- Test - lists.nanog.org

Hidden name servers?
by Sean Donelan 27 Jan '01

27 Jan '01

How do I get name servers added to the COM TLD zone file which are not listed in the NSI Registry WHOIS database? Domain Name: MICROSOFT.COM Registrar: NETWORK SOLUTIONS, INC. Whois Server: whois.networksolutions.com Referral URL: www.networksolutions.com Name Server: DNS4.CP.MSFT.NET Name Server: DNS5.CP.MSFT.NET Name Server: DNS7.CP.MSFT.NET Name Server: DNS6.CP.MSFT.NET Updated Date: 24-jan-2001 Name Server LookUp for microsoft.com Search Type: NS - Authoritative name server Name Server: a.root-servers.net Header: ID=29916, QR=Response, Opcode=QUERY, RCODE=NO ERROR Authoritative Answer=No, Truncation=No Recursion Desired=Yes, Recursion Available=No QDCOUNT=1, ANCOUNT=8, NSCOUNT=0, ARCOUNT=8 Question: Name=microsoft.com, QTYPE=NS, QCLASS=1 Answer Section: - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=18 Name Server=DNS4.CP.MSFT.NET - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=7 Name Server=DNS5.CP.MSFT.NET - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=7 Name Server=DNS7.CP.MSFT.NET - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=7 Name Server=DNS6.CP.MSFT.NET - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=20 Name Server=Z1.MSFT.AKADNS.COM - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=5 Name Server=Z2.MSFT.AKADNS.COM - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=5 Name Server=Z6.MSFT.AKADNS.COM - Name=microsoft.com Type=NS, Class=1, TTL=172800 (2 Days), RDLENGTH=5 Name Server=Z7.MSFT.AKADNS.COM Additional Records Section: - Name=DNS4.CP.MSFT.NET Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.46.138.11 - Name=DNS5.CP.MSFT.NET Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.46.138.12 - Name=DNS7.CP.MSFT.NET Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.46.138.21 - Name=DNS6.CP.MSFT.NET Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.46.138.20 - Name=Z1.MSFT.AKADNS.COM Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=216.32.118.104 - Name=Z2.MSFT.AKADNS.COM Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=32.96.80.17 - Name=Z6.MSFT.AKADNS.COM Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=207.229.152.20 - Name=Z7.MSFT.AKADNS.COM Type=A, Class=1, TTL=172800 (2 Days), RDLENGTH=4 IP Address=213.161.66.158

3 2

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> > BTW, I consider RFC2870 antiquated > > Is it antiquated because it does not use the Roeland Meyer > definition of > "root server"? No, it is antiquated because of the reasons which I stated, and you cut out.

1 0

RE: How common is lack of DNS server diversity?
by Sean Donelan 27 Jan '01

27 Jan '01

On Sat, 27 January 2001, Roeland Meyer wrote: > <Root server> ::= Any DNS server that has final authority for a <domain > tier/level>; Wouldn't a better term be "authoritative server"? It states what it is, and doesn't have the semantic overload of your use of "root server." Unless, of course, you are in marketing in which case you want semantic overload such as Microsoft's use of "Digital Nervous System" (DNS) to create confusion. Root Server == An authoritative server for the "." (root) of the domain name system TLD Server == An authoritative server for a Top Level Domain, such as the generic TLDs (COM, EDU, INT) and country code TLDs (CA, AU, ZA)

1 0

RE: How common is lack of DNS server diversity?
by Tony Rall 27 Jan '01

27 Jan '01

Regarding "search", I was simply referring to the commonly used dns terminology referring to the "search list". See /etc/resolv.conf on any unix system or "DNS and Bind V3", page 102. Wait a minute, I see where your usage may have originated. W95 network config refers to the nameserver list as "DNS Server Search Order", and to the domain list as the "Domain Suffix Search Order". MS doesn't use this wording in W2k. As far as specifying multiple nameservers (the "nameserver" directive in resolv.conf, or "DNS server addresses" in Win2k), as I said before I tested it and it worked fine in Win2k. Test procedure: Under "Advanced TCP/IP Settings", DNS tab, remove all nameserver addresses, add the address of a non-existent machine, add the address of a working nameserver. Reboot (if you're not doing this with Netswitcher). Test. All services work fine. Nslookup gives you an idea about what is happening under the covers: C:\>nslookup trall2 DNS request timed out. timeout was 2 seconds. *** Can't find server name for address 9.1.25.192: Timed out <- the non-existent nameserver Server: hawk.almaden.ibm.com Address: 9.1.8.254 <- the working nameserver Name: trall2.almaden.ibm.com Address: 9.1.77.83 Nslookup will retry the nameserver list each time, resulting in a resolution delay. But the IP stack resolver remembers which server is working and doesn't retry the bad ones unless needed - there is no resolution delay. Feel free to test this on any other operating system and report your results. Tony Rall Roeland Meyer <rmeyer(a)mhsc.com> on 2001-01-27 11:10:34 To: Tony Rall/Almaden/IBM@IBMUS, Roeland Meyer <rmeyer(a)mhsc.com> cc: nanog(a)merit.edu Subject: RE: How common is lack of DNS server diversity? > From: Tony Rall [mailto:trall@almaden.ibm.com] > Sent: Saturday, January 27, 2001 10:54 AM > > >MS DNS, WinNT4 and below, have broken search algorithm > implementations. > >DDNS, Win2K, is currently untested. > > Search algorithm? I thought we were talking about making > full use of the > dns server list - i.e., if first server doesn't respond try > the next one in > the list. I think, *that* is called a search algorithm. Try it at root level, with WinNT, you'll find that it doesn't work. Better yet, try it with BIND8 (*nix, of course) too, and compare the results. If your test doesn't produce the same results, please send test-plan, scripts, and methods to me. I'd be very interested.

