Re: Some servvices on my edge box slow to reply

From: clvrmnky (clvrmnky-uunet_at_coldmail.com.invalid)
Date: 09/21/04 

Date: Tue, 21 Sep 2004 16:47:32 -0400

On 21/09/2004 2:12 PM, Dave Uhring wrote:

> On Tue, 21 Sep 2004 13:50:48 -0400, clvrmnky wrote:
>
>
>>On 21/09/2004 1:36 PM, Dave Uhring wrote:
>
>
>>>What is in /etc/resolv.conf?
>>>
>>
>>search mydomain.org
>>nameserver 127.0.0.1
>>nameserver aaa.bbb.ccc.ddd
>>nameserver aaa.bbb.ccc.eee
>>lookup file bind
>>
>>When I remove the 127.0.0.1, arp -a and netstat -r return reasonably
>>promptly. I am unable to test from one of the nodes on the inside right
>>now, as I am at work.
>
>
> What do you get when doing 'host' or 'nslookup' of the hostnames and IP
> addresses on the 10.0.0.0 network? Is the nameserver actually working,
> particularly in reverse mode?
>
10.0.0.10-10.0.0.20 are DHCP supplied internal addresses (not
10.0.0.11-20, as I said earlier.) 10.0.0.254 is the IP of the internal
NIC of the edge box.

[...]
clvrmnky@martini:~ # time nslookup 10.0.0.10
Server: localhost
Address: 127.0.0.1

*** localhost can't find 10.0.0.10: Server failed

real 1m11.335s
user 0m0.000s
sys 0m0.016s
clvrmnky@martini:~ #
clvrmnky@martini:~ # time host -a -v 10.0.0.10
Query about 10.0.0.10 for record types ANY
Finding reverse mapping for 10.0.0.10 ...
Nameserver not responding
10.0.0.10 ANY record not found, try again

real 0m48.151s
user 0m0.031s
sys 0m0.008s
clvrmnky@martini:~ #
clvrmnky@martini:~ # time nslookup 10.0.0.254
Server: localhost
Address: 127.0.0.1

*** localhost can't find 10.0.0.254: Server failed

real 1m12.094s
user 0m0.016s
sys 0m0.016s
clvrmnky@martini:~ #
clvrmnky@martini:~ # time host -a -v 10.0.0.254
Query about 10.0.0.254 for record types ANY
Name: martini.clevermonkey.org
Address: 10.0.0.254
Aliases: martini www music

real 0m0.031s
user 0m0.008s
sys 0m0.023s
[...]

Hostname->IP lookups work well, so I'm not reporting them here.
Obviously, one generally does not do hostname lookups for DHCP supplied
addresses, as these hostnames rarely exist.

I'm sure the DHCP supplied addresses used to fail a lot faster
yesterday. I've changed nothing in my resolver, named or dhcpd setup.
I have no idea what to do for reverse lookups that will always fail,
like the DHCP supplied ones.

Of course, reverse lookups return faster if I place bogus lines in
/etc/hosts for the DHCP supplied IPs. Once I hit BIND, I'm in trouble.
  For example, the "10.0.0.255" (broadcast?) entry in the arp table
takes forever to return now. This was never the case in the past.

>
>>I bumped up debugging in named, though I'm not sure what I'm looking at.
>
>
> Any messages should appear in /var/log/daemon.
>
Hmmm. Seems to log to /var/named/namedb/named.run on OBSD 3.1.
/var/log/daemon shows no new info when I bump up the logging to even
unreasonable levels.

Relevant Pages

  • Re: Disabling Netbios reverse lookups
    ... good as disabling NB reverse lookups from the client in the first place, ... You might try changing the NetBIOS name resolution registry entry to = 02, ...
    (microsoft.public.win2000.security)
  • Re: Dns 2003 conditonal forward
    ... Forward lookups work fine, reverse ... > Is this the way conditional forwarding is suppose to work? ... Are you asking about the reverse lookups on the external domains? ...
    (microsoft.public.windows.server.dns)
  • Re: IP filtering based on corresponding MX records
    ... I don't think Exchange can do this. ... I'm not sure if you're trying to incoporate this as part of your SPAM ... lookups does not comply with RFC protocol. ... I'd agree that reverse lookups are of dubious value. ...
    (microsoft.public.exchange.admin)