<div dir="ltr"><div><br></div><div>Der, sorry. Machines are all RHEL 6.8, running the BIND provided by RH: 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6</div><div><br></div><div>Restarting BIND (or even the OS) doesn't seem to change anything. I don't seem to have scan as an option for rndc. I assume it's in a newer version that RH doesn't yet provide for RHEL 6.</div><div><br></div><div>Logs are confusing. I tailed the general log and xfer log, while running tcpdump.</div><div><br></div><div>The xfer log and general log indicate that the CORRECT address is being used:</div><div><br></div><div><font face="monospace,monospace">18-Jul-2016 10:13:18.120 general: zone 153.10.10.IN-ADDR.ARPA/IN/internal-in: Transfer started.<br>18-Jul-2016 10:13:18.121 transfer of '153.10.10.IN-ADDR.ARPA/IN/internal-in' from 10.10.153.225#53: connected using 10.10.205.230#46673</font><br></div><div><br></div><div>However, I also ran tcpdump during that time (tcpdump -n host 10.10.153.225):</div><div><br></div><div><font face="monospace,monospace">10:13:18.121138 IP 10.10.205.240.46673 > 10.10.153.225.domain: Flags [S], seq 1847532073, win 14600, options [mss 1460,sackOK,TS val 255805503 ecr 0,nop ,wscale 7], length 0<br>10:13:18.121911 IP 10.10.153.225.domain > 10.10.205.240.46673: Flags [S.], seq 1696697219, ack 1847532074, win 8192, options [mss 1380,nop,wscale 8,sack OK,TS val 329780493 ecr 255805503,nop,Unknown Option 1403], length 0<br>10:13:18.121937 IP 10.10.205.240.46673 > 10.10.153.225.domain: Flags [.], ack 1, win 115, options [nop,nop,TS val 255805503 ecr 329780493], length 0<br></font></div><div><font face="monospace,monospace"><br></font></div><div><font face="monospace,monospace">[me@foo:/var/named/log]# host foo<br><a href="http://foo.scsr.nevada.edu">foo.scsr.nevada.edu</a> has address 10.10.205.240<br>[me@foo:/var/named/log]# host foo-xfer<br><a href="http://foo-xfer.scsr.nevada.edu">foo-xfer.scsr.nevada.edu</a> has address 10.10.205.230</font><br></div><div><br></div><div>So unless I'm crazy (possible, regardless)... named is reporting using 230, but OS is showing 240 (and remote host logs confirm 240)!?</div><div><br></div><div>Thanks!!</div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div><br></div><div>cheers and thanks,</div><div><br></div>Ian Veach, Senior Systems Analyst<div>System Computing Services, Nevada System of Higher Education</div><div><br></div></div></div>
<br><div class="gmail_quote">On Mon, Jul 18, 2016 at 9:28 AM, Tony Finch <span dir="ltr"><<a href="mailto:dot@dotat.at" target="_blank">dot@dotat.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>Ian Veach <<a href="mailto:ian_veach@nshe.nevada.edu">ian_veach@nshe.nevada.edu</a>> wrote:<br>
><br>
> So, any ideas on why I would see that slave initiate transfers on it's OS<br>
> IP versus the transfer-source IP... especially when the other three work<br>
> fine?<br>
<br>
</span>What does the log say about interface addresses? Which version of BIND are<br>
you running? Has the xfer interface been reconfigured on the problematic<br>
host? Does `rndc scan` or restarting named help?<br>
<span class="HOEnZb"><font color="#888888"><br>
Tony.<br>
--<br>
f.anthony.n.finch <<a href="mailto:dot@dotat.at">dot@dotat.at</a>> <a href="http://dotat.at/" target="_blank" rel="noreferrer">http://dotat.at/</a> - I xn--zr8h punycode<br>
Biscay: East 3 or 4, becoming cyclonic 4 or 5. Slight or moderate. Showers<br>
later. Good, occasionally moderate.<br>
</font></span></blockquote></div><br></div>
<br>
<span style="font-family:Arial,sans-serif;font-size:small;background-color:rgb(255,255,255)">PUBLIC RECORDS NOTICE: In accordance with NRS Chapter 239, this email and responses, unless otherwise made confidential by law, may be subject to the Nevada Public Records laws and may be disclosed to the public upon request.</span>