<div dir="ltr">On Mon, Jun 15, 2015 at 5:56 AM, Gaurav Kansal <span dir="ltr"><<a href="mailto:gaurav.kansal@nic.in" target="_blank">gaurav.kansal@nic.in</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div link="#0563C1" vlink="#954F72" lang="EN-US"><div><p class="MsoNormal">Dear Team,<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">My caching DNS server is generating log of . NS queries to ROOT Servers. <u></u><u></u></p><p class="MsoNormal">I have a hint file in my bind configuration and the same is up-to date.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">The same behavior is occurring in multiple versions of BIND (tested on 9.7, 9.9 and on 9.10).<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">It must be for some purpose (may be BIND doesn’t trust hint file and cross check it from root servers).<u></u><u></u></p><p class="MsoNormal">Can anyone put some light on this.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u>Sample tcpdump output :-<u></u><u></u></u></p><p class="MsoNormal">15:36:42.440831 IP anydnsmby.27938 > k.root-servers.net.domain: 38907 [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">15:36:43.241203 IP anydnsmby.52261 > f.root-servers.net.domain: 3841 [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">15:36:43.624041 IP anydnsmby.48889 > k.root-servers.net.domain: 6314 [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">15:36:44.424047 IP anydnsmby.65507 > c.root-servers.net.domain: 27973 [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">15:37:42.071574 IP anydnsmby.38958 > i.root-servers.net.domain: 53519 [1au] NS? 117.240.177.150. (44)<u></u><u></u></p><p class="MsoNormal">15:40:11.121122 IP anydnsmby.7941 > i.root-servers.net.domain: 62400 [1au] NS? <a href="http://1.mr" target="_blank">1.mr</a>. (33)<u></u><u></u></p><p class="MsoNormal">15:45:52.780062 IP anydnsmby.49432 > e.root-servers.net.domain: 54241+ [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">15:45:59.341780 IP anydnsmby.34368 > e.root-servers.net.domain: 55928+ [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">15:46:04.487088 IP anydnsmby.35621 > e.root-servers.net.domain: 7266+ [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">15:46:35.453029 IP anydnsmby.62875 > i.root-servers.net.domain: 4129 [1au] NS? comp-HP. (36)<u></u><u></u></p><p class="MsoNormal">16:16:13.747955 IP anydnsmby.39690 > a.root-servers.net.domain: 8774+ [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">16:16:20.845363 IP anydnsmby.36994 > e.root-servers.net.domain: 63433+ [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">16:16:36.746049 IP anydnsmby.42878 > a.root-servers.net.domain: 48439+ [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">16:16:42.060534 IP anydnsmby.41018 > j.root-servers.net.domain: 5347+ [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">16:16:49.081649 IP anydnsmby.53661 > e.root-servers.net.domain: 54768+ [1au] NS? . (28)<u></u><u></u></p><p class="MsoNormal">16:51:14.034065 IP anydnsmby.38025 > k.root-servers.net.domain: 52771 [1au] NS? 116.73.202.141. (43)<u></u><u></u></p><p class="MsoNormal">16:51:14.835539 IP anydnsmby.19616 > i.root-servers.net.domain: 14926 [1au] NS? 116.73.202.141. (43)<u></u><u></u></p><p class="MsoNormal">17:25:16.706395 IP anydnsmby.58045 > i.root-servers.net.domain: 30880 [1au] NS? <a href="http://2.mr" target="_blank">2.mr</a>. (33)<u></u><u></u></p><p class="MsoNormal">17:25:16.707072 IP anydnsmby.38495 > i.root-servers.net.domain: 43451 [1au] NS? <a href="http://6.mr" target="_blank">6.mr</a>. (33)<u></u><u></u></p><p class="MsoNormal">17:25:16.707989 IP anydnsmby.35834 > i.root-servers.net.domain: 61843 [1au] NS? <a href="http://3.mr" target="_blank">3.mr</a>. (33)<u></u><u></u></p><p class="MsoNormal">17:56:44.855060 IP anydnsmby.61903 > a.root-servers.net.domain: 23284 [1au] NS? 172.192.168.2. (42)<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Regards,<u></u><u></u></p><p class="MsoNormal">Gaurav Kansal<u></u><u></u></p></div></div><br></blockquote><div><br></div><div>Bind has never trusted your hints file. (OK, I can't swear to v4.x of BIND, even though I did use 4.3 a very long time ago.)<br><br>The file is called a hints file as it is used only to provide a starting place for your named to find the root. It's really not even needed in most cases as BIND now has a built-in set of hints that are used in the absence of a hints file. Yo0u really only need a hits file if you are using a non-standard (usually internal) root.<br><br>Once named "finds" a responsive root from either its internal list or from the hints file, the hints are ignored. It gets a copy of the root zone and starts to figure out the fastest one for normal use. Periodically it will retry other root servers to make sure that it is always using a reasonably fast responding one. I'll admit to being unfamiliar with the algorithm used to make these periodic checks.<br></div></div>--<br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">Kevin Oberman, Network Engineer, Retired<br>E-mail: <a href="mailto:rkoberman@gmail.com" target="_blank">rkoberman@gmail.com</a><br></div></div></div></div></div>
</div></div>