<p dir="ltr">Cisco routers do have the ability to "doctor" DNS packets when doing NAT. When it doctors it sets the TTL to 0 but I dont know why it would only do it on CNAME records. </p>
<div class="gmail_quote">On Jun 5, 2014 12:43 PM, "Reindl Harald" <<a href="mailto:h.reindl@thelounge.net">h.reindl@thelounge.net</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<br>
Am 05.06.2014 17:58, schrieb /dev/rob0:<br>
> On Thu, Jun 05, 2014 at 05:21:47PM +0200, Reindl Harald wrote:<br>
>> what the hell invents "$TTL 0 ; 0 seconds" lines before<br>
>> each CNAME block while on the master there is exactly<br>
>> one TTL line with 86400 on top of the file?<br>
><br>
> The way named writes a zone file is not the way I would do it.<br>
> Records are strictly in alphabetic order, and $TTL blocks are made<br>
> around all RRSETs where TTL varies.<br>
><br>
> The zone FILE is not your problem. I don't know exactly what the<br>
> problem might be. It seems that something is intercepting and<br>
> filtering the zone transfers?<br>
><br>
> You could try transfers manually from the slave:<br>
><br>
> dig [key auth if required] <a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. axfr @<a href="http://91.118.73.16" target="_blank">91.118.73.16</a><br>
><br>
> Does that show any zero TTLs? If so I suggest you place a couple of<br>
> sniffers at strategic spots, one leaving the master, another entering<br>
> the slave, and force a zone transfer.<br>
<br>
as yolu can see clearly below any CNAME record comes with a zero TTL<br>
the dotted line are a lot of CNAMES, all with zero TTL<br>
after them the first A-record has again the desired 86400<br>
<br>
the SOA at the end comes also with 86400 and the CNAME<br>
block before again has a TTL of zero<br>
<br>
i can't imagine anyhting which would sit between the<br>
transfer and change things - aaaah wait there was a<br>
Zyxel router in front of ns1 which was exploitable<br>
and now is replaced by a small Cisco from the ISP<br>
<br>
oh, no, don't tell me that my ISP clutters DNS again :-(<br>
<br>
[root@ns2:~]$ dig <a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. axfr @<a href="http://91.118.73.16" target="_blank">91.118.73.16</a><br>
<br>
; <<>> DiG 9.9.3-rl.13207.22-P2-RedHat-9.9.3-15.P2.fc19 <<>> <a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. axfr @<a href="http://91.118.73.16" target="_blank">91.118.73.16</a><br>
;; global options: +cmd<br>
<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 86400 IN SOA <a href="http://ns2.thelounge.net" target="_blank">ns2.thelounge.net</a>. <a href="http://hostmaster.thelounge.net" target="_blank">hostmaster.thelounge.net</a>. 1226095186 3600 1800<br>
<a href="tel:1814400%203600" value="+18144003600">1814400 3600</a><br>
<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 86400 IN MX 10 <a href="http://barracuda.thelounge.net" target="_blank">barracuda.thelounge.net</a>.<br>
<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 86400 IN TXT "v=spf1 ip4:<a href="http://91.118.73.0/24" target="_blank">91.118.73.0/24</a> ip4:89.207.144.27 ip4:62.178.103.85 -all"<br>
<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 86400 IN SPF "v=spf1 ip4:<a href="http://91.118.73.0/24" target="_blank">91.118.73.0/24</a> ip4:89.207.144.27 ip4:62.178.103.85 -all"<br>
<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 86400 IN NS <a href="http://ns2.thelounge.net" target="_blank">ns2.thelounge.net</a>.<br>
<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 86400 IN NS <a href="http://ns1.thelounge.net" target="_blank">ns1.thelounge.net</a>.<br>
<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 86400 IN A 91.118.73.4<br>
**.<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 0 IN CNAME **.<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>.<br>
**.<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 0 IN CNAME **.<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>.<br>
................................<br>
<a href="http://testserver.rhsoft.net" target="_blank">testserver.rhsoft.net</a>. 86400 IN A 84.113.92.77<br>
**.<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 0 IN CNAME **.<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>.<br>
<a href="http://rhsoft.net" target="_blank">rhsoft.net</a>. 86400 IN SOA <a href="http://ns2.thelounge.net" target="_blank">ns2.thelounge.net</a>. <a href="http://hostmaster.thelounge.net" target="_blank">hostmaster.thelounge.net</a>. 1226095186 3600 1800<br>
<a href="tel:1814400%203600" value="+18144003600">1814400 3600</a><br>
;; Query time: 22 msec<br>
;; SERVER: 91.118.73.16#53(91.118.73.16)<br>
;; WHEN: Do Jun 05 18:35:08 CEST 2014<br>
;; XFR size: 58 records (messages 1, bytes 1545)<br>
<br>
<br>_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br></blockquote></div>