I need HELP on DNS RESOLVER!
-
@johnpoz Am I need to sniff from unbound logs ?
-
just do a packet capture on the wan for port 53... So you can see exactly what is being asked for and what your getting back
Flush unbound cache first
What does your unbound cache show for it?
[2.4.3-RELEASE][root@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf lookup cs71.wac.edgecastcdn.net The following name servers are used for lookup of cs71.wac.edgecastcdn.net. ;rrset 3119 4 0 7 3 edgecastcdn.net. 3119 IN NS ns1.edgecastcdn.net. edgecastcdn.net. 3119 IN NS ns2.edgecastcdn.net. edgecastcdn.net. 3119 IN NS ns3.edgecastcdn.net. edgecastcdn.net. 3119 IN NS ns4.edgecastcdn.net. ;rrset 3119 1 0 3 3 ns4.edgecastcdn.net. 3119 IN A 192.229.254.6 ;rrset 3119 1 0 3 3 ns4.edgecastcdn.net. 3119 IN AAAA 2606:2800:e::6 ;rrset 3119 1 0 3 3 ns3.edgecastcdn.net. 3119 IN A 192.229.254.5 ;rrset 3119 1 0 3 3 ns3.edgecastcdn.net. 3119 IN AAAA 2606:2800:e::5 ;rrset 85919 1 0 8 3 ns2.edgecastcdn.net. 172319 IN A 72.21.80.6 ;rrset 85919 1 0 8 3 ns2.edgecastcdn.net. 172319 IN AAAA 2606:2800:1::6 ;rrset 85919 1 0 8 3 ns1.edgecastcdn.net. 172319 IN A 72.21.80.5 ;rrset 85919 1 0 8 3 ns1.edgecastcdn.net. 172319 IN AAAA 2606:2800:1::5 Delegation with 4 names, of which 0 can be examined to query further addresses. It provides 8 IP addresses. 2606:2800:1::5 not in infra cache. 72.21.80.5 not in infra cache. 2606:2800:1::6 rto 376 msec, ttl 419, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed. 72.21.80.6 rto 238 msec, ttl 419, ping 2 var 59 rtt 238, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2606:2800:e::5 not in infra cache. 192.229.254.5 rto 297 msec, ttl 419, ping 1 var 74 rtt 297, tA 0, tAAAA 0, tother 0, EDNS 0 probed. 2606:2800:e::6 rto 376 msec, ttl 419, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed. 192.229.254.6 rto 306 msec, ttl 419, ping 2 var 76 rtt 306, tA 0, tAAAA 0, tother 0, EDNS 0 probed. [2.4.3-RELEASE][root@sg4860.local.lan]/root: -
@johnpoz said in I need HELP on DNS RESOLVER!:
dig cs71.wac.edgecastcdn.net +trace +nodnssec
After start catching I typed this command to pfsense:
dig cs71.wac.edgecastcdn.net +trace +nodnssecHere output from packet capture at 53 port
22:53:30.024208 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65 22:53:31.030351 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65 22:53:32.040306 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65 22:53:33.050299 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65 22:53:37.090317 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65 22:53:38.100289 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65 22:53:40.160315 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65 22:53:43.240948 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65 22:53:44.253515 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65 22:53:48.304619 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65 22:53:51.360307 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65 22:53:52.379843 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65 22:53:53.389741 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65 22:54:00.450247 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65 22:54:01.460281 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65 22:54:02.469596 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65 22:54:03.480236 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65 22:54:07.540247 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65 22:54:08.583342 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65 22:54:10.600242 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65 22:54:13.640244 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65 22:54:14.650266 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65 22:54:18.690232 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65 22:54:21.740238 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65 22:54:22.772875 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65 22:54:23.779625 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65 22:54:30.812783 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65 22:54:31.819612 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65 22:54:32.830242 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65 22:54:33.856594 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65 22:54:37.899669 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65 22:54:38.910250 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65 22:54:40.949745 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65 22:54:44.000233 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65 22:54:45.010274 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65 22:54:46.708756 IP 88.247.225.172.static.ttnet.com.tr.7485 > m.gtld-servers.net.domain: UDP, length 44 22:54:46.771932 IP m.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.7485: UDP, length 782 22:54:46.772270 IP 88.247.225.172.static.ttnet.com.tr.59069 > ns2.msft.net.domain: UDP, length 44 22:54:46.827447 IP ns2.msft.net.domain > 88.247.225.172.static.ttnet.com.tr.59069: UDP, length 82 22:54:46.827814 IP 88.247.225.172.static.ttnet.com.tr.18069 > l.gtld-servers.net.domain: UDP, length 56 22:54:46.864979 IP 88.247.225.172.static.ttnet.com.tr.25085 > f.gtld-servers.net.domain: UDP, length 56 22:54:46.894347 IP l.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.18069: UDP, length 1106 22:54:46.894691 IP 88.247.225.172.static.ttnet.com.tr.9268 > a1-66.akam.net.domain: UDP, length 56 22:54:47.030650 IP a1-66.akam.net.domain > 88.247.225.172.static.ttnet.com.tr.9268: UDP, length 92 22:54:47.031049 IP 88.247.225.172.static.ttnet.com.tr.58962 > j.gtld-servers.net.domain: UDP, length 54 22:54:47.064947 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.25085: UDP, length 1106 22:54:47.065230 IP 88.247.225.172.static.ttnet.com.tr.12213 > use3.akam.net.domain: UDP, length 56 22:54:47.132643 IP use3.akam.net.domain > 88.247.225.172.static.ttnet.com.tr.12213: UDP, length 92 22:54:47.132882 IP 88.247.225.172.static.ttnet.com.tr.51526 > f.gtld-servers.net.domain: UDP, length 54 22:54:47.153901 IP j.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.58962: UDP, length 1048 22:54:47.154148 IP 88.247.225.172.static.ttnet.com.tr.4808 > a2-16-40-192.deploy.static.akamaitechnologies.com.domain: UDP, length 54 22:54:47.338473 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.51526: UDP, length 1048 22:54:47.338984 IP 88.247.225.172.static.ttnet.com.tr.51939 > a95-101-36-192.deploy.static.akamaitechnologies.com.domain: UDP, length 54 22:54:47.347453 IP a2-16-40-192.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.4808: UDP, length 378 22:54:47.347714 IP 88.247.225.172.static.ttnet.com.tr.13784 > a2-16-187-47.deploy.static.akamaitechnologies.com.domain: UDP, length 54 22:54:47.397160 IP a95-101-36-192.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.51939: UDP, length 378 22:54:47.397407 IP 88.247.225.172.static.ttnet.com.tr.14635 > a2-16-187-63.deploy.static.akamaitechnologies.com.domain: UDP, length 54 22:54:47.418622 IP a2-16-187-47.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.13784: UDP, length 70 22:54:47.463365 IP a2-16-187-63.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.14635: UDP, length 70 22:54:49.092864 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65 22:54:52.120242 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65 22:54:53.130227 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65 22:54:54.189718 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65edit: ttnet.com.tr is my ISP.
