• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

I need HELP on DNS RESOLVER!

DHCP and DNS
6
78
14.8k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • E
    emirefek @Gertjan
    last edited by Sep 14, 2018, 3:52 PM

    @gertjan I already disable that rule and mate I cannot resolve this domain on pfsense box too. Its not about rules I think.

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz Sep 14, 2018, 4:54 PM Sep 14, 2018, 4:41 PM

      your trace will show you where you have a problem.. A +trace is exactly what resolver does.. It walks down from roots to the authoritative ns for a domain, then queries an authoritative ns for the domain your looking for for the record you seek..

      If you can not resolve thee ns for edgecastcdn.net then no your never going to be able to resolve a record they are authoritative for

      Now that you have removed that rule and centos can talk to any dns it wants... Lets see its trace for that record as I posted before.

      So how that is resolved

      ; <<>> DiG 9.11.2-P1 <<>> cs71.wac.edgecastcdn.net +trace +nodnssec
      ;; global options: +cmd
      .                       47128   IN      NS      a.root-servers.net.
      .                       47128   IN      NS      b.root-servers.net.
      .                       47128   IN      NS      c.root-servers.net.
      .                       47128   IN      NS      d.root-servers.net.
      .                       47128   IN      NS      e.root-servers.net.
      .                       47128   IN      NS      f.root-servers.net.
      .                       47128   IN      NS      g.root-servers.net.
      .                       47128   IN      NS      h.root-servers.net.
      .                       47128   IN      NS      i.root-servers.net.
      .                       47128   IN      NS      j.root-servers.net.
      .                       47128   IN      NS      k.root-servers.net.
      .                       47128   IN      NS      l.root-servers.net.
      .                       47128   IN      NS      m.root-servers.net.
      ;; Received 239 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms
      
      net.                    172800  IN      NS      a.gtld-servers.net.
      net.                    172800  IN      NS      m.gtld-servers.net.
      net.                    172800  IN      NS      b.gtld-servers.net.
      net.                    172800  IN      NS      c.gtld-servers.net.
      net.                    172800  IN      NS      e.gtld-servers.net.
      net.                    172800  IN      NS      k.gtld-servers.net.
      net.                    172800  IN      NS      i.gtld-servers.net.
      net.                    172800  IN      NS      j.gtld-servers.net.
      net.                    172800  IN      NS      f.gtld-servers.net.
      net.                    172800  IN      NS      h.gtld-servers.net.
      net.                    172800  IN      NS      d.gtld-servers.net.
      net.                    172800  IN      NS      g.gtld-servers.net.
      net.                    172800  IN      NS      l.gtld-servers.net.
      ;; Received 846 bytes from 192.36.148.17#53(i.root-servers.net) in 35 ms
      
      edgecastcdn.net.        172800  IN      NS      ns1.edgecastcdn.net.
      edgecastcdn.net.        172800  IN      NS      ns2.edgecastcdn.net.
      ;; Received 177 bytes from 192.31.80.30#53(d.gtld-servers.net) in 42 ms
      
      cs71.wac.edgecastcdn.net. 3600  IN      A       72.21.91.97
      ;; Received 69 bytes from 72.21.80.5#53(ns1.edgecastcdn.net) in 18 ms
      

      It asks roots hey roots who is NS for .net domain, hey .net NS who is authoritative for edgecastcdn.net, hey hey ns1.edgecastcdn.net what is the A record for cs71.wac.edgecastcdn.net.

      You can see that happen in the trace - and exactly what IP got asked..

      If pfsense can not do that - then you need to figure out why.. You can sniff when you run the command and see exactly what gets asked and what gets returned.. On pfsense wan.. If you send a query and don't get a response then the problem is upstream.. Maybe your ISP dicks with dns queries? Maybe you have a network problem talking to the NSers for edgecastcdn.net? maybe they block your IP, etc. etc.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      E 1 Reply Last reply Sep 14, 2018, 6:40 PM Reply Quote 0
      • E
        emirefek @johnpoz
        last edited by Sep 14, 2018, 6:40 PM

        @johnpoz this is my output from pfsense but in my results I cannot see gtld-servers.net ?

