Kevin, this server is totally non-recursive. Neither recurse option is enabled and packet size does not exceed 512 byte. May be it was some temporarly bugs due to mysterious causes.<br><br>Below I post full sniffer's output for both queries:<br>
<br>No. Time Source Destination Protocol Info<br> 1 0.000000 193.110.129.66 194.85.61.20 DNS Standard query MX <a href="http://lbr.ru">lbr.ru</a><br><br>Frame 1 (66 bytes on wire, 66 bytes captured)<br>
Arrival Time: Jun 9, 2009 10:21:34.405480000<br> [Time delta from previous captured frame: 0.000000000 seconds]<br> [Time delta from previous displayed frame: 0.000000000 seconds]<br> [Time since reference or first frame: 0.000000000 seconds]<br>
Frame Number: 1<br> Frame Length: 66 bytes<br> Capture Length: 66 bytes<br> [Frame is marked: False]<br> [Protocols in frame: eth:ip:udp:dns]<br> [Coloring Rule Name: UDP]<br> [Coloring Rule String: udp]<br>
Ethernet II, Src: Intel_db:50:96 (00:0e:0c:db:50:96), Dst: All-HSRP-routers_c7 (00:00:0c:07:ac:c7)<br> Destination: All-HSRP-routers_c7 (00:00:0c:07:ac:c7)<br> Address: All-HSRP-routers_c7 (00:00:0c:07:ac:c7)<br>
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)<br> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)<br> Source: Intel_db:50:96 (00:0e:0c:db:50:96)<br>
Address: Intel_db:50:96 (00:0e:0c:db:50:96)<br> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)<br> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)<br>
Type: IP (0x0800)<br>Internet Protocol, Src: 193.110.129.66 (193.110.129.66), Dst: 194.85.61.20 (194.85.61.20)<br> Version: 4<br> Header length: 20 bytes<br> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)<br>
0000 00.. = Differentiated Services Codepoint: Default (0x00)<br> .... ..0. = ECN-Capable Transport (ECT): 0<br> .... ...0 = ECN-CE: 0<br> Total Length: 52<br> Identification: 0x7b9b (31643)<br>
Flags: 0x00<br> 0... = Reserved bit: Not set<br> .0.. = Don't fragment: Not set<br> ..0. = More fragments: Not set<br> Fragment offset: 0<br> Time to live: 126<br> Protocol: UDP (0x11)<br>
Header checksum: 0x7f03 [correct]<br> [Good: True]<br> [Bad : False]<br> Source: 193.110.129.66 (193.110.129.66)<br> Destination: 194.85.61.20 (194.85.61.20)<br>User Datagram Protocol, Src Port: 11173 (11173), Dst Port: domain (53)<br>
Source port: 11173 (11173)<br> Destination port: domain (53)<br> Length: 32<br> Checksum: 0xec71 [correct]<br> [Good Checksum: True]<br> [Bad Checksum: False]<br>Domain Name System (query)<br> [Response In: 2]<br>
Transaction ID: 0xc7e5<br> Flags: 0x0000 (Standard query)<br> 0... .... .... .... = Response: Message is a query<br> .000 0... .... .... = Opcode: Standard query (0)<br> .... ..0. .... .... = Truncated: Message is not truncated<br>
.... ...0 .... .... = Recursion desired: Don't do query recursively<br> .... .... .0.. .... = Z: reserved (0)<br> .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable<br>
Questions: 1<br> Answer RRs: 0<br> Authority RRs: 0<br> Additional RRs: 0<br> Queries<br> <a href="http://lbr.ru">lbr.ru</a>: type MX, class IN<br> Name: <a href="http://lbr.ru">lbr.ru</a><br>
Type: MX (Mail exchange)<br> Class: IN (0x0001)<br><br>No. Time Source Destination Protocol Info<br> 2 0.034553 194.85.61.20 193.110.129.66 DNS Standard query response<br>
<br>Frame 2 (66 bytes on wire, 66 bytes captured)<br> Arrival Time: Jun 9, 2009 10:21:34.440033000<br> [Time delta from previous captured frame: 0.034553000 seconds]<br> [Time delta from previous displayed frame: 0.034553000 seconds]<br>
