DDNS updates for secondary DNS server

kraishak kraishak.edu at gmail.com
Thu Apr 29 09:56:19 UTC 2021


I tried tcpdump, I can see lot of other traffic when I was searching to
filter DDNS packets I found the below one
" tcpdump 'udp[0xa] & 0x78 = 0x28'"

Case1) when both primary and secondary DNS server are up and running 
I see the packets flowing from my DHCP server to DNS primary server

tcpdump 'udp[0xa] & 0x78 = 0x28'
09:36:25.836650 IP dhcpremote.36057 > 192.168.0.45.domain: 32269 update [1a]
[2n] SOA? tst.com. (113)
09:36:25.838185 IP 192.168.0.45.domain > dhcpremote.36057: 32269 update-
1/2/0 (Class 254) ANY (113)
09:36:25.840153 IP dhcpremote.36057 > 192.168.0.45.domain: 37754 update [1a]
[2n] SOA? tst.com. (113)
09:36:25.840716 IP 192.168.0.45.domain > dhcpremote.36057: 37754 update-
1/2/0 (Class 254) ANY (113)
09:36:25.842929 IP dhcpremote.36057 > 192.168.0.45.domain: 50378 update [1a]
[2n] SOA? tst.com. (113)
09:36:25.843558 IP 192.168.0.45.domain > dhcpremote.36057: 50378 update-
1/2/0 (Class 254) ANY (113)
09:36:25.935787 IP dhcpremote.36057 > 192.168.0.45.domain: 45452 update [1a]
[2n] SOA? tst.com. (113)
09:36:25.936482 IP 192.168.0.45.domain > dhcpremote.36057: 45452 update-
1/2/0 (Class 254) ANY (113)
09:36:25.937238 IP dhcpremote.36057 > 192.168.0.45.domain: 57717 update [1a]
[2n] SOA? tst.com. (113)
09:36:25.937644 IP 192.168.0.45.domain > dhcpremote.36057: 57717 update-
1/2/0 (Class 254) ANY (113)
I can see DNS records get added to the zone on primary DNS server
 
Case2)I stopped primary DNS server and only secondary is running 
At this time initially I saw the traffic trying to communicate to primary
and later it tried to communicate to secondary also but on the secondary
server I don't see any updates for that zone 

9:47:50.448729 IP dhcpremote.36057 > 192.168.0.45.domain: 28079 update [1a]
[2n] SOA? tst.com. (113)
09:47:50.450722 IP dhcpremote.36057 > 192.168.0.45.domain: 56210 update [1a]
[2n] SOA? tst.com. (113)
09:47:50.452350 IP dhcpremote.36057 > 192.168.0.45.domain: 35555 update [1a]
[2n] SOA? tst.com. (113)
09:47:50.454332 IP dhcpremote.36057 > 192.168.0.45.domain: 6159 update [1a]
[2n] SOA? tst.com. (113)
09:47:50.456659 IP dhcpremote.36057 > 192.168.0.45.domain: 46788 update [1a]
[2n] SOA? tst.com. (113)
09:47:53.451803 IP dhcpremote.36057 > 192.168.0.45.domain: 28079 update [1a]
[2n] SOA? tst.com. (113)
09:47:53.451882 IP dhcpremote.36057 > 192.168.0.45.domain: 56210 update [1a]
[2n] SOA? tst.com. (113)
09:47:53.452444 IP dhcpremote.36057 > 192.168.0.45.domain: 35555 update [1a]
[2n] SOA? tst.com. (113)
09:47:53.454400 IP dhcpremote.36057 > 192.168.0.45.domain: 6159 update [1a]
[2n] SOA? tst.com. (113)
09:47:53.456731 IP dhcpremote.36057 > 192.168.0.45.domain: 46788 update [1a]
[2n] SOA? tst.com. (113)
09:47:56.452149 IP dhcpremote.36057 > 192.168.0.45.domain: 28079 update [1a]
[2n] SOA? tst.com. (113)
09:47:56.452188 IP dhcpremote.36057 > 192.168.0.45.domain: 56210 update [1a]
[2n] SOA? tst.com. (113)
09:47:56.452542 IP dhcpremote.36057 > 192.168.0.45.domain: 35555 update [1a]
[2n] SOA? tst.com. (113)
09:47:56.454501 IP dhcpremote.36057 > 192.168.0.45.domain: 6159 update [1a]
[2n] SOA? tst.com. (113)
09:47:56.456806 IP dhcpremote.36057 > 192.168.0.45.domain: 46788 update [1a]
[2n] SOA? tst.com. (113)
09:47:59.455189 IP dhcpremote.36057 > 192.168.0.45.domain: 56210 update [1a]
[2n] SOA? tst.com. (113)
09:47:59.455220 IP dhcpremote.36057 > 192.168.0.45.domain: 28079 update [1a]
[2n] SOA? tst.com. (113)
09:47:59.455229 IP dhcpremote.36057 > 192.168.0.45.domain: 35555 update [1a]
[2n] SOA? tst.com. (113)
09:47:59.455241 IP dhcpremote.36057 > 192.168.0.45.domain: 6159 update [1a]
[2n] SOA? tst.com. (113)
09:47:59.456869 IP dhcpremote.36057 > 192.168.0.45.domain: 46788 update [1a]
[2n] SOA? tst.com. (113)
09:48:02.458314 IP dhcpremote.36057 > 192.168.0.47.domain: 2904 update [1a]
[2n] SOA? tst.com. (113)
09:48:02.458409 IP dhcpremote.36057 > 192.168.0.47.domain: 51837 update [1a]
[2n] SOA? tst.com. (113)
09:48:02.458463 IP dhcpremote.36057 > 192.168.0.47.domain: 33836 update [1a]
[2n] SOA? tst.com. (113)
09:48:02.458501 IP dhcpremote.36057 > 192.168.0.47.domain: 64762 update [1a]
[2n] SOA? tst.com. (113)
09:48:02.458578 IP dhcpremote.36057 > 192.168.0.47.domain: 58373 update [1a]
[2n] SOA? tst.com. (113)
09:48:02.461798 IP 192.168.0.47.domain > dhcpremote.36057: 2904 update
NotImp- 1/2/0 (Class 254) ANY (113)
09:48:02.462583 IP 192.168.0.47.domain > dhcpremote.36057: 33836 update
NotImp- 1/2/0 (Class 254) ANY (113)
09:48:02.463148 IP 192.168.0.47.domain > dhcpremote.36057: 64762 update
NotImp- 1/2/0 (Class 254) ANY (113)
09:48:02.463678 IP 192.168.0.47.domain > dhcpremote.36057: 58373 update
NotImp- 1/2/0 (Class 254) ANY (113)
09:48:02.464209 IP 192.168.0.47.domain > dhcpremote.36057: 51837 update
NotImp- 1/2/0 (Class 254) ANY (113)


While it is trying to communicate to secondary I can see some different in
packet like "update NotImp " not sure if that means anything to debug





--
Sent from: http://isc-dhcp-users.2343191.n4.nabble.com/


More information about the dhcp-users mailing list