Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    I need HELP on DNS RESOLVER!

    Scheduled Pinned Locked Moved DHCP and DNS
    78 Posts 6 Posters 14.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      emirefek
      last edited by emirefek

      @johnpoz said in I need HELP on DNS RESOLVER!:

      @m.root-servers.net net NS

      This output from my pfsense box. But I cannot talk it from my centos server and Im sure my centos dns settings are pointing my pfsense box.

      dig @m.root-servers.net net NS

      ; <<>> DiG 9.11.2-P1 <<>> @m.root-servers.net net NS
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10472
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;net.				IN	NS

;; AUTHORITY SECTION:
net.			172800	IN	NS	l.gtld-servers.net.
net.			172800	IN	NS	b.gtld-servers.net.
net.			172800	IN	NS	h.gtld-servers.net.
net.			172800	IN	NS	i.gtld-servers.net.
net.			172800	IN	NS	d.gtld-servers.net.
net.			172800	IN	NS	e.gtld-servers.net.
net.			172800	IN	NS	f.gtld-servers.net.
net.			172800	IN	NS	a.gtld-servers.net.
net.			172800	IN	NS	m.gtld-servers.net.
net.			172800	IN	NS	c.gtld-servers.net.
net.			172800	IN	NS	k.gtld-servers.net.
net.			172800	IN	NS	j.gtld-servers.net.
net.			172800	IN	NS	g.gtld-servers.net.

;; ADDITIONAL SECTION:
a.gtld-servers.net.	172800	IN	A	192.5.6.30
b.gtld-servers.net.	172800	IN	A	192.33.14.30
c.gtld-servers.net.	172800	IN	A	192.26.92.30
d.gtld-servers.net.	172800	IN	A	192.31.80.30
e.gtld-servers.net.	172800	IN	A	192.12.94.30
f.gtld-servers.net.	172800	IN	A	192.35.51.30
g.gtld-servers.net.	172800	IN	A	192.42.93.30
h.gtld-servers.net.	172800	IN	A	192.54.112.30
i.gtld-servers.net.	172800	IN	A	192.43.172.30
j.gtld-servers.net.	172800	IN	A	192.48.79.30
k.gtld-servers.net.	172800	IN	A	192.52.178.30
l.gtld-servers.net.	172800	IN	A	192.41.162.30
m.gtld-servers.net.	172800	IN	A	192.55.83.30
a.gtld-servers.net.	172800	IN	AAAA	2001:503:a83e::2:30
b.gtld-servers.net.	172800	IN	AAAA	2001:503:231d::2:30
c.gtld-servers.net.	172800	IN	AAAA	2001:503:83eb::30
d.gtld-servers.net.	172800	IN	AAAA	2001:500:856e::30
e.gtld-servers.net.	172800	IN	AAAA	2001:502:1ca1::30
f.gtld-servers.net.	172800	IN	AAAA	2001:503:d414::30
g.gtld-servers.net.	172800	IN	AAAA	2001:503:eea3::30
h.gtld-servers.net.	172800	IN	AAAA	2001:502:8cc::30
i.gtld-servers.net.	172800	IN	AAAA	2001:503:39c1::30
j.gtld-servers.net.	172800	IN	AAAA	2001:502:7094::30
k.gtld-servers.net.	172800	IN	AAAA	2001:503:d2d::30
l.gtld-servers.net.	172800	IN	AAAA	2001:500:d937::30
m.gtld-servers.net.	172800	IN	AAAA	2001:501:b1f9::30

;; Query time: 84 msec
;; SERVER: 202.12.27.33#53(202.12.27.33)
;; WHEN: Fri Sep 14 16:06:49 +03 2018
;; MSG SIZE  rcvd: 825

      Output from centos:

      [root@ekcentos ~]# dig @m.root-servers.net net NS

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7_5.1 <<>> @m.root-servers.net net NS
; (2 servers found)
;; global options: +cmd
;; connection timed out; no servers could be reached
[root@ekcentos ~]#

      EDIT:I blocked all other dns servers to LAN side from rules section when I do that centos cannot solve that hostname but when I allow all dns servers to lan side centos can solve this domain too.