[Time since reference or first frame: 0.034553000 seconds]<br> Frame Number: 2<br> Frame Length: 66 bytes<br> Capture Length: 66 bytes<br> [Frame is marked: False]<br> [Protocols in frame: eth:ip:udp:dns]<br>
[Coloring Rule Name: UDP]<br> [Coloring Rule String: udp]<br>Ethernet II, Src: Cisco_ff:e0:1b (00:0b:bf:ff:e0:1b), Dst: Intel_db:50:96 (00:0e:0c:db:50:96)<br> Destination: Intel_db:50:96 (00:0e:0c:db:50:96)<br> Address: Intel_db:50:96 (00:0e:0c:db:50:96)<br>
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)<br> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)<br> Source: Cisco_ff:e0:1b (00:0b:bf:ff:e0:1b)<br>
Address: Cisco_ff:e0:1b (00:0b:bf:ff:e0:1b)<br> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)<br> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)<br>
Type: IP (0x0800)<br>Internet Protocol, Src: 194.85.61.20 (194.85.61.20), Dst: 193.110.129.66 (193.110.129.66)<br> Version: 4<br> Header length: 20 bytes<br> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)<br>
0000 00.. = Differentiated Services Codepoint: Default (0x00)<br> .... ..0. = ECN-Capable Transport (ECT): 0<br> .... ...0 = ECN-CE: 0<br> Total Length: 52<br> Identification: 0x7b9b (31643)<br>
Flags: 0x00<br> 0... = Reserved bit: Not set<br> .0.. = Don't fragment: Not set<br> ..0. = More fragments: Not set<br> Fragment offset: 0<br> Time to live: 52<br> Protocol: UDP (0x11)<br>
Header checksum: 0xc903 [correct]<br> [Good: True]<br> [Bad : False]<br> Source: 194.85.61.20 (194.85.61.20)<br> Destination: 193.110.129.66 (193.110.129.66)<br>User Datagram Protocol, Src Port: domain (53), Dst Port: 11173 (11173)<br>
Source port: domain (53)<br> Destination port: 11173 (11173)<br> Length: 32<br> Checksum: 0x0000 (none)<br> Good Checksum: False<br> Bad Checksum: False<br>Domain Name System (response)<br> [Request In: 1]<br>
[Time: 0.034553000 seconds]<br> Transaction ID: 0xc7e5<br> Flags: 0x8600 (Standard query response, No error)<br> 1... .... .... .... = Response: Message is a response<br> .000 0... .... .... = Opcode: Standard query (0)<br>
.... .1.. .... .... = Authoritative: Server is an authority for domain<br> .... ..1. .... .... = Truncated: Message is truncated<br> .... ...0 .... .... = Recursion desired: Don't do query recursively<br>
.... .... 0... .... = Recursion available: Server can't do recursive queries<br> .... .... .0.. .... = Z: reserved (0)<br> .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server<br>
.... .... .... 0000 = Reply code: No error (0)<br> Questions: 1<br> Answer RRs: 0<br> Authority RRs: 0<br> Additional RRs: 0<br> Queries<br> <a href="http://lbr.ru">lbr.ru</a>: type MX, class IN<br>
Name: <a href="http://lbr.ru">lbr.ru</a><br> Type: MX (Mail exchange)<br> Class: IN (0x0001)<br><br><br>No. Time Source Destination Protocol Info<br> 7 79.586117 193.110.129.66 194.85.61.20 DNS Standard query MX <a href="http://lbr.ru">lbr.ru</a><br>
<br>Frame 7 (66 bytes on wire, 66 bytes captured)<br> Arrival Time: Jun 9, 2009 10:22:53.991597000<br> [Time delta from previous captured frame: 6.975743000 seconds]<br> [Time delta from previous displayed frame: 6.975743000 seconds]<br>
[Time since reference or first frame: 79.586117000 seconds]<br> Frame Number: 7<br> Frame Length: 66 bytes<br> Capture Length: 66 bytes<br> [Frame is marked: False]<br> [Protocols in frame: eth:ip:udp:dns]<br>
[Coloring Rule Name: UDP]<br> [Coloring Rule String: udp]<br>Ethernet II, Src: Intel_db:50:96 (00:0e:0c:db:50:96), Dst: All-HSRP-routers_c7 (00:00:0c:07:ac:c7)<br> Destination: All-HSRP-routers_c7 (00:00:0c:07:ac:c7)<br>