        dig cs71.wac.edgecastcdn.net +trace +nodnssec

        ; <<>> DiG 9.11.2-P1 <<>> cs71.wac.edgecastcdn.net +trace +nodnssec
        ;; global options: +cmd
        .			518275	IN	NS	j.root-servers.net.
        .			518275	IN	NS	k.root-servers.net.
        .			518275	IN	NS	l.root-servers.net.
        .			518275	IN	NS	a.root-servers.net.
        .			518275	IN	NS	i.root-servers.net.
        .			518275	IN	NS	g.root-servers.net.
        .			518275	IN	NS	h.root-servers.net.
        .			518275	IN	NS	c.root-servers.net.
        .			518275	IN	NS	m.root-servers.net.
        .			518275	IN	NS	b.root-servers.net.
        .			518275	IN	NS	f.root-servers.net.
        .			518275	IN	NS	d.root-servers.net.
        .			518275	IN	NS	e.root-servers.net.
        ;; Received 239 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms
        
        ;; connection timed out; no servers could be reached
        

        after that I try this command but I dont know how dig command work clearly but When ı execute this command I was get these output

        dig gtld-servers.net +trace +nodnssec

        ; <<>> DiG 9.11.2-P1 <<>> gtld-servers.net +trace +nodnssec
        ;; global options: +cmd
        .			517818	IN	NS	j.root-servers.net.
        .			517818	IN	NS	k.root-servers.net.
        .			517818	IN	NS	l.root-servers.net.
        .			517818	IN	NS	a.root-servers.net.
        .			517818	IN	NS	i.root-servers.net.
        .			517818	IN	NS	g.root-servers.net.
        .			517818	IN	NS	h.root-servers.net.
        .			517818	IN	NS	c.root-servers.net.
        .			517818	IN	NS	m.root-servers.net.
        .			517818	IN	NS	b.root-servers.net.
        .			517818	IN	NS	f.root-servers.net.
        .			517818	IN	NS	d.root-servers.net.
        .			517818	IN	NS	e.root-servers.net.
        ;; Received 239 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms
        
        net.			172800	IN	NS	a.gtld-servers.net.
        net.			172800	IN	NS	b.gtld-servers.net.
        net.			172800	IN	NS	c.gtld-servers.net.
        net.			172800	IN	NS	d.gtld-servers.net.
        net.			172800	IN	NS	e.gtld-servers.net.
        net.			172800	IN	NS	f.gtld-servers.net.
        net.			172800	IN	NS	g.gtld-servers.net.
        net.			172800	IN	NS	h.gtld-servers.net.
        net.			172800	IN	NS	i.gtld-servers.net.
        net.			172800	IN	NS	j.gtld-servers.net.
        net.			172800	IN	NS	k.gtld-servers.net.
        net.			172800	IN	NS	l.gtld-servers.net.
        net.			172800	IN	NS	m.gtld-servers.net.
        ;; Received 825 bytes from 198.97.190.53#53(h.root-servers.net) in 133 ms
        
        gtld-servers.net.	172800	IN	NS	av1.nstld.com.
        gtld-servers.net.	172800	IN	NS	av2.nstld.com.
        gtld-servers.net.	172800	IN	NS	av3.nstld.com.
        gtld-servers.net.	172800	IN	NS	av4.nstld.com.
        ;; Received 302 bytes from 192.43.172.30#53(i.gtld-servers.net) in 203 ms
        
        gtld-servers.net.	86400	IN	SOA	av4.nstld.com. nstld.verisign-grs.com. 2017061500 3600 900 1209600 86400
        ;; Received 113 bytes from 192.42.178.30#53(av2.nstld.com) in 66 ms
        
        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by Sep 14, 2018, 7:20 PM

          @emirefek said in I need HELP on DNS RESOLVER!:

          ;; connection timed out; no servers could be reached

          You are NOT talking to roots... When you ask for

          dig cs71.wac.edgecastcdn.net +trace +nodnssec

          Sniff on your WAN when you do that command... What do you see? You should be able to watch the whole process where does it fail?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          E 1 Reply Last reply Sep 14, 2018, 7:22 PM Reply Quote 0
          • E
            emirefek @johnpoz
            last edited by Sep 14, 2018, 7:22 PM

            @johnpoz Am I need to sniff from unbound logs ?