      1 Reply Last reply Reply Quote 0
      • nodauN
        nodau
        last edited by

        one question? are you using carp? if so, use the carp vips on dns resolver. for outbound interface you only need localhost.

        Norman

        virtualized pfSense 2.7.2 HA-Cluster on vsphere 8

        E 1 Reply Last reply Reply Quote 0
        • E
          emirefek @nodau
          last edited by

          @bahsig No Im not my setup is very simple. 1 WAN(PPPOE) - and 2 LAN (one of them for WIFIaps)

          I seeted up my box with that tutorial: https://www.youtube.com/watch?v=RrQrt8r_uYg

          And my plugins are pfblocker, snort and squid but I didnt configure it yet.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            So your problem has nothing to do with dns it seems like, but more your dns rules?

            Lets see these rules for your centos box network interface on pfsense..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            E 1 Reply Last reply Reply Quote 0
            • E
              emirefek @johnpoz
              last edited by

              @johnpoz
              here they are I block all other dns servers because of I dont want to clients pass pfblocker with other dns servers.
              0_1536932941642_LANrules.PNG

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan
                last edited by Gertjan

                @emirefek said in I need HELP on DNS RESOLVER!:

                EDIT:I blocked all other dns servers to LAN side from rules section when I do that centos cannot solve that hostname but when I allow all dns servers to lan side centos

                Your DNS ! ONLY ! to pfSEnse rule is UDP only .... 👎

                Read this https://serverfault.com/questions/404840/when-do-dns-queries-use-tcp-instead-of-udp and start slapping yourself.

                Act upon this information (and also activate DNSSEC, it will work this time ^^).

                edit : https://en.wikipedia.org/wiki/Domain_Name_System#Protocol_transport - see "DNS Protocol transport"

                edit : tip : Instead of "192.168.1.1" as a destination address, use "LAN Address". This will protect you for the next pitfall : the day you introduce IPv6.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                E 1 Reply Last reply Reply Quote 0
                • E
                  emirefek @Gertjan
                  last edited by emirefek

                  @gertjan Oh. I change it to TCP/UDP and I can solve it now on centos. And I was enable DNSSEC now and I change To LAN Address on rules section.

                  But I cannot solve damn edgecastcdn.net anyway.

                  [root@ekcentos ~]# dig @e.gtld-servers.net edgecastcdn.net NS

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7_5.1 <<>> @e.gtld-servers.net edgecastcdn.net NS
; (2 servers found)
;; global options: +cmd
;; connection timed out; no servers could be reached
[root@ekcentos ~]# dig @e.gtld-servers.net edgecastcdn.net NS
^C[root@ekcentos ~]# dig @ns1.edgecastcdn.net edgecastcdn.net NS
^C^C^C^Cdig: couldn't get address for 'ns1.edgecastcdn.net': not found
[root@ekcentos ~]#
                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan
                    last edited by

                    @emirefek said in I need HELP on DNS RESOLVER!:

                    ig @ns1.edgecastcdn.net edgecastcdn.net NS

                    Possible that you test also with another PC with some Microsoft OS on your LAN - and then use the 'dig' of Microsoft : nslookup.
                    Just to be sure that your Centos does things as they should.

                    Btw : try also disabling for some time your rule number 3 (the DNS block rule).

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    E 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      your rules are not going to allow centos to query anything other than 192.168.1.1 for dns - sothat dig on centos would never work with that rule in place.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • E
                        emirefek @Gertjan
                        last edited by

                        @gertjan I already disable that rule and mate I cannot resolve this domain on pfsense box too. Its not about rules I think.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          your trace will show you where you have a problem.. A +trace is exactly what resolver does.. It walks down from roots to the authoritative ns for a domain, then queries an authoritative ns for the domain your looking for for the record you seek..

                          If you can not resolve thee ns for edgecastcdn.net then no your never going to be able to resolve a record they are authoritative for

                          Now that you have removed that rule and centos can talk to any dns it wants... Lets see its trace for that record as I posted before.

