<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">
<div>Pol,</div>
<div><br>
</div>
<div>You can "audit" your traffic by getting a pcap via tcpdump and then analyzing it in wireshark. Packets don't lie.</div>
<div><br>
</div>
<div>John</div>
<div><br>
</div>
<div id="x_signature-x" style="">Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF">
Nine</a></div>
</div>
<div id="x_quoted_header" style="clear:both"><br>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<span style="font-size:11.0pt; font-family:'Calibri','sans-serif'"><b>From:</b> Pol Hallen <bindml@fuckaround.org><br>
<b>Sent:</b> Sep 21, 2016 2:35 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: forwarder (YES/NO)<br>
</span></div>
</div>
<br type="attribution">
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">hello again!<br>
<br>
> try running dig +trace <host> and see how fast it runs. It should return<br>
> in about same time as BIND does (when it doesn't have anything in cache).<br>
<br>
; <<>> DiG 9.10.3-P4-Debian <<>> +trace @192.168.1.212 yahoo.it<br>
; (1 server found)<br>
;; global options: +cmd<br>
. 518367 IN NS d.root-servers.net.<br>
. 518367 IN NS g.root-servers.net.<br>
. 518367 IN NS e.root-servers.net.<br>
. 518367 IN NS h.root-servers.net.<br>
. 518367 IN NS b.root-servers.net.<br>
. 518367 IN NS c.root-servers.net.<br>
. 518367 IN NS a.root-servers.net.<br>
. 518367 IN NS l.root-servers.net.<br>
. 518367 IN NS i.root-servers.net.<br>
. 518367 IN NS m.root-servers.net.<br>
. 518367 IN NS k.root-servers.net.<br>
. 518367 IN NS j.root-servers.net.<br>
. 518367 IN NS f.root-servers.net.<br>
. 518396 IN RRSIG NS 8 0 518400 <br>
20161004170000 20160921160000 46551 . <br>
tZptpyBClVtkAbyo4NOR2MgHDoq67TlImcBVzZORhn7C2c557prmG42J <br>
sSPD8aZmisk3bbUJbmqFVFB/M2y/O4zjw3jBf42ujHce99VD3xCeJuk7 <br>
boGW356J6c7JaApB02GRf3SGQIv7x6MVyBmGeKxAosEePlbfjg/8NPEY +y0=<br>
;; Received 397 bytes from 192.168.1.212#53(192.168.1.212) in 2 ms<br>
<br>
it. 172800 IN NS a.dns.it.<br>
it. 172800 IN NS m.dns.it.<br>
it. 172800 IN NS r.dns.it.<br>
it. 172800 IN NS dns.nic.it.<br>
it. 172800 IN NS nameserver.cnr.it.<br>
it. 86400 IN NSEC itau. NS RRSIG NSEC<br>
it. 86400 IN RRSIG NSEC 8 1 86400 <br>
20161004170000 20160921160000 46551 . <br>
LL0eXWf22Lhhi5C0P+PX446JQH+GwCFhxU7tkUUF9wyG+pQ0eDCnpTu0 <br>
vm0ww/3YycmNJwlF3IHJmLIh2l7htSW6G/o2/ozNbZU6RF9pMhKxQNrJ <br>
aE6hf4L+Ka1N5uNstgJzrE6pV9ouXOJmL0Epoa3gUnbSZcFHH5QrKbu6 AfQ=<br>
;; Received 545 bytes from 192.58.128.30#53(j.root-servers.net) in 577 ms<br>
<br>
yahoo.it. 10800 IN NS ns2.yahoo.com.<br>
yahoo.it. 10800 IN NS ns1.yahoo.com.<br>
yahoo.it. 10800 IN NS ns5.yahoo.com.<br>
yahoo.it. 10800 IN NS ns7.yahoo.com.<br>
yahoo.it. 10800 IN NS ns3.yahoo.com.<br>
;; Received 136 bytes from 194.0.16.215#53(a.dns.it) in 136 ms<br>
<br>
yahoo.it. 300 IN A 106.10.212.24<br>
yahoo.it. 300 IN A 98.137.236.24<br>
yahoo.it. 300 IN A 77.238.184.24<br>
yahoo.it. 300 IN A 212.82.102.24<br>
yahoo.it. 300 IN A 74.6.50.24<br>
yahoo.it. 86400 IN NS ns3.yahoo.com.<br>
yahoo.it. 86400 IN NS ns2.yahoo.com.<br>
yahoo.it. 86400 IN NS ns1.yahoo.com.<br>
yahoo.it. 86400 IN NS ns4.yahoo.com.<br>
yahoo.it. 86400 IN NS ns5.yahoo.com.<br>
;; Received 380 bytes from 68.180.131.16#53(ns1.yahoo.com) in 173 ms<br>
<br>
same problem... bind is too slow...<br>
<br>
the situation change (very fast) if I use bind like resolver<br>
<br>
forwarders {<br>
8.8.8.8;<br>
}<br>
<br>
I don't understand why without resolver my bind is so slow... how I can <br>
audit the problem?<br>
<br>
thanks! :-)<br>
<br>
>> but testing 127.0.0.1, bind keep also 4000/5000ms to resolve a query<br>
><br>
><br>
>> forwarders {<br>
>> 127.0.0.1;<br>
>> }<br>
><br>
> do you forward to yourself???<br>
<br>
unfortunately looking for bind on internet there're many wrong howto :-/<br>
<br>
Pol<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div>
</span></font>
</body>
</html>