/DNS {
   class: IN
   minvalue: 2
   query: NS
   test: nanswers
   zone: yahoo.com
  }
}

srvc::reason from debugging says UDP timeout.
this is odd, because from the box Argus is on:
unix11> dig @ns2.broadviewnet.net yahoo.com ns

; <<>> DiG 9.2.1 <<>> @ns2.broadviewnet.net yahoo.com ns
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41093
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;yahoo.com.                     IN      NS

;; ANSWER SECTION:
yahoo.com.              172788  IN      NS      ns1.yahoo.com.
yahoo.com.              172788  IN      NS      ns2.yahoo.com.
yahoo.com.              172788  IN      NS      ns3.yahoo.com.
yahoo.com.              172788  IN      NS      ns4.yahoo.com.
yahoo.com.              172788  IN      NS      ns5.yahoo.com.

;; Query time: 22 msec
;; SERVER: 64.115.0.10#53(ns2.broadviewnet.net)
;; WHEN: Fri Mar 12 12:16:03 2004
;; MSG SIZE  rcvd: 117

Any Ideas?

Jeremy Kister
www.jeremykister.com/jeremy/

---

From: Jeff Weisberg <[email-masked]>
Date: Fri, 12 Mar 2004 12:56:00 -0500 (EST)

| I recenty changed my recursive name servers from BIND 9 to dnscache.  One of
| the tests i was using successfully is now failing:
| 
| Host "ns2" {
|  Service UDP/DNS {
[...]

| Any Ideas?

FAQ #6?
	http://argus.tcp4me.com/faq.html

	--jeff

---

From: "Jeremy Kister" <[email-masked]>
Date: Fri, 12 Mar 2004 16:03:58 -0500

>FAQ #6?

I didnt realize that a NS lookup still sent a status query; I was using

           Host "ns2" {
               Service UDP/DNSQ {
                sendnotify:     no
                expect: ^...(\x80|\x00)
                }
             }

in conjunction with the previous listed config, but thought that argus
wouldnt care about a status query when asking for a specific record/type.
speaking of which, why does argus care about a status query when asking for
yahoo's ns records?

i think the FAQ should be updated to specifically say that any queries to
either tinydns or dnscache from the dbjdns package must not use UDP/DNS...
(to prevent dumbo's like me who kinda knew the answer from making the
mistake)

Jeremy Kister

---

From: Jeff Weisberg <[email-masked]>
Date: Fri, 12 Mar 2004 16:46:17 -0500 (EST)

sorry, I don't think read your email all the way to the end.
ignore my previous response; I'll try again.

| I didnt realize that a NS lookup still sent a status query; I was using

no, if you ask for an NS query, you get an NS query.

|    class: IN
|    minvalue: 2
|    query: NS
|    test: nanswers
|    zone: yahoo.com
|   }
| }

this fails because you are making a non-recursive query to a
non-authoritative name server. it fails for the same reason as:

	dig @ns2 yahoo.com ns +norecurse

add
	recurse:	yes

sorry for previous non-useful answer.

	--jeff