xfer-in: Transfer status: timed out (selective failures)

[Timothe Litt]

On 24-Feb-25 17:54, Peter 'PMc' Much wrote:
> tcpdump was friendly enough to tell me I should use -vv option,
> only I didn't read that at first.
> Then it clearly shows that these packets have invalid checksums. :(
>
> And that is apparently reason enough to just drop them without
> notice.
>
> Now how they aquire broken checksums, and why they start to
> do so two days ago (because I find some successful XFR in the log,
> until Feb-22), that is another story.

A couple of hints:

The bad checksums may be a false lead.  If you have a network interface 
that off-loads checksum computation, the checksum (valid or invalid) may 
not appear in the user/trace buffer.  (Depends on the interface & driver.)

If your NAT is changing IP addresses, it may not recompute the checksum 
(for the same reason - you can't count on it being valid in the buffer).

You can mark packets with IPtables to make tracking/logging easier.


Timothe Litt
ACM Distinguished Engineer
--------------------------
This communication may not represent the ACM or my employer's views,
if any, on the matters discussed.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20250224/fdb60d85/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20250224/fdb60d85/attachment.sig>