            1 Reply Last reply Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz Sep 14, 2018, 7:25 PM Sep 14, 2018, 7:24 PM

              just do a packet capture on the wan for port 53... So you can see exactly what is being asked for and what your getting back

              Flush unbound cache first

              What does your unbound cache show for it?

              [2.4.3-RELEASE][root@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf lookup cs71.wac.edgecastcdn.net
              The following name servers are used for lookup of cs71.wac.edgecastcdn.net.
              ;rrset 3119 4 0 7 3
              edgecastcdn.net.        3119    IN      NS      ns1.edgecastcdn.net.
              edgecastcdn.net.        3119    IN      NS      ns2.edgecastcdn.net.
              edgecastcdn.net.        3119    IN      NS      ns3.edgecastcdn.net.
              edgecastcdn.net.        3119    IN      NS      ns4.edgecastcdn.net.
              ;rrset 3119 1 0 3 3
              ns4.edgecastcdn.net.    3119    IN      A       192.229.254.6
              ;rrset 3119 1 0 3 3
              ns4.edgecastcdn.net.    3119    IN      AAAA    2606:2800:e::6
              ;rrset 3119 1 0 3 3
              ns3.edgecastcdn.net.    3119    IN      A       192.229.254.5
              ;rrset 3119 1 0 3 3
              ns3.edgecastcdn.net.    3119    IN      AAAA    2606:2800:e::5
              ;rrset 85919 1 0 8 3
              ns2.edgecastcdn.net.    172319  IN      A       72.21.80.6
              ;rrset 85919 1 0 8 3
              ns2.edgecastcdn.net.    172319  IN      AAAA    2606:2800:1::6
              ;rrset 85919 1 0 8 3
              ns1.edgecastcdn.net.    172319  IN      A       72.21.80.5
              ;rrset 85919 1 0 8 3
              ns1.edgecastcdn.net.    172319  IN      AAAA    2606:2800:1::5
              Delegation with 4 names, of which 0 can be examined to query further addresses.
              It provides 8 IP addresses.
              2606:2800:1::5          not in infra cache.
              72.21.80.5              not in infra cache.
              2606:2800:1::6          rto 376 msec, ttl 419, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
              72.21.80.6              rto 238 msec, ttl 419, ping 2 var 59 rtt 238, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
              2606:2800:e::5          not in infra cache.
              192.229.254.5           rto 297 msec, ttl 419, ping 1 var 74 rtt 297, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
              2606:2800:e::6          rto 376 msec, ttl 419, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
              192.229.254.6           rto 306 msec, ttl 419, ping 2 var 76 rtt 306, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
              [2.4.3-RELEASE][root@sg4860.local.lan]/root:
              

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • E
                emirefek
                last edited by emirefek Sep 14, 2018, 7:59 PM Sep 14, 2018, 7:57 PM

                @johnpoz said in I need HELP on DNS RESOLVER!:

                dig cs71.wac.edgecastcdn.net +trace +nodnssec

                After start catching I typed this command to pfsense:

