Lot of traffic after installing bind 8.4.3 on sparc
Mark_Andrews at isc.org
Mark_Andrews at isc.org
Thu Dec 4 00:09:24 UTC 2003
>
> We at ORNL are experiencing the same problem. And I don't understand this
> log output with the XX+...
>
> e.g.
> Dec 3 08:37:55 ns1 named[12200]: [ID 295310 daemon.info] XX+160.91.170.43/19
> 6.209.148.12.in-addr.arpa/PTR/IN
What don't you understand about it? The "/" before the IP
address accidently got dropped (patch below) but otherwise
it is the same as it has been for a long time unless you
get a TSIG and/or EDNS message. If you do get these you will
get a "/S", "/E" or "/SE" appended to the above log message.
(S = signed)
(E = EDNS)
XX Token to pick from syslog
"+"/" " RD specified / RD not specified
IPADDRESS
QNAME
QTYPE
QCLASS
FLAGS
Mark
Index: src/bin/named/ns_req.c
===================================================================
RCS file: /proj/cvs/isc/bind8/src/bin/named/ns_req.c,v
retrieving revision 8.190
retrieving revision 8.191
diff -u -r8.190 -r8.191
--- src/bin/named/ns_req.c 24 Nov 2003 00:11:48 -0000 8.190
+++ src/bin/named/ns_req.c 28 Nov 2003 22:00:46 -0000 8.191
@@ -1068,7 +1068,7 @@
const char *sep = (in_tsig != NULL || udpsize != 0) ? "/" : "";
getnameinfo(from, sa_slen(from), hbuf,
sizeof(hbuf), NULL, 0, NI_NUMERICHOST);
- ns_info(ns_log_queries, "%s%s/%s/%s/%s%s%s%s",
+ ns_info(ns_log_queries, "%s/%s/%s/%s/%s%s%s%s",
(hp->rd) ? "XX+" : "XX ",
hbuf,
(dname[0] == '\0') ? "." : dname,
>
> any ideas?
>
> I am thinking, too, that we will revert to previous version of BIND.
>
>
>
> On Thu, 4 Dec 2003 Mark_Andrews at isc.org wrote:
>
> >
> > > Hello Group
> > >
> > > I encountered the flowing problem with the new version 8.4.3 of bind. Ma
> ybe
> > > someone have an idea what is going wrong?
> >
> > I don't see anything wrong. All I see below is the server making
> > IPv6 queries. These could be as a result of clients requests or
> > it could be the result of named looking for missing AAAA glue.
> >
> > 8.4.3 will *delay* lookups for missing AAAA records for nameservers,
> > if it has a A record to try, until the query to the IPv4 address
> > for the nameserver timeout.
> >
> > I seriously doubt that you were using 8.4.2 despite your claim.
> > BIND 8.4.2 was not released publicly except in deperacted form
> > for reference purposes.
> >
> > So if you tell us what you were actually running we may be able
> > to tell you if the changes in behaviour are expected or not.
> >
> > You should also tell us why you think these queries are wrong.
> >
> > If you don't want named to use IPv6 for lookups then specify
> > '-4' on the command line.
> >
> > Mark
> >
> > > After installing the new version everything went fine. The server gave
> > > answer. But afterwards we discover heavy traffic on our network.
> > >
> > > 11:20:27.450179 IP our.name.server.53 > xxx.168.44.1.53: 41698 [1au] AA
> AA?
> > > sriil5d.ladit.xxxxxx.xx. (65) (DF)
> > > 11:20:27.451796 IP our.name.server.53 > xxx.168.44.1.53: 48192 AAAA?
> > > srvlaaffaibb1b.xxx.xxx.xxx.(54) (DF)
> > > 11:20:27.451822 IP our.name.server.53 > xxx.25.232.11.53: 16843 [1au]
> > > AAAA? esssbadsiff08.xxx.xx. (51) (DF)
> > > 11:20:27.454873 IP our.name.server.53 > rsyux06.xdxx.xx.53: 22550 AAAA?
> > > 02.xdxx.xx. (39) (DF)
> > > 11:20:27.456028 IP our.name.server.53 > xxx.18.55.1.53: 23405 [1au] AAA
> A?
> > > vlddaib3d.xxx.xxx.xxx.(65) (DF)
> > > 11:20:27.456053 IP our.name.server.53 > xxx.18.44.1.53: 62674 AAAA?
> > > ib3d.xxx.xxx.xxx.(54) (DF)
> > > 11:20:27.457332 IP our.name.server.53 > xxx.18.55.1.53: 3450 AAAA?
> > > srvxxx5.xxx.xxx.xxx.(54) (DF)
> > > (obfuscated)
> > >
> > > ... a lot of traffic! Afterwards we changed back to 8.4.2 and everything
> > > went normal.
> > >
> > > The system is a `SunOS dns1 5.8 Generic_108528-24 sun4m sparc
> > > SUNW,SPARCstation-5`.
> > >
> > > The changelog say something about ipv6 addr. and AAAA requests...
> > >
> > > Any suggestion would be welcome.
> > >
> > > Thx and by
> > >
> > > Dan Berger
> > >
> > >
> > >
> > --
> > Mark Andrews, Internet Software Consortium
> > 1 Seymour St., Dundas Valley, NSW 2117, Australia
> > PHONE: +61 2 9871 4742 INTERNET: Mark.Andrews at isc.org
> >
> >
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: Mark.Andrews at isc.org
More information about the bind-users
mailing list