Re: major DNS hiccup

Andrew Haley wrote:
Mike Scott <usenet.10@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Per Hedeland wrote:
In article <E5Rsg.96337$uP.82275@xxxxxxxxxxxxxxxxxxxx> Mike Scott
<usenet.10@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> writes:
If it's ntl (I'm Cambridge too, btw - Harlow) I can't imagine what they're doing. I see reply packets with correct checksums and no noticeable missing packets - so they'd have to be intercepting DNS packets, garbaging and retransmitting them: somehow I doubt ntl could manage that quite so successfully :-)
You still haven't posted any traces from failed lookups - if you do,
maybe someone could figure out just what is wrong with them...

--Per Hedeland
per@xxxxxxxxxxxx

I thought I had :-( I must be getting muddled about what I've posted and what not; sorry.

Anyway, I'm going to check out dnstracer (thanks Chronos) as well again today or tomorrow - the output made my head spin last night - and I'll get back hopefully with detailed info from a definitive failure.

As a postscript to all of this, I have now spoken with several NTL
customers in Cambridge, and they all have experienced the same DNS
problems. It seems that the fix is to point your DNS forwarder at
NTL's own name servers, rather than using using the roots.

I find it hard to imagine what the cause of this might be. Maybe NTL
are even doing this deliberately to reduce their own DNS traffic? Or
maybe it's an attempt at filtering:

http://technology.guardian.co.uk/weekly/story/0,,1807757,00.html

Andrew.

Hmm. That's all about making UK ISPs filter child-p0rn web sites. The UK government is forcing UK broadband users to cover the cost of probably useless filtering, which may have got ntl to break DNS on the way.

Wonderful.

In light of Andrew's comments, I'm not sure there's much point in further 'unaimed' checking of the problems I'm seeing. However, the only thing I can think of that ntl might have done to cause this is install transparent DNS proxies -- although I've never heard of such a thing, I'd assume the idea's at least plausible. Can anyone think of a way of testing this hypothesis?

I guess this isn't strictly a c.u.b.f.misc topic any more. Maybe it should move to a more appropriate group??? Suggestions?

--
Please use the corrected version of the address below for replies.
Replies to the header address will be junked, as will mail from
various domains listed at www.scottsonline.org.uk
Mike Scott Harlow Essex England.(unet -a-t- scottsonline.org.uk)
.

Relevant Pages

  • Re: Cant Resolve Certain internet DNS names
    ... Our firewall was already using 1500 MTU, but the Checkpoint SmartDefense ... Why are some websites using non-RFC compliant packets for DNS? ... > DNS server, but this reduces DNS efficiency because queries that won't fit ...
    (microsoft.public.windows.server.dns)
  • Re: DNS Fixup/Inspect Pix/ASA 7.0 or greater breaking email
    ... emails being sent to AOL and Comcast plus a few other mom and pops to hang ... I have that there is no way that a DNS inspect command could cause only ... long responses have the response dropped, ... 1500 byte packets these days, that they can just send back longer ...
    (comp.dcom.sys.cisco)
  • A paper by Amit Klein (Trusteer): "OpenBSD DNS Cache Poisoning and Multiple O/S Predictable IP ID Vu
    ... DNS transaction ID (OpenBSD ported BIND 9 into their code tree, ... fragmentation ID normalization feature (e.g. "scrub out random- ... packets and raw IP packets. ...
    (Bugtraq)
  • Re: IP Tables DNS issues
    ... >I'm having problem with my IP tables allowing DNS queries, ... ># Log packets with impossible source addresses ... There is significant discussion of the merits of DROP verses DENY ... (send RESET or ICMP Type 3). ...
    (comp.security.firewalls)
  • RE: Firewall Rule Set not allowing access to DNS servers?
    ... I changed the DNS rules as you suggested, and the firewall works perfectly - ... > # Allow out access to my ISP's Domain name server. ... > so your udp packets never match this rule and default to ...
    (freebsd-questions)