                dig cs71.wac.edgecastcdn.net +trace +nodnssec
                

                Here output from packet capture at 53 port

                22:53:30.024208 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
                22:53:31.030351 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
                22:53:32.040306 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
                22:53:33.050299 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
                22:53:37.090317 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
                22:53:38.100289 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
                22:53:40.160315 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
                22:53:43.240948 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
                22:53:44.253515 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
                22:53:48.304619 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
                22:53:51.360307 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
                22:53:52.379843 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
                22:53:53.389741 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65
                22:54:00.450247 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
                22:54:01.460281 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
                22:54:02.469596 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
                22:54:03.480236 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
                22:54:07.540247 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
                22:54:08.583342 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
                22:54:10.600242 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
                22:54:13.640244 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
                22:54:14.650266 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
                22:54:18.690232 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
                22:54:21.740238 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
                22:54:22.772875 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
                22:54:23.779625 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65
                22:54:30.812783 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
                22:54:31.819612 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
                22:54:32.830242 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
                22:54:33.856594 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
                22:54:37.899669 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
                22:54:38.910250 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
                22:54:40.949745 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
                22:54:44.000233 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
                22:54:45.010274 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
                22:54:46.708756 IP 88.247.225.172.static.ttnet.com.tr.7485 > m.gtld-servers.net.domain: UDP, length 44
                22:54:46.771932 IP m.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.7485: UDP, length 782
                22:54:46.772270 IP 88.247.225.172.static.ttnet.com.tr.59069 > ns2.msft.net.domain: UDP, length 44
                22:54:46.827447 IP ns2.msft.net.domain > 88.247.225.172.static.ttnet.com.tr.59069: UDP, length 82
                22:54:46.827814 IP 88.247.225.172.static.ttnet.com.tr.18069 > l.gtld-servers.net.domain: UDP, length 56
                22:54:46.864979 IP 88.247.225.172.static.ttnet.com.tr.25085 > f.gtld-servers.net.domain: UDP, length 56
                22:54:46.894347 IP l.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.18069: UDP, length 1106
                22:54:46.894691 IP 88.247.225.172.static.ttnet.com.tr.9268 > a1-66.akam.net.domain: UDP, length 56
                22:54:47.030650 IP a1-66.akam.net.domain > 88.247.225.172.static.ttnet.com.tr.9268: UDP, length 92
                22:54:47.031049 IP 88.247.225.172.static.ttnet.com.tr.58962 > j.gtld-servers.net.domain: UDP, length 54
                22:54:47.064947 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.25085: UDP, length 1106
                22:54:47.065230 IP 88.247.225.172.static.ttnet.com.tr.12213 > use3.akam.net.domain: UDP, length 56
                22:54:47.132643 IP use3.akam.net.domain > 88.247.225.172.static.ttnet.com.tr.12213: UDP, length 92
                22:54:47.132882 IP 88.247.225.172.static.ttnet.com.tr.51526 > f.gtld-servers.net.domain: UDP, length 54
                22:54:47.153901 IP j.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.58962: UDP, length 1048
                22:54:47.154148 IP 88.247.225.172.static.ttnet.com.tr.4808 > a2-16-40-192.deploy.static.akamaitechnologies.com.domain: UDP, length 54
                22:54:47.338473 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.51526: UDP, length 1048
                22:54:47.338984 IP 88.247.225.172.static.ttnet.com.tr.51939 > a95-101-36-192.deploy.static.akamaitechnologies.com.domain: UDP, length 54
                22:54:47.347453 IP a2-16-40-192.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.4808: UDP, length 378
                22:54:47.347714 IP 88.247.225.172.static.ttnet.com.tr.13784 > a2-16-187-47.deploy.static.akamaitechnologies.com.domain: UDP, length 54
                22:54:47.397160 IP a95-101-36-192.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.51939: UDP, length 378
                22:54:47.397407 IP 88.247.225.172.static.ttnet.com.tr.14635 > a2-16-187-63.deploy.static.akamaitechnologies.com.domain: UDP, length 54
                22:54:47.418622 IP a2-16-187-47.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.13784: UDP, length 70
                22:54:47.463365 IP a2-16-187-63.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.14635: UDP, length 70
                22:54:49.092864 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
                22:54:52.120242 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
                22:54:53.130227 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
                22:54:54.189718 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65
                

                edit: ttnet.com.tr is my ISP.

                1 Reply Last reply Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator
                  last edited by Sep 14, 2018, 8:02 PM

                  post up the pcap of that.. So can make heads or tales of it..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  E 1 Reply Last reply Sep 14, 2018, 8:04 PM Reply Quote 0
                  • E
                    emirefek @johnpoz
                    last edited by Sep 14, 2018, 8:04 PM

                    @johnpoz I posted this is packet capture ? you need without reverse dns?

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz Sep 14, 2018, 8:10 PM Sep 14, 2018, 8:04 PM

                      NO you did not.. Download the capture and attach the pcap... All you can see there is the dest and source IPs... You can not SEE what was asked and what was returned.. I want the actual pcap so I can load it into wireshark and view what is going on. Also make sure you bump up the 100 packet limit since seems you have other dns queries going on there.