1 0

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> From: Tony Rall [mailto:trall@almaden.ibm.com] > Sent: Saturday, January 27, 2001 10:54 AM > > >MS DNS, WinNT4 and below, have broken search algorithm > implementations. > >DDNS, Win2K, is currently untested. > > Search algorithm? I thought we were talking about making > full use of the > dns server list - i.e., if first server doesn't respond try > the next one in > the list. I think, *that* is called a search algorithm. Try it at root level, with WinNT, you'll find that it doesn't work. Better yet, try it with BIND8 (*nix, of course) too, and compare the results. If your test doesn't produce the same results, please send test-plan, scripts, and methods to me. I'd be very interested.

1 0

RE: How common is lack of DNS server diversity?
by Tony Rall 27 Jan '01

27 Jan '01

>MS DNS, WinNT4 and below, have broken search algorithm implementations. >DDNS, Win2K, is currently untested. Search algorithm? I thought we were talking about making full use of the dns server list - i.e., if first server doesn't respond try the next one in the list. Win2k, at least, has no problem doing this. (I do not remember having any problem with the domain search list in previous MS OSs. That is, if I specify almaden.ibm.com and ibm.com, it will find xyz.ibm.com if I just use the name xyz and xyz.almaden.ibm.com does not exist.) Tony Rall

1 0

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> It appeared from the reports/complaints we > received that a number of client systems/resolvers had decided to only > request data from the nonfunctional DNS server and despite > failing on that > wouldn't ask our other listed DNS servers. They therefore could not > resolve addresses for otherwise functional network assets. I seem to > remember this was somehow related to systems running Microsoft OS's. > Am I confused or could it be that Microsoft knows something > about this? MS DNS, WinNT4 and below, have broken search algorithm implementations. DDNS, Win2K, is currently untested.

1 0

Blackouts again?
by Roy 27 Jan '01

27 Jan '01

This may just be a coincidence but our NOC is in the dark (again). Power went out at 6AM (almost exactly). Since we already were blacked out once when the crisis started, we thought we were safe for a while so this may be a real failure. PG&E's computer did accept our power outage report. Roy Engehausen

1 1

RE: DNS availability
by Roeland Meyer 27 Jan '01

27 Jan '01

> From: richb(a)pioneer.ci.net [mailto:richb@pioneer.ci.net] > Sent: Friday, January 26, 2001 8:24 AM > > Christian Nielsen <cnielsen(a)nielsen.net> wrote: > > ultradns does this and has a great product. > > Interesting to read the faq on UltraDNS's website: > > > Q. I read that your service is supposed to make use of > several servers > > all over the world, but you only give people two server addresses to > > provide to their registrar. How do I make use of all the other > > servers? > > > A. The two server addresses you supply your registrar when > you set up > > a domain on the Managed DNS Service system are actually 'virtual' > > addresses that will route to the best possible server on > our network, > > based on a number of factors. This highly intelligent > mechanism allows > > you to achieve full redundancy and reliability with only two name > > server addresses actually listed. In fact, if the registrar would > > allow you to do so, you could achieve the same level of reliability > > with only one name server address. > Or maybe there have been a few extensions to BGP which I haven't > learned about...;-) It's not BGP! see www.3dns.com and www.f5.com for similar technology. As well as a clue or two. You might also ask yourself the difference between packet routing and query routing. While you're at it, better also ask how those wizards make cluster load balancing work. "Sufficiently advanced technology is indistinguishable from magic, to the uninitiated" paraphrased from Arthur C. Clark

2 1

Re: Proactive steps to prevent DDOS?
by Sean Donelan 27 Jan '01

27 Jan '01

On Fri, 26 January 2001, RJ Atkinson wrote: > > At 19:15 26/01/01, Sean Donelan wrote: > > >Help me, what proactive steps can I take to protect my network from a DDOS? > > A good starting point is to review the past NANOG presentations. > URL for NANOG is: > http://www.nanog.org Most are suggestions for what other networks can do to prevent them from being a source of a DDOS attack. There is less help for what the target of a DDOS can do.

3 2