                          So how that is resolved

                          ; <<>> DiG 9.11.2-P1 <<>> cs71.wac.edgecastcdn.net +trace +nodnssec
;; global options: +cmd
.                       47128   IN      NS      a.root-servers.net.
.                       47128   IN      NS      b.root-servers.net.
.                       47128   IN      NS      c.root-servers.net.
.                       47128   IN      NS      d.root-servers.net.
.                       47128   IN      NS      e.root-servers.net.
.                       47128   IN      NS      f.root-servers.net.
.                       47128   IN      NS      g.root-servers.net.
.                       47128   IN      NS      h.root-servers.net.
.                       47128   IN      NS      i.root-servers.net.
.                       47128   IN      NS      j.root-servers.net.
.                       47128   IN      NS      k.root-servers.net.
.                       47128   IN      NS      l.root-servers.net.
.                       47128   IN      NS      m.root-servers.net.
;; Received 239 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

net.                    172800  IN      NS      a.gtld-servers.net.
net.                    172800  IN      NS      m.gtld-servers.net.
net.                    172800  IN      NS      b.gtld-servers.net.
net.                    172800  IN      NS      c.gtld-servers.net.
net.                    172800  IN      NS      e.gtld-servers.net.
net.                    172800  IN      NS      k.gtld-servers.net.
net.                    172800  IN      NS      i.gtld-servers.net.
net.                    172800  IN      NS      j.gtld-servers.net.
net.                    172800  IN      NS      f.gtld-servers.net.
net.                    172800  IN      NS      h.gtld-servers.net.
net.                    172800  IN      NS      d.gtld-servers.net.
net.                    172800  IN      NS      g.gtld-servers.net.
net.                    172800  IN      NS      l.gtld-servers.net.
;; Received 846 bytes from 192.36.148.17#53(i.root-servers.net) in 35 ms

edgecastcdn.net.        172800  IN      NS      ns1.edgecastcdn.net.
edgecastcdn.net.        172800  IN      NS      ns2.edgecastcdn.net.
;; Received 177 bytes from 192.31.80.30#53(d.gtld-servers.net) in 42 ms

cs71.wac.edgecastcdn.net. 3600  IN      A       72.21.91.97
;; Received 69 bytes from 72.21.80.5#53(ns1.edgecastcdn.net) in 18 ms

                          It asks roots hey roots who is NS for .net domain, hey .net NS who is authoritative for edgecastcdn.net, hey hey ns1.edgecastcdn.net what is the A record for cs71.wac.edgecastcdn.net.

                          You can see that happen in the trace - and exactly what IP got asked..

                          If pfsense can not do that - then you need to figure out why.. You can sniff when you run the command and see exactly what gets asked and what gets returned.. On pfsense wan.. If you send a query and don't get a response then the problem is upstream.. Maybe your ISP dicks with dns queries? Maybe you have a network problem talking to the NSers for edgecastcdn.net? maybe they block your IP, etc. etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          E 1 Reply Last reply Reply Quote 0
                          • E
                            emirefek @johnpoz
                            last edited by

                            @johnpoz this is my output from pfsense but in my results I cannot see gtld-servers.net ?

                            dig cs71.wac.edgecastcdn.net +trace +nodnssec

                            ; <<>> DiG 9.11.2-P1 <<>> cs71.wac.edgecastcdn.net +trace +nodnssec
;; global options: +cmd
.			518275	IN	NS	j.root-servers.net.
.			518275	IN	NS	k.root-servers.net.
.			518275	IN	NS	l.root-servers.net.
.			518275	IN	NS	a.root-servers.net.
.			518275	IN	NS	i.root-servers.net.
.			518275	IN	NS	g.root-servers.net.
.			518275	IN	NS	h.root-servers.net.
.			518275	IN	NS	c.root-servers.net.
.			518275	IN	NS	m.root-servers.net.
.			518275	IN	NS	b.root-servers.net.
.			518275	IN	NS	f.root-servers.net.
.			518275	IN	NS	d.root-servers.net.
.			518275	IN	NS	e.root-servers.net.
;; Received 239 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

;; connection timed out; no servers could be reached

                            after that I try this command but I dont know how dig command work clearly but When ı execute this command I was get these output

