Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    I need HELP on DNS RESOLVER!

    Scheduled Pinned Locked Moved DHCP and DNS
    78 Posts 6 Posters 14.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      emirefek @johnpoz
      last edited by

      @johnpoz this is my output from pfsense but in my results I cannot see gtld-servers.net ?

      dig cs71.wac.edgecastcdn.net +trace +nodnssec

      ; <<>> DiG 9.11.2-P1 <<>> cs71.wac.edgecastcdn.net +trace +nodnssec
;; global options: +cmd
.			518275	IN	NS	j.root-servers.net.
.			518275	IN	NS	k.root-servers.net.
.			518275	IN	NS	l.root-servers.net.
.			518275	IN	NS	a.root-servers.net.
.			518275	IN	NS	i.root-servers.net.
.			518275	IN	NS	g.root-servers.net.
.			518275	IN	NS	h.root-servers.net.
.			518275	IN	NS	c.root-servers.net.
.			518275	IN	NS	m.root-servers.net.
.			518275	IN	NS	b.root-servers.net.
.			518275	IN	NS	f.root-servers.net.
.			518275	IN	NS	d.root-servers.net.
.			518275	IN	NS	e.root-servers.net.
;; Received 239 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

;; connection timed out; no servers could be reached

      after that I try this command but I dont know how dig command work clearly but When ı execute this command I was get these output

      dig gtld-servers.net +trace +nodnssec

      ; <<>> DiG 9.11.2-P1 <<>> gtld-servers.net +trace +nodnssec
;; global options: +cmd
.			517818	IN	NS	j.root-servers.net.
.			517818	IN	NS	k.root-servers.net.
.			517818	IN	NS	l.root-servers.net.
.			517818	IN	NS	a.root-servers.net.
.			517818	IN	NS	i.root-servers.net.
.			517818	IN	NS	g.root-servers.net.
.			517818	IN	NS	h.root-servers.net.
.			517818	IN	NS	c.root-servers.net.
.			517818	IN	NS	m.root-servers.net.
.			517818	IN	NS	b.root-servers.net.
.			517818	IN	NS	f.root-servers.net.
.			517818	IN	NS	d.root-servers.net.
.			517818	IN	NS	e.root-servers.net.
;; Received 239 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

net.			172800	IN	NS	a.gtld-servers.net.
net.			172800	IN	NS	b.gtld-servers.net.
net.			172800	IN	NS	c.gtld-servers.net.
net.			172800	IN	NS	d.gtld-servers.net.
net.			172800	IN	NS	e.gtld-servers.net.
net.			172800	IN	NS	f.gtld-servers.net.
net.			172800	IN	NS	g.gtld-servers.net.
net.			172800	IN	NS	h.gtld-servers.net.
net.			172800	IN	NS	i.gtld-servers.net.
net.			172800	IN	NS	j.gtld-servers.net.
net.			172800	IN	NS	k.gtld-servers.net.
net.			172800	IN	NS	l.gtld-servers.net.
net.			172800	IN	NS	m.gtld-servers.net.
;; Received 825 bytes from 198.97.190.53#53(h.root-servers.net) in 133 ms

gtld-servers.net.	172800	IN	NS	av1.nstld.com.
gtld-servers.net.	172800	IN	NS	av2.nstld.com.
gtld-servers.net.	172800	IN	NS	av3.nstld.com.
gtld-servers.net.	172800	IN	NS	av4.nstld.com.
;; Received 302 bytes from 192.43.172.30#53(i.gtld-servers.net) in 203 ms

gtld-servers.net.	86400	IN	SOA	av4.nstld.com. nstld.verisign-grs.com. 2017061500 3600 900 1209600 86400
;; Received 113 bytes from 192.42.178.30#53(av2.nstld.com) in 66 ms
      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        @emirefek said in I need HELP on DNS RESOLVER!:

        ;; connection timed out; no servers could be reached

        You are NOT talking to roots... When you ask for

        dig cs71.wac.edgecastcdn.net +trace +nodnssec

        Sniff on your WAN when you do that command... What do you see? You should be able to watch the whole process where does it fail?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        E 1 Reply Last reply Reply Quote 0
        • E
          emirefek @johnpoz
          last edited by

          @johnpoz Am I need to sniff from unbound logs ?

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            just do a packet capture on the wan for port 53... So you can see exactly what is being asked for and what your getting back

            Flush unbound cache first

            What does your unbound cache show for it?