                      Also what does the cache show you for unbound... See my other command I posted.

                      47.338473 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.51526: UDP, length 1048

                      Here one of the gtld servers answered you - what did he say? If had the pcap could load into wireshark and SEE exactly what was returned.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      E 1 Reply Last reply Sep 14, 2018, 8:09 PM Reply Quote 0
                      • E
                        emirefek @johnpoz
                        last edited by emirefek Sep 15, 2018, 2:07 PM Sep 14, 2018, 8:09 PM

                        @johnpoz Sorry I wasnt know that here it is my .cap file [DELETED FILE]

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz Sep 14, 2018, 8:15 PM Sep 14, 2018, 8:14 PM

                          Ok WTF look at this... your asking averyone and their browser for this - and no response!!!

                          🔒 Log in to view

                          Why are you sending queries to ALL these IPs Notse are not the IPs for NS for that domain..

                          But you do get a response looking up synology something.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          E 1 Reply Last reply Sep 14, 2018, 8:16 PM Reply Quote 0
                          • E
                            emirefek @johnpoz
                            last edited by emirefek Sep 14, 2018, 8:32 PM Sep 14, 2018, 8:16 PM

                            @johnpoz Synology is NAS brand my nas is checking something randomly. Wrong time wrong place ?

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz Sep 14, 2018, 8:21 PM Sep 14, 2018, 8:17 PM

                              So your asking Roots - and NOT getting any answers... I looked up the first 2 there those are root servers... So where are you answers??

                              Ask roots for that A record you should get back the NS for .net

                              C:\>dig @a.root-servers.net cs71.wac.edgecastcdn.net
                              
                              ; <<>> DiG 9.12.2-P1 <<>> @a.root-servers.net cs71.wac.edgecastcdn.net
                              ; (1 server found)
                              ;; global options: +cmd
                              ;; Got answer:
                              ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32949
                              ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27
                              ;; WARNING: recursion requested but not available
                              
                              ;; OPT PSEUDOSECTION:
                              ; EDNS: version: 0, flags:; udp: 4096
                              ;; QUESTION SECTION:
                              ;cs71.wac.edgecastcdn.net.      IN      A
                              
                              ;; AUTHORITY SECTION:
                              net.                    172800  IN      NS      e.gtld-servers.net.
                              net.                    172800  IN      NS      f.gtld-servers.net.
                              net.                    172800  IN      NS      m.gtld-servers.net.
                              net.                    172800  IN      NS      i.gtld-servers.net.
                              net.                    172800  IN      NS      j.gtld-servers.net.
                              net.                    172800  IN      NS      b.gtld-servers.net.
                              net.                    172800  IN      NS      a.gtld-servers.net.
                              net.                    172800  IN      NS      c.gtld-servers.net.
                              net.                    172800  IN      NS      k.gtld-servers.net.
                              net.                    172800  IN      NS      h.gtld-servers.net.
                              net.                    172800  IN      NS      l.gtld-servers.net.
                              net.                    172800  IN      NS      g.gtld-servers.net.
                              net.                    172800  IN      NS      d.gtld-servers.net.
                              