-
post up the pcap of that.. So can make heads or tales of it..
-
@johnpoz I posted this is packet capture ? you need without reverse dns?
-
NO you did not.. Download the capture and attach the pcap... All you can see there is the dest and source IPs... You can not SEE what was asked and what was returned.. I want the actual pcap so I can load it into wireshark and view what is going on. Also make sure you bump up the 100 packet limit since seems you have other dns queries going on there.
Also what does the cache show you for unbound... See my other command I posted.
47.338473 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.51526: UDP, length 1048
Here one of the gtld servers answered you - what did he say? If had the pcap could load into wireshark and SEE exactly what was returned.
-
@johnpoz Sorry I wasnt know that here it is my .cap file [DELETED FILE]
-
Ok WTF look at this... your asking averyone and their browser for this - and no response!!!
Why are you sending queries to ALL these IPs Notse are not the IPs for NS for that domain..
But you do get a response looking up synology something.
-
@johnpoz Synology is NAS brand my nas is checking something randomly. Wrong time wrong place ?
-
So your asking Roots - and NOT getting any answers... I looked up the first 2 there those are root servers... So where are you answers??
Ask roots for that A record you should get back the NS for .net
C:\>dig @a.root-servers.net cs71.wac.edgecastcdn.net ; <<>> DiG 9.12.2-P1 <<>> @a.root-servers.net cs71.wac.edgecastcdn.net ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32949 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;cs71.wac.edgecastcdn.net. IN A ;; AUTHORITY SECTION: net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. ;; ADDITIONAL SECTION: e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 a.gtld-servers.net. 172800 IN A 192.5.6.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 k.gtld-servers.net. 172800 IN A 192.52.178.30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 d.gtld-servers.net. 172800 IN A 192.31.80.30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 ;; Query time: 31 msec ;; SERVER: 198.41.0.4#53(198.41.0.4) ;; WHEN: Fri Sep 14 15:20:00 Central Daylight Time 2018 ;; MSG SIZE rcvd: 846Your just asking and asking and asking and not getting back anything... Why? That will explain why you can not resolve for sure.
-
@johnpoz I did packet capture again. And these are results. 0_1536956837326_packetcapture (3).zip
I execute ""dig @a.root-servers.net cs71.wac.edgecastcdn.net"" this command on pfsense cmndprmpt
edit:which program using for looking cap files ?(ok I installed wireshark)
-
Sorry i went for beers wont be able to view til get home did u get anwser?
-
@johnpoz No problem mate. Thanks for all of these responses. Take "Efe's" if avalible.
-
So same thing dude your asking
But you get NO response?? Something upstream of you filtering dns? There should be no reason that I can think of why if you ask a root server your not getting a response. You can see other queries there where you ask root and get answers..
This is what should look like - you ask, and get answer of all the NS for .net
-
@johnpoz I dont know why. Im on my home know There isnt any linux with me now. In my house Im using diffrent ISP. How can I check response on windows devices ?
64.53.public is a dns fake root ? Am I understand right.
-
198.41.0.4 is root - I just edit in wireshark what my public IP resolves too ;) Not a fan of posting my public IP on forums - especially when I have ticked off a few people here that might do something with that info - hehehe
You can install dig on your windows machine.. Just download bind from iSC and say install tools only... I run dig on windows all the time..
-
@johnpoz said in I need HELP on DNS RESOLVER!:
I run dig on windows all the time..
I should have known this one human life before. Nuking nslookup from orbit right now.
Thanks. -
hehhe - nslookup is a joke of a tool compared to dig..
edit: BTW - newer versions you might have to set resolv.conf pointing to your nameserver in the etc folder it creates if don't want to have to use @ namserver in the cmdline all the time... Unless they fixed that? I think starting with 9.12 it was failing to pull NS from the OS..
let me check
yeah - if you don't have a resolv.conf file in the etc folder dig 9.12.2-p1 atleast does not pull NS its suppose to use..
So create a resolv.conf and put in
namserver ipaddressThat you want to use with dig so you don't have to always call it out.
-
@johnpoz I dont understand how to install that any tutorial ?
-
Run the install - pick tools only..
The only issues is if you don't want to have to tell dig which NS to use every time you run it - then you need to create a resolv.conf file in the etc folder it creates when you install it..
Put in nameserver you want it to use.. then when you run dig it will default to using that ns..