                            dig gtld-servers.net +trace +nodnssec

                            ; <<>> DiG 9.11.2-P1 <<>> gtld-servers.net +trace +nodnssec
;; global options: +cmd
.			517818	IN	NS	j.root-servers.net.
.			517818	IN	NS	k.root-servers.net.
.			517818	IN	NS	l.root-servers.net.
.			517818	IN	NS	a.root-servers.net.
.			517818	IN	NS	i.root-servers.net.
.			517818	IN	NS	g.root-servers.net.
.			517818	IN	NS	h.root-servers.net.
.			517818	IN	NS	c.root-servers.net.
.			517818	IN	NS	m.root-servers.net.
.			517818	IN	NS	b.root-servers.net.
.			517818	IN	NS	f.root-servers.net.
.			517818	IN	NS	d.root-servers.net.
.			517818	IN	NS	e.root-servers.net.
;; Received 239 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

net.			172800	IN	NS	a.gtld-servers.net.
net.			172800	IN	NS	b.gtld-servers.net.
net.			172800	IN	NS	c.gtld-servers.net.
net.			172800	IN	NS	d.gtld-servers.net.
net.			172800	IN	NS	e.gtld-servers.net.
net.			172800	IN	NS	f.gtld-servers.net.
net.			172800	IN	NS	g.gtld-servers.net.
net.			172800	IN	NS	h.gtld-servers.net.
net.			172800	IN	NS	i.gtld-servers.net.
net.			172800	IN	NS	j.gtld-servers.net.
net.			172800	IN	NS	k.gtld-servers.net.
net.			172800	IN	NS	l.gtld-servers.net.
net.			172800	IN	NS	m.gtld-servers.net.
;; Received 825 bytes from 198.97.190.53#53(h.root-servers.net) in 133 ms

gtld-servers.net.	172800	IN	NS	av1.nstld.com.
gtld-servers.net.	172800	IN	NS	av2.nstld.com.
gtld-servers.net.	172800	IN	NS	av3.nstld.com.
gtld-servers.net.	172800	IN	NS	av4.nstld.com.
;; Received 302 bytes from 192.43.172.30#53(i.gtld-servers.net) in 203 ms

gtld-servers.net.	86400	IN	SOA	av4.nstld.com. nstld.verisign-grs.com. 2017061500 3600 900 1209600 86400
;; Received 113 bytes from 192.42.178.30#53(av2.nstld.com) in 66 ms
                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              @emirefek said in I need HELP on DNS RESOLVER!:

                              ;; connection timed out; no servers could be reached

                              You are NOT talking to roots... When you ask for

                              dig cs71.wac.edgecastcdn.net +trace +nodnssec

                              Sniff on your WAN when you do that command... What do you see? You should be able to watch the whole process where does it fail?

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              E 1 Reply Last reply Reply Quote 0
                              • E
                                emirefek @johnpoz
                                last edited by

                                @johnpoz Am I need to sniff from unbound logs ?

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  just do a packet capture on the wan for port 53... So you can see exactly what is being asked for and what your getting back

                                  Flush unbound cache first

                                  What does your unbound cache show for it?

                                  [2.4.3-RELEASE][root@sg4860.local.lan]/root: unbound-control -c /var/unbound/unbound.conf lookup cs71.wac.edgecastcdn.net
The following name servers are used for lookup of cs71.wac.edgecastcdn.net.
;rrset 3119 4 0 7 3
edgecastcdn.net.        3119    IN      NS      ns1.edgecastcdn.net.
edgecastcdn.net.        3119    IN      NS      ns2.edgecastcdn.net.
edgecastcdn.net.        3119    IN      NS      ns3.edgecastcdn.net.
edgecastcdn.net.        3119    IN      NS      ns4.edgecastcdn.net.
;rrset 3119 1 0 3 3
ns4.edgecastcdn.net.    3119    IN      A       192.229.254.6
;rrset 3119 1 0 3 3
ns4.edgecastcdn.net.    3119    IN      AAAA    2606:2800:e::6
;rrset 3119 1 0 3 3
ns3.edgecastcdn.net.    3119    IN      A       192.229.254.5
;rrset 3119 1 0 3 3
ns3.edgecastcdn.net.    3119    IN      AAAA    2606:2800:e::5
;rrset 85919 1 0 8 3
ns2.edgecastcdn.net.    172319  IN      A       72.21.80.6
;rrset 85919 1 0 8 3
ns2.edgecastcdn.net.    172319  IN      AAAA    2606:2800:1::6
;rrset 85919 1 0 8 3
ns1.edgecastcdn.net.    172319  IN      A       72.21.80.5
;rrset 85919 1 0 8 3
ns1.edgecastcdn.net.    172319  IN      AAAA    2606:2800:1::5
Delegation with 4 names, of which 0 can be examined to query further addresses.
It provides 8 IP addresses.
2606:2800:1::5          not in infra cache.
72.21.80.5              not in infra cache.
2606:2800:1::6          rto 376 msec, ttl 419, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
72.21.80.6              rto 238 msec, ttl 419, ping 2 var 59 rtt 238, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2606:2800:e::5          not in infra cache.
192.229.254.5           rto 297 msec, ttl 419, ping 1 var 74 rtt 297, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2606:2800:e::6          rto 376 msec, ttl 419, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
192.229.254.6           rto 306 msec, ttl 419, ping 2 var 76 rtt 306, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
[2.4.3-RELEASE][root@sg4860.local.lan]/root:

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    emirefek
                                    last edited by emirefek

                                    @johnpoz said in I need HELP on DNS RESOLVER!:

                                    dig cs71.wac.edgecastcdn.net +trace +nodnssec

                                    After start catching I typed this command to pfsense:

                                    dig cs71.wac.edgecastcdn.net +trace +nodnssec

                                    Here output from packet capture at 53 port

                                    22:53:30.024208 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
22:53:31.030351 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
22:53:32.040306 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
22:53:33.050299 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
22:53:37.090317 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
22:53:38.100289 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
22:53:40.160315 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
22:53:43.240948 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
22:53:44.253515 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
22:53:48.304619 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
22:53:51.360307 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
22:53:52.379843 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
22:53:53.389741 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65
22:54:00.450247 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
22:54:01.460281 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
22:54:02.469596 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
22:54:03.480236 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
22:54:07.540247 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
22:54:08.583342 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
22:54:10.600242 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
22:54:13.640244 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
22:54:14.650266 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
22:54:18.690232 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
22:54:21.740238 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
22:54:22.772875 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
22:54:23.779625 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65
22:54:30.812783 IP 88.247.225.172.static.ttnet.com.tr.41077 > b.root-servers.net.domain: UDP, length 65
22:54:31.819612 IP 88.247.225.172.static.ttnet.com.tr.52431 > d.root-servers.net.domain: UDP, length 65
22:54:32.830242 IP 88.247.225.172.static.ttnet.com.tr.61670 > j.root-servers.net.domain: UDP, length 65
22:54:33.856594 IP 88.247.225.172.static.ttnet.com.tr.46721 > l.root-servers.net.domain: UDP, length 65
22:54:37.899669 IP 88.247.225.172.static.ttnet.com.tr.32420 > G.ROOT-SERVERS.NET.domain: UDP, length 65
22:54:38.910250 IP 88.247.225.172.static.ttnet.com.tr.29122 > h.root-servers.net.domain: UDP, length 65
22:54:40.949745 IP 88.247.225.172.static.ttnet.com.tr.47510 > f.root-servers.net.domain: UDP, length 65
22:54:44.000233 IP 88.247.225.172.static.ttnet.com.tr.23648 > c.root-servers.net.domain: UDP, length 65
22:54:45.010274 IP 88.247.225.172.static.ttnet.com.tr.30337 > e.root-servers.net.domain: UDP, length 65
22:54:46.708756 IP 88.247.225.172.static.ttnet.com.tr.7485 > m.gtld-servers.net.domain: UDP, length 44
22:54:46.771932 IP m.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.7485: UDP, length 782
22:54:46.772270 IP 88.247.225.172.static.ttnet.com.tr.59069 > ns2.msft.net.domain: UDP, length 44
22:54:46.827447 IP ns2.msft.net.domain > 88.247.225.172.static.ttnet.com.tr.59069: UDP, length 82
22:54:46.827814 IP 88.247.225.172.static.ttnet.com.tr.18069 > l.gtld-servers.net.domain: UDP, length 56
22:54:46.864979 IP 88.247.225.172.static.ttnet.com.tr.25085 > f.gtld-servers.net.domain: UDP, length 56
22:54:46.894347 IP l.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.18069: UDP, length 1106
22:54:46.894691 IP 88.247.225.172.static.ttnet.com.tr.9268 > a1-66.akam.net.domain: UDP, length 56