            [2.4.3-RELEASE][root@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf lookup cs71.wac.edgecastcdn.net
The following name servers are used for lookup of cs71.wac.edgecastcdn.net.
;rrset 3119 4 0 7 3
edgecastcdn.net.        3119    IN      NS      ns1.edgecastcdn.net.
edgecastcdn.net.        3119    IN      NS      ns2.edgecastcdn.net.
edgecastcdn.net.        3119    IN      NS      ns3.edgecastcdn.net.
edgecastcdn.net.        3119    IN      NS      ns4.edgecastcdn.net.
;rrset 3119 1 0 3 3
ns4.edgecastcdn.net.    3119    IN      A       192.229.254.6
;rrset 3119 1 0 3 3
ns4.edgecastcdn.net.    3119    IN      AAAA    2606:2800:e::6
;rrset 3119 1 0 3 3
ns3.edgecastcdn.net.    3119    IN      A       192.229.254.5
;rrset 3119 1 0 3 3
ns3.edgecastcdn.net.    3119    IN      AAAA    2606:2800:e::5
;rrset 85919 1 0 8 3
ns2.edgecastcdn.net.    172319  IN      A       72.21.80.6
;rrset 85919 1 0 8 3
ns2.edgecastcdn.net.    172319  IN      AAAA    2606:2800:1::6
;rrset 85919 1 0 8 3
ns1.edgecastcdn.net.    172319  IN      A       72.21.80.5
;rrset 85919 1 0 8 3
ns1.edgecastcdn.net.    172319  IN      AAAA    2606:2800:1::5
Delegation with 4 names, of which 0 can be examined to query further addresses.
It provides 8 IP addresses.
2606:2800:1::5          not in infra cache.
72.21.80.5              not in infra cache.
2606:2800:1::6          rto 376 msec, ttl 419, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
72.21.80.6              rto 238 msec, ttl 419, ping 2 var 59 rtt 238, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2606:2800:e::5          not in infra cache.
192.229.254.5           rto 297 msec, ttl 419, ping 1 var 74 rtt 297, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2606:2800:e::6          rto 376 msec, ttl 419, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
192.229.254.6           rto 306 msec, ttl 419, ping 2 var 76 rtt 306, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
[2.4.3-RELEASE][root@sg4860.local.lan]/root:

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • E
              emirefek
              last edited by emirefek

              @johnpoz said in I need HELP on DNS RESOLVER!:

              dig cs71.wac.edgecastcdn.net +trace +nodnssec

              After start catching I typed this command to pfsense:

              dig cs71.wac.edgecastcdn.net +trace +nodnssec

              Here output from packet capture at 53 port

              22:53:30.024208 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
22:53:31.030351 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
22:53:32.040306 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
22:53:33.050299 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
22:53:37.090317 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
22:53:38.100289 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
22:53:40.160315 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
22:53:43.240948 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
22:53:44.253515 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
22:53:48.304619 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
22:53:51.360307 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
22:53:52.379843 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
22:53:53.389741 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65
22:54:00.450247 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
22:54:01.460281 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
22:54:02.469596 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
22:54:03.480236 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
22:54:07.540247 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
22:54:08.583342 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
22:54:10.600242 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
22:54:13.640244 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
22:54:14.650266 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
22:54:18.690232 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
22:54:21.740238 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
22:54:22.772875 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
22:54:23.779625 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65
22:54:30.812783 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
22:54:31.819612 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
22:54:32.830242 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
22:54:33.856594 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
22:54:37.899669 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
22:54:38.910250 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
22:54:40.949745 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
22:54:44.000233 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
22:54:45.010274 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
22:54:46.708756 IP 88.247.225.172.static.ttnet.com.tr.7485 > m.gtld-servers.net.domain: UDP, length 44
22:54:46.771932 IP m.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.7485: UDP, length 782
22:54:46.772270 IP 88.247.225.172.static.ttnet.com.tr.59069 > ns2.msft.net.domain: UDP, length 44
22:54:46.827447 IP ns2.msft.net.domain > 88.247.225.172.static.ttnet.com.tr.59069: UDP, length 82
22:54:46.827814 IP 88.247.225.172.static.ttnet.com.tr.18069 > l.gtld-servers.net.domain: UDP, length 56
22:54:46.864979 IP 88.247.225.172.static.ttnet.com.tr.25085 > f.gtld-servers.net.domain: UDP, length 56
22:54:46.894347 IP l.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.18069: UDP, length 1106
22:54:46.894691 IP 88.247.225.172.static.ttnet.com.tr.9268 > a1-66.akam.net.domain: UDP, length 56
22:54:47.030650 IP a1-66.akam.net.domain > 88.247.225.172.static.ttnet.com.tr.9268: UDP, length 92
22:54:47.031049 IP 88.247.225.172.static.ttnet.com.tr.58962 > j.gtld-servers.net.domain: UDP, length 54
22:54:47.064947 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.25085: UDP, length 1106
22:54:47.065230 IP 88.247.225.172.static.ttnet.com.tr.12213 > use3.akam.net.domain: UDP, length 56
22:54:47.132643 IP use3.akam.net.domain > 88.247.225.172.static.ttnet.com.tr.12213: UDP, length 92
22:54:47.132882 IP 88.247.225.172.static.ttnet.com.tr.51526 > f.gtld-servers.net.domain: UDP, length 54
22:54:47.153901 IP j.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.58962: UDP, length 1048
22:54:47.154148 IP 88.247.225.172.static.ttnet.com.tr.4808 > a2-16-40-192.deploy.static.akamaitechnologies.com.domain: UDP, length 54
22:54:47.338473 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.51526: UDP, length 1048
22:54:47.338984 IP 88.247.225.172.static.ttnet.com.tr.51939 > a95-101-36-192.deploy.static.akamaitechnologies.com.domain: UDP, length 54
22:54:47.347453 IP a2-16-40-192.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.4808: UDP, length 378
22:54:47.347714 IP 88.247.225.172.static.ttnet.com.tr.13784 > a2-16-187-47.deploy.static.akamaitechnologies.com.domain: UDP, length 54
22:54:47.397160 IP a95-101-36-192.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.51939: UDP, length 378
22:54:47.397407 IP 88.247.225.172.static.ttnet.com.tr.14635 > a2-16-187-63.deploy.static.akamaitechnologies.com.domain: UDP, length 54
22:54:47.418622 IP a2-16-187-47.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.13784: UDP, length 70
22:54:47.463365 IP a2-16-187-63.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.14635: UDP, length 70
22:54:49.092864 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
22:54:52.120242 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
22:54:53.130227 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
22:54:54.189718 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65

