Re: MS DNS drops packets, but Bind works fine

Daniel Crichton (danielcCOMPMAN.CO.UK)
Mon, 1 Nov 1999 15:40:50 -0000

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
• Next message: Frank Heyne: "Re: CONCLUSION: Did system event 6008 (unexpected shutdown) dissappear in sp5?"
• Previous message: James E. Leinweber: "Re: MS DNS drops packets, but Bind works fine"
• In reply to: Daniel Crichton: "MS DNS drops packets, but Bind works fine"

On 29 Oct 99, at 9:22, James E. Leinweber wrote:

> Isn't this just the same old 16 character long DNS bug we've seen ever
> since MS-DNS since NT 4 was released? Apparently the query goes
> through a NETBIOS name mangling phase which stomps on the 16th byte,
> but doesn't restore it. Check the archives; it's come up before.

I'd already replied privately to James about this, and it's not the same problem - that's
only for NetBIOS resolution, which is not what I'm doing here. It also happens with hosts
of less or more than 16 chars, so it's not the same problem (try www.bbsonline.co.uk for
the same result).

I found a LogLevel parameter for MS DNS, so I turned it on for
DNS_LOG_LEVEL_ALL_PACKETS (0x0000ffff) and here's what I found for a
lookup on www.tefnut.co.uk:
======
Rcv 194.72.239.11 61c3 Q [0001 D NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Snd 198.41.0.4 280d Q [0000 NOERROR] (0)
Snd 198.41.0.4 3816 Q [0000 NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Rcv 198.41.0.4 280d R Q [0084 A NOERROR] (0)
Rcv 198.41.0.4 3816 R Q [0080 NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Snd 128.86.8.25 3816 Q [0000 NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Snd 195.66.240.130 3816 Q [0000 NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Rcv 194.72.239.11 61c3 Q [0001 D NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Snd 128.86.8.25 301d Q [0000 NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Rcv 195.66.240.130 3816 R Q [0080 NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Snd 198.41.0.4 1820 Q [0000 NOERROR] (4)map1(3)dns(3)gxn(3)net(0)
Rcv 128.86.8.25 301d R Q [8080 R NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Snd 195.224.255.22 301d Q [0000 NOERROR] (3)www(6)tefnut(2)co(2)uk(0)
Rcv 195.224.255.22 301d R Q [0084 A NOERROR] (3)www[C026][ERROR offset at
00C9283E to higher byte in packet 00C92852]

DNS Server encountered name offset exceeding packet length.
Offset is the error.
DNS Server encountered invalid domain name in packet from 195.224.255.22.
Packet is rejected.
DNS Server encountered invalid domain name in packet from 195.224.255.22.
Packet is rejected.
======

plus another 3 lots of [ERROR offset ...] entries for the other 3 name servers that are
listed for this host.

I don't know whether this is an MS DNS bug, a problem with GXN, or a mix of the 2.

I've verified that BindNT (I'm trying the one from Software.com) can resolve it OK, I guess
it's a little more flexible in what it returns to the client instead of discarding packets. So
for the moment I have MS DNS as my primary (that way I can admin using DNS Manager
from my Workstation desktop), and Bind as my secondary (so I can resolve hosts that
MS DNS won't); not too bad a solution (I hope!), but I'd rather that MS DNS can handle
problems a little more like Bind.

Dan

---
D.C. Crichton                 email: danielccompman.co.uk
Senior Systems Analyst        tel:   +44 (0)121 706 6000
Computer Manuals Ltd.         fax:   +44 (0)121 606 0477
Computer book info on the web:
   http://computer-manuals.co.uk/

• Next message: Frank Heyne: "Re: CONCLUSION: Did system event 6008 (unexpected shutdown) dissappear in sp5?"
• Previous message: James E. Leinweber: "Re: MS DNS drops packets, but Bind works fine"
• In reply to: Daniel Crichton: "MS DNS drops packets, but Bind works fine"

This archive was generated by hypermail 2.0b3 on Mon Nov 01 1999 - 12:49:53 CST