DNS Resolver Status, no data?
-
When you talk to the roots in resolver mode there isn't much reason to keep around data for dozens of authoritative servers you may not talk to again for who knows how long.
If you have the DNS Resolver in forwarding mode, it will show your forwarders there for much longer.
But again, unbound could be clearing that for any other reason, like a restart
-
The infra cache entries should stay their for the length of the ttl..
Yeah if your unbound is restarting then the cache is going to be dumped.
If you have it registering dhcp leases and you have lots of clients getting leases all the time then yeah it could be restarting every few minutes. Which makes the cache pretty useless to be honest ;)
-
I've already checked that Unbound is not restarting frequently. In fact, it hasn't restarted since its last boot 49 days ago in late January.
-
Well something is dumping the infra cache then.. You have any crons setup? Do you have pfblocker installed?
If unbound is up and running and being asked there would always be plenty of info in that cache.. Hmmm did you mess with the number of entries int he advanced tab?
Did you change the
TTL for Host Cache Entries
Setting from its default 15 min to say 1 min or something? -
@kom said in DNS Resolver Status, no data?:
I've already checked that Unbound is not restarting frequently. In fact, it hasn't restarted since its last boot 49 days ago in late January.
Sometimes (after reboot or WAN toggle) Unbound doesn't log anything to Status / System Logs / System / DNS Resolver.
Restarting Unbound from Status / Services tab will get it to log.
-
Right, I odn't have time to chase this anymore. I put Resolver into forwarding mode and that's that.
-
You weren't doing dnssec anyway so doesn't matter. Can not 2 secons to look to see if you this setup you got from 4 years ago didn't adjust the infra ttl to 1 minute..
-
TTL for Host Cache Entries was set to 15 minutes. I definitely haven't touched that one. Wasn't even aware of it. It's entirely possible, and likely, that I was underestimating the time before the flush.
-
That is not a flush, that is the max time a TTL can be set before it will timeout, etc. That is not a dump of the cache.
Let me state this again... If your resolve was working the info in the infra cache is beyond noise to someone that doesn't understand what any of it means.
You have no need to look down that rabbit hole if your not trying to troubleshoot a specific issue... Was resolver working? How many queries does it get in normally, if yours has been up for 49 days and your total number of queries was
total.num.queries=7233
Nobody is even asking pfsense anything...
Here I restarted unbound what yesterday and have
total.num.queries=19015
total.num.queries_ip_ratelimited=0
total.num.cachehits=16215
total.num.cachemiss=2800And I only have a couple of boxes on my home network... As I brought up before you have pretty much everything using your proxy and or AD dns.. So what your doing on pfsense prob has zero to do with anything. You should prob turn it off and see who complains, since your having pfsense ask your AD for its own dns anyway. And from the entries you did have in your cache couldn't even talk to outside dns.
BTW: I have been doing dns for years and years, for some very large networks.. And also its just hobby of mine I love the way it works and how it does what it does so fast and efficient.. And I can tell you have never had need to look into such info.. Can not recall when I ever dumped the infra cache other to see if there there were huge amounts of timeouts and such.. Even if you manage dns for a huge network, you most likely would never have need to view that info like that... You might use the lookup command we did to see what your resolver is using.. But raw full dump of the infra - no its eye candy in the menu to impress new users that don't really understand dns anyway ;) My take on why they put it in..
If they wanted to put up some useful/interesting eyecandy they would do like the total number of queries, percent cache hit,
This info would be more interesting that the raw infra_dump
num.query.type.A=7801
num.query.type.SOA=15
num.query.type.PTR=9895
num.query.type.TXT=21
num.query.type.AAAA=1388
num.query.type.SRV=246
num.query.class.IN=19366num.answer.rcode.NXDOMAIN=10067
That NXdomain means something is asking quite a bit actual for something that doesn't exist and gets returned NX.. So should prob look into that..
edit: Ok found it ;)
Mar 14 13:40:56 unbound 5708:1 info: 10.0.8.3 HNA00050.snipped.internal.com. A IN NXDOMAIN 0.000000 1 121Had unbound log queries and replies.. My shitty ass work laptop connected to my vpn to home is bombing nonsense down to my pfsense dns ;)
Just noise.. But should prob spend some time making sure my work laptop doesn't do that...
edit: Ok that corrected, simple acl to deny nonlocal from my laptops vpn IP... That way doesn't keep telling my Laptop NX for stuff it should be able to lookup from the local dns..
-
Hi,
This is probably normal when using TLS over DNS? :)
-
@ciscox That's what I see when I use the Resolver as Forwarder.
-
This post is deleted!