              edit: ttnet.com.tr is my ISP.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                post up the pcap of that.. So can make heads or tales of it..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                E 1 Reply Last reply Reply Quote 0
                • E
                  emirefek @johnpoz
                  last edited by

                  @johnpoz I posted this is packet capture ? you need without reverse dns?

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    NO you did not.. Download the capture and attach the pcap... All you can see there is the dest and source IPs... You can not SEE what was asked and what was returned.. I want the actual pcap so I can load it into wireshark and view what is going on. Also make sure you bump up the 100 packet limit since seems you have other dns queries going on there.

                    Also what does the cache show you for unbound... See my other command I posted.

                    47.338473 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.51526: UDP, length 1048

                    Here one of the gtld servers answered you - what did he say? If had the pcap could load into wireshark and SEE exactly what was returned.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    E 1 Reply Last reply Reply Quote 0
                    • E
                      emirefek @johnpoz
                      last edited by emirefek

                      @johnpoz Sorry I wasnt know that here it is my .cap file [DELETED FILE]

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        Ok WTF look at this... your asking averyone and their browser for this - and no response!!!

                        0_1536956060033_query.png

                        Why are you sending queries to ALL these IPs Notse are not the IPs for NS for that domain..

                        But you do get a response looking up synology something.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        E 1 Reply Last reply Reply Quote 0
                        • E
                          emirefek @johnpoz
                          last edited by emirefek

                          @johnpoz Synology is NAS brand my nas is checking something randomly. Wrong time wrong place ?

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            So your asking Roots - and NOT getting any answers... I looked up the first 2 there those are root servers... So where are you answers??

                            Ask roots for that A record you should get back the NS for .net

                            C:\>dig @a.root-servers.net cs71.wac.edgecastcdn.net

; <<>> DiG 9.12.2-P1 <<>> @a.root-servers.net cs71.wac.edgecastcdn.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32949
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;cs71.wac.edgecastcdn.net.      IN      A

;; AUTHORITY SECTION:
net.                    172800  IN      NS      e.gtld-servers.net.
net.                    172800  IN      NS      f.gtld-servers.net.
net.                    172800  IN      NS      m.gtld-servers.net.
net.                    172800  IN      NS      i.gtld-servers.net.
net.                    172800  IN      NS      j.gtld-servers.net.
net.                    172800  IN      NS      b.gtld-servers.net.
net.                    172800  IN      NS      a.gtld-servers.net.
net.                    172800  IN      NS      c.gtld-servers.net.
net.                    172800  IN      NS      k.gtld-servers.net.
net.                    172800  IN      NS      h.gtld-servers.net.
net.                    172800  IN      NS      l.gtld-servers.net.
net.                    172800  IN      NS      g.gtld-servers.net.
net.                    172800  IN      NS      d.gtld-servers.net.

