Lot of traffic after installing bind 8.4.3 on sparc

Mark_Andrews at isc.org Mark_Andrews at isc.org
Thu Dec 4 00:09:24 UTC 2003


> 
> We at ORNL are experiencing the same problem.  And I don't understand this
> log output with the XX+...
> 
> e.g.
> Dec  3 08:37:55 ns1 named[12200]: [ID 295310 daemon.info] XX+160.91.170.43/19
> 6.209.148.12.in-addr.arpa/PTR/IN

	What don't you understand about it?  The "/" before the IP
	address accidently got dropped (patch below) but otherwise
	it is the same as it has been for a long time unless you
	get a TSIG and/or EDNS message.  If you do get these you will
	get a "/S", "/E" or "/SE" appended to the above log message.

	(S = signed)
	(E = EDNS)
	
	XX 	Token to pick from syslog
	"+"/" "	RD specified / RD not specified
	IPADDRESS
	QNAME
	QTYPE
	QCLASS
	FLAGS

	Mark

Index: src/bin/named/ns_req.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_req.c,v
retrieving revision 8.190
retrieving revision 8.191
diff -u -r8.190 -r8.191
--- src/bin/named/ns_req.c	24 Nov 2003 00:11:48 -0000	8.190
+++ src/bin/named/ns_req.c	28 Nov 2003 22:00:46 -0000	8.191
@@ -1068,7 +1068,7 @@
 		const char *sep = (in_tsig != NULL || udpsize != 0) ? "/" : "";
 		getnameinfo(from, sa_slen(from), hbuf,
 			    sizeof(hbuf), NULL, 0, NI_NUMERICHOST);
-		ns_info(ns_log_queries, "%s%s/%s/%s/%s%s%s%s",
+		ns_info(ns_log_queries, "%s/%s/%s/%s/%s%s%s%s",
 			(hp->rd) ? "XX+" : "XX ",
 			hbuf, 
 			(dname[0] == '\0') ? "." : dname, 
> 
> any ideas?
> 
> I am thinking, too, that we will revert to previous version of BIND.
> 
> 
> 
> On Thu, 4 Dec 2003 Mark_Andrews at isc.org wrote:
> 
>  >
>  > > Hello Group
>  > >
>  > > I encountered the flowing problem with the new version 8.4.3 of bind. Ma
> ybe
>  > > someone have an idea what is going wrong?
>  >
>  > 	I don't see anything wrong.  All I see below is the server making
>  > 	IPv6 queries.  These could be as a result of clients requests or
>  > 	it could be the result of named looking for missing AAAA glue.
>  >
>  > 	8.4.3 will *delay* lookups for missing AAAA records for nameservers,
>  > 	if it has a A record to try, until the query to the IPv4 address
>  > 	for the nameserver timeout.
>  >
>  > 	I seriously doubt that you were using 8.4.2 despite your claim.
>  > 	BIND 8.4.2 was not released publicly except in deperacted form
>  > 	for reference purposes.
>  >
>  > 	So if you tell us what you were actually running we may be able
>  > 	to tell you if the changes in behaviour are expected or not.
>  >
>  > 	You should also tell us why you think these queries are wrong.
>  >
>  > 	If you don't want named to use IPv6 for lookups then specify
>  > 	'-4' on the command line.
>  >
>  > 	Mark
>  >
>  > > After installing the new version everything went fine. The server gave
>  > > answer. But afterwards we discover heavy traffic on our network.
>  > >
>  > > 11:20:27.450179 IP our.name.server.53 > xxx.168.44.1.53:  41698 [1au] AA
> AA?
>  > > sriil5d.ladit.xxxxxx.xx. (65) (DF)
>  > > 11:20:27.451796 IP our.name.server.53 > xxx.168.44.1.53:  48192 AAAA?
>  > > srvlaaffaibb1b.xxx.xxx.xxx.(54) (DF)
>  > > 11:20:27.451822 IP our.name.server.53 > xxx.25.232.11.53:  16843 [1au]
>  > > AAAA? esssbadsiff08.xxx.xx. (51) (DF)
>  > > 11:20:27.454873 IP our.name.server.53 > rsyux06.xdxx.xx.53:  22550 AAAA?
>  > > 02.xdxx.xx. (39) (DF)
>  > > 11:20:27.456028 IP our.name.server.53 > xxx.18.55.1.53:  23405 [1au] AAA
> A?
>  > > vlddaib3d.xxx.xxx.xxx.(65) (DF)
>  > > 11:20:27.456053 IP our.name.server.53 > xxx.18.44.1.53:  62674 AAAA?
>  > > ib3d.xxx.xxx.xxx.(54) (DF)
>  > > 11:20:27.457332 IP our.name.server.53 > xxx.18.55.1.53:  3450 AAAA?
>  > > srvxxx5.xxx.xxx.xxx.(54) (DF)
>  > > (obfuscated)
>  > >
>  > > ... a lot of traffic! Afterwards we changed back to 8.4.2 and everything
>  > > went normal.
>  > >
>  > > The system is a `SunOS dns1 5.8 Generic_108528-24 sun4m sparc
>  > > SUNW,SPARCstation-5`.
>  > >
>  > > The changelog say something about ipv6 addr. and AAAA requests...
>  > >
>  > > Any suggestion would be welcome.
>  > >
>  > > Thx and by
>  > >
>  > > Dan Berger
>  > >
>  > >
>  > >
>  > --
>  > Mark Andrews, Internet Software Consortium
>  > 1 Seymour St., Dundas Valley, NSW 2117, Australia
>  > PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews at isc.org
>  >
>  >
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews at isc.org


More information about the bind-users mailing list