TCP truncated?

[Barry Margolin]

In article <20000327141111.G77375 at lucifer.bart.nl>,
Jeroen Ruigrok van der Werven  <asmodai at bart.nl> wrote:
>Can someone with more in-depth knowledge of the BIND source code please
>tell me what this means?
>
>Mar 27 14:04:54 hel named[78358]: ns_resp: TCP truncated:
>"2.236.239.194.in-addr.arpa" IN PTR from [194.239.236.2].53

It means that your server tried a UDP query and got a truncated response,
so then it switched to TCP and *still* the response was truncated.

>It seemingly only started today.
>
>I am curious why they are using a TCP session for the NS stuff.

Because that IP address has too many PTR records to fit in a 500-byte UDP
response.  When a response doesn't fit in a small UDP packet, you're
supposed to switch to TCP.  That's part of the protocol spec.

-- 
Barry Margolin, barmar at bbnplanet.com
GTE Internetworking, Powered by BBN, Burlington, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.