Address: All-HSRP-routers_c7 (00:00:0c:07:ac:c7)<br> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)<br> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)<br>
Source: Intel_db:50:96 (00:0e:0c:db:50:96)<br> Address: Intel_db:50:96 (00:0e:0c:db:50:96)<br> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)<br> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)<br>
Type: IP (0x0800)<br>Internet Protocol, Src: 193.110.129.66 (193.110.129.66), Dst: 194.85.61.20 (194.85.61.20)<br> Version: 4<br> Header length: 20 bytes<br> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)<br>
0000 00.. = Differentiated Services Codepoint: Default (0x00)<br> .... ..0. = ECN-Capable Transport (ECT): 0<br> .... ...0 = ECN-CE: 0<br> Total Length: 52<br> Identification: 0x4611 (17937)<br>
Flags: 0x00<br> 0... = Reserved bit: Not set<br> .0.. = Don't fragment: Not set<br> ..0. = More fragments: Not set<br> Fragment offset: 0<br> Time to live: 126<br> Protocol: UDP (0x11)<br>
Header checksum: 0xb48d [correct]<br> [Good: True]<br> [Bad : False]<br> Source: 193.110.129.66 (193.110.129.66)<br> Destination: 194.85.61.20 (194.85.61.20)<br>User Datagram Protocol, Src Port: 19335 (19335), Dst Port: domain (53)<br>
Source port: 19335 (19335)<br> Destination port: domain (53)<br> Length: 32<br> Checksum: 0x689d [correct]<br> [Good Checksum: True]<br> [Bad Checksum: False]<br>Domain Name System (query)<br> [Response In: 8]<br>
Transaction ID: 0x2ad8<br> Flags: 0x0100 (Standard query)<br> 0... .... .... .... = Response: Message is a query<br> .000 0... .... .... = Opcode: Standard query (0)<br> .... ..0. .... .... = Truncated: Message is not truncated<br>
.... ...1 .... .... = Recursion desired: Do query recursively<br> .... .... .0.. .... = Z: reserved (0)<br> .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable<br>
Questions: 1<br> Answer RRs: 0<br> Authority RRs: 0<br> Additional RRs: 0<br> Queries<br> <a href="http://lbr.ru">lbr.ru</a>: type MX, class IN<br> Name: <a href="http://lbr.ru">lbr.ru</a><br>
Type: MX (Mail exchange)<br> Class: IN (0x0001)<br><br>No. Time Source Destination Protocol Info<br> 8 79.679224 194.85.61.20 193.110.129.66 DNS Standard query response MX 10 <a href="http://MAIL.lbr.ru">MAIL.lbr.ru</a><br>
<br>Frame 8 (175 bytes on wire, 175 bytes captured)<br> Arrival Time: Jun 9, 2009 10:22:54.084704000<br> [Time delta from previous captured frame: 0.093107000 seconds]<br> [Time delta from previous displayed frame: 0.093107000 seconds]<br>
[Time since reference or first frame: 79.679224000 seconds]<br> Frame Number: 8<br> Frame Length: 175 bytes<br> Capture Length: 175 bytes<br> [Frame is marked: False]<br> [Protocols in frame: eth:ip:udp:dns]<br>
[Coloring Rule Name: UDP]<br> [Coloring Rule String: udp]<br>Ethernet II, Src: Cisco_ff:e0:1b (00:0b:bf:ff:e0:1b), Dst: Intel_db:50:96 (00:0e:0c:db:50:96)<br> Destination: Intel_db:50:96 (00:0e:0c:db:50:96)<br> Address: Intel_db:50:96 (00:0e:0c:db:50:96)<br>
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)<br> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)<br> Source: Cisco_ff:e0:1b (00:0b:bf:ff:e0:1b)<br>
Address: Cisco_ff:e0:1b (00:0b:bf:ff:e0:1b)<br> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)<br> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)<br>
Type: IP (0x0800)<br>Internet Protocol, Src: 194.85.61.20 (194.85.61.20), Dst: 193.110.129.66 (193.110.129.66)<br> Version: 4<br> Header length: 20 bytes<br> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)<br>