;; ADDITIONAL SECTION:
e.gtld-servers.net.     172800  IN      A       192.12.94.30
e.gtld-servers.net.     172800  IN      AAAA    2001:502:1ca1::30
f.gtld-servers.net.     172800  IN      A       192.35.51.30
f.gtld-servers.net.     172800  IN      AAAA    2001:503:d414::30
m.gtld-servers.net.     172800  IN      A       192.55.83.30
m.gtld-servers.net.     172800  IN      AAAA    2001:501:b1f9::30
i.gtld-servers.net.     172800  IN      A       192.43.172.30
i.gtld-servers.net.     172800  IN      AAAA    2001:503:39c1::30
j.gtld-servers.net.     172800  IN      A       192.48.79.30
j.gtld-servers.net.     172800  IN      AAAA    2001:502:7094::30
b.gtld-servers.net.     172800  IN      A       192.33.14.30
b.gtld-servers.net.     172800  IN      AAAA    2001:503:231d::2:30
a.gtld-servers.net.     172800  IN      A       192.5.6.30
a.gtld-servers.net.     172800  IN      AAAA    2001:503:a83e::2:30
c.gtld-servers.net.     172800  IN      A       192.26.92.30
c.gtld-servers.net.     172800  IN      AAAA    2001:503:83eb::30
k.gtld-servers.net.     172800  IN      A       192.52.178.30
k.gtld-servers.net.     172800  IN      AAAA    2001:503:d2d::30
h.gtld-servers.net.     172800  IN      A       192.54.112.30
h.gtld-servers.net.     172800  IN      AAAA    2001:502:8cc::30
l.gtld-servers.net.     172800  IN      A       192.41.162.30
l.gtld-servers.net.     172800  IN      AAAA    2001:500:d937::30
g.gtld-servers.net.     172800  IN      A       192.42.93.30
g.gtld-servers.net.     172800  IN      AAAA    2001:503:eea3::30
d.gtld-servers.net.     172800  IN      A       192.31.80.30
d.gtld-servers.net.     172800  IN      AAAA    2001:500:856e::30

;; Query time: 31 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Fri Sep 14 15:20:00 Central Daylight Time 2018
;; MSG SIZE  rcvd: 846

                            Your just asking and asking and asking and not getting back anything... Why? That will explain why you can not resolve for sure.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            E 1 Reply Last reply Reply Quote 0
                            • E
                              emirefek @johnpoz
                              last edited by emirefek

                              @johnpoz I did packet capture again. And these are results. 0_1536956837326_packetcapture (3).zip

                              I execute ""dig @a.root-servers.net cs71.wac.edgecastcdn.net"" this command on pfsense cmndprmpt

                              edit:which program using for looking cap files ?(ok I installed wireshark)

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @emirefek
                                last edited by

                                @emirefek

                                Sorry i went for beers wont be able to view til get home did u get anwser?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                E 1 Reply Last reply Reply Quote 0
                                • E
                                  emirefek @johnpoz
                                  last edited by

                                  @johnpoz No problem mate. Thanks for all of these responses. Take "Efe's" if avalible.

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    So same thing dude your asking

                                    0_1537015197873_noresponse.png

                                    But you get NO response?? Something upstream of you filtering dns? There should be no reason that I can think of why if you ask a root server your not getting a response. You can see other queries there where you ask root and get answers..

                                    This is what should look like - you ask, and get answer of all the NS for .net
                                    0_1537015893956_answer.png

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    E 1 Reply Last reply Reply Quote 0
                                    • E
                                      emirefek @johnpoz
                                      last edited by

                                      @johnpoz I dont know why. Im on my home know There isnt any linux with me now. In my house Im using diffrent ISP. How can I check response on windows devices ?

                                      64.53.public is a dns fake root ? Am I understand right.

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        198.41.0.4 is root - I just edit in wireshark what my public IP resolves too ;) Not a fan of posting my public IP on forums - especially when I have ticked off a few people here that might do something with that info - hehehe

                                        You can install dig on your windows machine.. Just download bind from iSC and say install tools only... I run dig on windows all the time..

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        GertjanG 1 Reply Last reply Reply Quote 0
                                        • GertjanG
                                          Gertjan @johnpoz
                                          last edited by

                                          @johnpoz said in I need HELP on DNS RESOLVER!:

                                          I run dig on windows all the time..

                                          I should have known this one human life before. Nuking nslookup from orbit right now.
                                          Thanks.

                                          No "help me" PM's please. Use the forum, the community will thank you.
                                          Edit : and where are the logs ??

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            hehhe - nslookup is a joke of a tool compared to dig..

                                            edit: BTW - newer versions you might have to set resolv.conf pointing to your nameserver in the etc folder it creates if don't want to have to use @ namserver in the cmdline all the time... Unless they fixed that? I think starting with 9.12 it was failing to pull NS from the OS..

                                            let me check

                                            yeah - if you don't have a resolv.conf file in the etc folder dig 9.12.2-p1 atleast does not pull NS its suppose to use..

                                            So create a resolv.conf and put in
                                            namserver ipaddress

                                            That you want to use with dig so you don't have to always call it out.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                            E 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.