                              ;; ADDITIONAL SECTION:
                              e.gtld-servers.net.     172800  IN      A       192.12.94.30
                              e.gtld-servers.net.     172800  IN      AAAA    2001:502:1ca1::30
                              f.gtld-servers.net.     172800  IN      A       192.35.51.30
                              f.gtld-servers.net.     172800  IN      AAAA    2001:503:d414::30
                              m.gtld-servers.net.     172800  IN      A       192.55.83.30
                              m.gtld-servers.net.     172800  IN      AAAA    2001:501:b1f9::30
                              i.gtld-servers.net.     172800  IN      A       192.43.172.30
                              i.gtld-servers.net.     172800  IN      AAAA    2001:503:39c1::30
                              j.gtld-servers.net.     172800  IN      A       192.48.79.30
                              j.gtld-servers.net.     172800  IN      AAAA    2001:502:7094::30
                              b.gtld-servers.net.     172800  IN      A       192.33.14.30
                              b.gtld-servers.net.     172800  IN      AAAA    2001:503:231d::2:30
                              a.gtld-servers.net.     172800  IN      A       192.5.6.30
                              a.gtld-servers.net.     172800  IN      AAAA    2001:503:a83e::2:30
                              c.gtld-servers.net.     172800  IN      A       192.26.92.30
                              c.gtld-servers.net.     172800  IN      AAAA    2001:503:83eb::30
                              k.gtld-servers.net.     172800  IN      A       192.52.178.30
                              k.gtld-servers.net.     172800  IN      AAAA    2001:503:d2d::30
                              h.gtld-servers.net.     172800  IN      A       192.54.112.30
                              h.gtld-servers.net.     172800  IN      AAAA    2001:502:8cc::30
                              l.gtld-servers.net.     172800  IN      A       192.41.162.30
                              l.gtld-servers.net.     172800  IN      AAAA    2001:500:d937::30
                              g.gtld-servers.net.     172800  IN      A       192.42.93.30
                              g.gtld-servers.net.     172800  IN      AAAA    2001:503:eea3::30
                              d.gtld-servers.net.     172800  IN      A       192.31.80.30
                              d.gtld-servers.net.     172800  IN      AAAA    2001:500:856e::30
                              
                              ;; Query time: 31 msec
                              ;; SERVER: 198.41.0.4#53(198.41.0.4)
                              ;; WHEN: Fri Sep 14 15:20:00 Central Daylight Time 2018
                              ;; MSG SIZE  rcvd: 846
                              

                              Your just asking and asking and asking and not getting back anything... Why? That will explain why you can not resolve for sure.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              E 1 Reply Last reply Sep 14, 2018, 8:27 PM Reply Quote 0
                              • E
                                emirefek @johnpoz
                                last edited by emirefek Sep 14, 2018, 8:38 PM Sep 14, 2018, 8:27 PM

                                @johnpoz I did packet capture again. And these are results. 0_1536956837326_packetcapture (3).zip

                                I execute ""dig @a.root-servers.net cs71.wac.edgecastcdn.net"" this command on pfsense cmndprmpt

                                edit:which program using for looking cap files ?(ok I installed wireshark)

                                J 1 Reply Last reply Sep 14, 2018, 8:46 PM Reply Quote 0
                                • J
                                  johnpoz LAYER 8 Global Moderator @emirefek
                                  last edited by Sep 14, 2018, 8:46 PM

                                  @emirefek

                                  Sorry i went for beers wont be able to view til get home did u get anwser?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  E 1 Reply Last reply Sep 14, 2018, 8:49 PM Reply Quote 0
                                  • E
                                    emirefek @johnpoz
                                    last edited by Sep 14, 2018, 8:49 PM

                                    @johnpoz No problem mate. Thanks for all of these responses. Take "Efe's" if avalible.

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by johnpoz Sep 15, 2018, 12:51 PM Sep 15, 2018, 12:44 PM

                                      So same thing dude your asking

                                      🔒 Log in to view

                                      But you get NO response?? Something upstream of you filtering dns? There should be no reason that I can think of why if you ask a root server your not getting a response. You can see other queries there where you ask root and get answers..

                                      This is what should look like - you ask, and get answer of all the NS for .net
                                      🔒 Log in to view

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      E 1 Reply Last reply Sep 15, 2018, 12:53 PM Reply Quote 0
                                      • E
                                        emirefek @johnpoz
                                        last edited by Sep 15, 2018, 12:53 PM

                                        @johnpoz I dont know why. Im on my home know There isnt any linux with me now. In my house Im using diffrent ISP. How can I check response on windows devices ?

                                        64.53.public is a dns fake root ? Am I understand right.

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz Sep 15, 2018, 12:56 PM Sep 15, 2018, 12:55 PM

                                          198.41.0.4 is root - I just edit in wireshark what my public IP resolves too ;) Not a fan of posting my public IP on forums - especially when I have ticked off a few people here that might do something with that info - hehehe

                                          You can install dig on your windows machine.. Just download bind from iSC and say install tools only... I run dig on windows all the time..

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          GertjanG 1 Reply Last reply Sep 15, 2018, 12:56 PM Reply Quote 0
                                          42 out of 78
                                          • First post
                                            42/78
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.