0000 00.. = Differentiated Services Codepoint: Default (0x00)<br> .... ..0. = ECN-Capable Transport (ECT): 0<br> .... ...0 = ECN-CE: 0<br> Total Length: 161<br> Identification: 0x48ea (18666)<br>
Flags: 0x00<br> 0... = Reserved bit: Not set<br> .0.. = Don't fragment: Not set<br> ..0. = More fragments: Not set<br> Fragment offset: 0<br> Time to live: 55<br> Protocol: UDP (0x11)<br>
Header checksum: 0xf847 [correct]<br> [Good: True]<br> [Bad : False]<br> Source: 194.85.61.20 (194.85.61.20)<br> Destination: 193.110.129.66 (193.110.129.66)<br>User Datagram Protocol, Src Port: domain (53), Dst Port: 19335 (19335)<br>
Source port: domain (53)<br> Destination port: 19335 (19335)<br> Length: 141<br> Checksum: 0x29a9 [correct]<br> [Good Checksum: True]<br> [Bad Checksum: False]<br>Domain Name System (response)<br>
[Request In: 7]<br> [Time: 0.093107000 seconds]<br> Transaction ID: 0x2ad8<br> Flags: 0x8500 (Standard query response, No error)<br> 1... .... .... .... = Response: Message is a response<br> .000 0... .... .... = Opcode: Standard query (0)<br>
.... .1.. .... .... = Authoritative: Server is an authority for domain<br> .... ..0. .... .... = Truncated: Message is not truncated<br> .... ...1 .... .... = Recursion desired: Do query recursively<br>
.... .... 0... .... = Recursion available: Server can't do recursive queries<br> .... .... .0.. .... = Z: reserved (0)<br> .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server<br>
.... .... .... 0000 = Reply code: No error (0)<br> Questions: 1<br> Answer RRs: 1<br> Authority RRs: 2<br> Additional RRs: 3<br> Queries<br> <a href="http://lbr.ru">lbr.ru</a>: type MX, class IN<br>
Name: <a href="http://lbr.ru">lbr.ru</a><br> Type: MX (Mail exchange)<br> Class: IN (0x0001)<br> Answers<br> <a href="http://lbr.ru">lbr.ru</a>: type MX, class IN, preference 10, mx <a href="http://MAIL.lbr.ru">MAIL.lbr.ru</a><br>
Name: <a href="http://lbr.ru">lbr.ru</a><br> Type: MX (Mail exchange)<br> Class: IN (0x0001)<br> Time to live: 1 day<br> Data length: 9<br> Preference: 10<br>
Mail exchange: <a href="http://MAIL.lbr.ru">MAIL.lbr.ru</a><br> Authoritative nameservers<br> <a href="http://lbr.ru">lbr.ru</a>: type NS, class IN, ns <a href="http://ns3.nic.ru">ns3.nic.ru</a><br> Name: <a href="http://lbr.ru">lbr.ru</a><br>
Type: NS (Authoritative name server)<br> Class: IN (0x0001)<br> Time to live: 1 day<br> Data length: 10<br> Name server: <a href="http://ns3.nic.ru">ns3.nic.ru</a><br>
<a href="http://lbr.ru">lbr.ru</a>: type NS, class IN, ns <a href="http://ns4.nic.ru">ns4.nic.ru</a><br> Name: <a href="http://lbr.ru">lbr.ru</a><br> Type: NS (Authoritative name server)<br> Class: IN (0x0001)<br>
Time to live: 1 day<br> Data length: 6<br> Name server: <a href="http://ns4.nic.ru">ns4.nic.ru</a><br> Additional records<br> <a href="http://MAIL.lbr.ru">MAIL.lbr.ru</a>: type A, class IN, addr 213.184.248.227<br>
Name: <a href="http://MAIL.lbr.ru">MAIL.lbr.ru</a><br> Type: A (Host address)<br> Class: IN (0x0001)<br> Time to live: 1 day<br> Data length: 4<br> Addr: 213.184.248.227<br>
<a href="http://ns3.nic.ru">ns3.nic.ru</a>: type A, class IN, addr 194.85.61.20<br> Name: <a href="http://ns3.nic.ru">ns3.nic.ru</a><br> Type: A (Host address)<br> Class: IN (0x0001)<br>
Time to live: 4 hours, 57 minutes, 5 seconds<br> Data length: 4<br> Addr: 194.85.61.20<br> <a href="http://ns4.nic.ru">ns4.nic.ru</a>: type A, class IN, addr 194.226.96.8<br> Name: <a href="http://ns4.nic.ru">ns4.nic.ru</a><br>
Type: A (Host address)<br> Class: IN (0x0001)<br> Time to live: 4 hours, 57 minutes, 1 second<br> Data length: 4<br> Addr: 194.226.96.8<br><br><br>