DNS Resolver Status, no data?
-
@johnpoz said in DNS Resolver Status, no data?:
I cleared the cache and then used the same nslookup session I had going to 10.10.4.1 to resolve www.whatever.com
[2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf flush_infra all ok [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra [2.4.4-RELEASE][admin@pfsense.???.local]/root: unbound-control -c /var/unbound/unbound.conf dump_infra 192.203.230.10 . ttl 896 ping 1 var 74 rtt 297 rto 297 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 192.112.36.4 . ttl 896 ping 4 var 79 rtt 320 rto 320 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 198.57.151.238 whatever.com. ttl 896 ping 21 var 73 rtt 313 rto 313 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 193.0.14.129 . ttl 896 ping 15 var 66 rtt 279 rto 279 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 199.9.14.201 . ttl 896 ping 9 var 89 rtt 365 rto 365 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 192.52.178.30 com. ttl 896 ping 3 var 77 rtt 311 rto 311 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 192.36.148.17 . ttl 896 ping 3 var 78 rtt 315 rto 315 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 192.58.128.30 . ttl 896 ping 27 var 124 rtt 523 rto 523 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 -
@jimp, any insight into what's going on here?
-
We just show what unbound dumps out. If it's empty, then it's empty in unbound. That could be for any number of reasons, all up to unbound. If you have something like pfBlockerNG and DNSBL active that could contribute to any differences you see. Also keep in mind if you have DHCP registration active for the DNS resolver, unbound will restart for each lease change that triggers a hostname update.
-
This post is deleted! -
Well that output looks normal... That is your infra cache for that domain, in what would be used to look it up... So you should see the full cache output in the gui then.
As jimp stated all that gui is showing you is the output of the command dump_infra
-
Yes, I get that. What I don't get is how this list is empty, then 5 minute later it's full, then 5 minutes later it's empty. Does it really flush that frequently?
-
When you talk to the roots in resolver mode there isn't much reason to keep around data for dozens of authoritative servers you may not talk to again for who knows how long.
If you have the DNS Resolver in forwarding mode, it will show your forwarders there for much longer.
But again, unbound could be clearing that for any other reason, like a restart
-
The infra cache entries should stay their for the length of the ttl..
Yeah if your unbound is restarting then the cache is going to be dumped.
If you have it registering dhcp leases and you have lots of clients getting leases all the time then yeah it could be restarting every few minutes. Which makes the cache pretty useless to be honest ;)
-
I've already checked that Unbound is not restarting frequently. In fact, it hasn't restarted since its last boot 49 days ago in late January.
-
Well something is dumping the infra cache then.. You have any crons setup? Do you have pfblocker installed?
If unbound is up and running and being asked there would always be plenty of info in that cache.. Hmmm did you mess with the number of entries int he advanced tab?
Did you change the
TTL for Host Cache Entries
Setting from its default 15 min to say 1 min or something? -
@kom said in DNS Resolver Status, no data?:
I've already checked that Unbound is not restarting frequently. In fact, it hasn't restarted since its last boot 49 days ago in late January.
Sometimes (after reboot or WAN toggle) Unbound doesn't log anything to Status / System Logs / System / DNS Resolver.
Restarting Unbound from Status / Services tab will get it to log.
-
Right, I odn't have time to chase this anymore. I put Resolver into forwarding mode and that's that.
-
You weren't doing dnssec anyway so doesn't matter. Can not 2 secons to look to see if you this setup you got from 4 years ago didn't adjust the infra ttl to 1 minute..
-
TTL for Host Cache Entries was set to 15 minutes. I definitely haven't touched that one. Wasn't even aware of it. It's entirely possible, and likely, that I was underestimating the time before the flush.
-
That is not a flush, that is the max time a TTL can be set before it will timeout, etc. That is not a dump of the cache.
Let me state this again... If your resolve was working the info in the infra cache is beyond noise to someone that doesn't understand what any of it means.
You have no need to look down that rabbit hole if your not trying to troubleshoot a specific issue... Was resolver working? How many queries does it get in normally, if yours has been up for 49 days and your total number of queries was
total.num.queries=7233
Nobody is even asking pfsense anything...
Here I restarted unbound what yesterday and have
total.num.queries=19015
total.num.queries_ip_ratelimited=0
total.num.cachehits=16215
total.num.cachemiss=2800And I only have a couple of boxes on my home network... As I brought up before you have pretty much everything using your proxy and or AD dns.. So what your doing on pfsense prob has zero to do with anything. You should prob turn it off and see who complains, since your having pfsense ask your AD for its own dns anyway. And from the entries you did have in your cache couldn't even talk to outside dns.
BTW: I have been doing dns for years and years, for some very large networks.. And also its just hobby of mine I love the way it works and how it does what it does so fast and efficient.. And I can tell you have never had need to look into such info.. Can not recall when I ever dumped the infra cache other to see if there there were huge amounts of timeouts and such.. Even if you manage dns for a huge network, you most likely would never have need to view that info like that... You might use the lookup command we did to see what your resolver is using.. But raw full dump of the infra - no its eye candy in the menu to impress new users that don't really understand dns anyway ;) My take on why they put it in..
If they wanted to put up some useful/interesting eyecandy they would do like the total number of queries, percent cache hit,
This info would be more interesting that the raw infra_dump
num.query.type.A=7801
num.query.type.SOA=15
num.query.type.PTR=9895
num.query.type.TXT=21
num.query.type.AAAA=1388
num.query.type.SRV=246
num.query.class.IN=19366num.answer.rcode.NXDOMAIN=10067
That NXdomain means something is asking quite a bit actual for something that doesn't exist and gets returned NX.. So should prob look into that..
edit: Ok found it ;)
Mar 14 13:40:56 unbound 5708:1 info: 10.0.8.3 HNA00050.snipped.internal.com. A IN NXDOMAIN 0.000000 1 121Had unbound log queries and replies.. My shitty ass work laptop connected to my vpn to home is bombing nonsense down to my pfsense dns ;)
Just noise.. But should prob spend some time making sure my work laptop doesn't do that...
edit: Ok that corrected, simple acl to deny nonlocal from my laptops vpn IP... That way doesn't keep telling my Laptop NX for stuff it should be able to lookup from the local dns..
-
Hi,
This is probably normal when using TLS over DNS? :)
-
@ciscox That's what I see when I use the Resolver as Forwarder.
-
This post is deleted!