22:54:47.030650 IP a1-66.akam.net.domain > 88.247.225.172.static.ttnet.com.tr.9268: UDP, length 92
22:54:47.031049 IP 88.247.225.172.static.ttnet.com.tr.58962 > j.gtld-servers.net.domain: UDP, length 54
22:54:47.064947 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.25085: UDP, length 1106
22:54:47.065230 IP 88.247.225.172.static.ttnet.com.tr.12213 > use3.akam.net.domain: UDP, length 56
22:54:47.132643 IP use3.akam.net.domain > 88.247.225.172.static.ttnet.com.tr.12213: UDP, length 92
22:54:47.132882 IP 88.247.225.172.static.ttnet.com.tr.51526 > f.gtld-servers.net.domain: UDP, length 54
22:54:47.153901 IP j.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.58962: UDP, length 1048
22:54:47.154148 IP 88.247.225.172.static.ttnet.com.tr.4808 > a2-16-40-192.deploy.static.akamaitechnologies.com.domain: UDP, length 54
22:54:47.338473 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.51526: UDP, length 1048
22:54:47.338984 IP 88.247.225.172.static.ttnet.com.tr.51939 > a95-101-36-192.deploy.static.akamaitechnologies.com.domain: UDP, length 54
22:54:47.347453 IP a2-16-40-192.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.4808: UDP, length 378
22:54:47.347714 IP 88.247.225.172.static.ttnet.com.tr.13784 > a2-16-187-47.deploy.static.akamaitechnologies.com.domain: UDP, length 54
22:54:47.397160 IP a95-101-36-192.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.51939: UDP, length 378
22:54:47.397407 IP 88.247.225.172.static.ttnet.com.tr.14635 > a2-16-187-63.deploy.static.akamaitechnologies.com.domain: UDP, length 54
22:54:47.418622 IP a2-16-187-47.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.13784: UDP, length 70
22:54:47.463365 IP a2-16-187-63.deploy.static.akamaitechnologies.com.domain > 88.247.225.172.static.ttnet.com.tr.14635: UDP, length 70
22:54:49.092864 IP 88.247.225.172.static.ttnet.com.tr.20086 > i.root-servers.net.domain: UDP, length 65
22:54:52.120242 IP 88.247.225.172.static.ttnet.com.tr.17712 > a.root-servers.net.domain: UDP, length 65
22:54:53.130227 IP 88.247.225.172.static.ttnet.com.tr.35541 > M.ROOT-SERVERS.NET.domain: UDP, length 65
22:54:54.189718 IP 88.247.225.172.static.ttnet.com.tr.52565 > k.root-servers.net.domain: UDP, length 65

                                    edit: ttnet.com.tr is my ISP.

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      post up the pcap of that.. So can make heads or tales of it..

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      E 1 Reply Last reply Reply Quote 0
                                      • E
                                        emirefek @johnpoz
                                        last edited by

                                        @johnpoz I posted this is packet capture ? you need without reverse dns?

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz

                                          NO you did not.. Download the capture and attach the pcap... All you can see there is the dest and source IPs... You can not SEE what was asked and what was returned.. I want the actual pcap so I can load it into wireshark and view what is going on. Also make sure you bump up the 100 packet limit since seems you have other dns queries going on there.

                                          Also what does the cache show you for unbound... See my other command I posted.

                                          47.338473 IP f.gtld-servers.net.domain > 88.247.225.172.static.ttnet.com.tr.51526: UDP, length 1048

                                          Here one of the gtld servers answered you - what did he say? If had the pcap could load into wireshark and SEE exactly what was returned.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          E 1 Reply Last reply Reply Quote 0
                                          • E
                                            emirefek @johnpoz
                                            last edited by emirefek

                                            @johnpoz Sorry I wasnt know that here it is my .cap file [DELETED FILE]

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.