Strange DNS replies.

jimdaworm · 02-04-2009, 03:17 AM

Hi Everyone,

I have been trying to troubleshoot some 404 errors I have been getting sometimes/randomly when I am trying to update aptitude.

Can anyone explain the below?

Code:

debby:/home/adam# traceroute http.us.debian.org
traceroute to http.us.debian.org (78.141.176.35), 30 hops max, 60 byte packets
 1  mygateway1.ar7 (10.0.0.1)  1.445 ms  1.751 ms  1.989 ms
 2  * * *
 3  145.Red-80-58-121.staticIP.rima-tde.net (*.*.*.*)  332.033 ms  332.949 ms  333.766 ms
 4  So6-0-0-0-grtmadpe3.red.telefonica.wholesale.net (84.16.8.121)  334.691 ms  335.445 ms  346.164 ms
 5  So6-3-0-0-grtparix3.red.telefonica-wholesale.net (84.16.12.118)  373.668 ms  374.722 ms So7-0-0-0-grtparix3.red.telefonica-wholesale.net (213.140.37.18)  388.364 ms
 6  Tiscali-7-1-0-0-grtparix3.red.telefonica-wholesale.net (213.140.53.146)  389.319 ms  383.656 ms  396.974 ms
 7  xe-0-0-0.fra20.ip.tiscali.net (89.149.186.65)  397.864 ms  128.508 ms xe-2-0-0.fra20.ip.tiscali.net (89.149.186.73)  128.677 ms
 8  ptlu-gw.ip.tiscali.net (213.200.64.58)  342.638 ms  342.892 ms  343.327 ms
 9  213.166.61.206 (213.166.61.206)  117.650 ms  93.723 ms  97.923 ms
10  download.skype.com (78.141.176.35)  203.168 ms  203.403 ms  203.735 ms
debby:/home/adam#

Code:

debby:/home/adam# ping http.us.debian.org
PING http.us.debian.org (78.141.176.35) 56(84) bytes of data.
64 bytes from download.skype.com (78.141.176.35): icmp_seq=1 ttl=50 time=101 ms
64 bytes from download.skype.com (78.141.176.35): icmp_seq=2 ttl=50 time=96.3 ms
64 bytes from download.skype.com (78.141.176.35): icmp_seq=3 ttl=49 time=124 ms
64 bytes from download.skype.com (78.141.176.35): icmp_seq=4 ttl=51 time=96.2 ms
64 bytes from download.skype.com (78.141.176.35): icmp_seq=5 ttl=49 time=97.8 ms
64 bytes from download.skype.com (78.141.176.35): icmp_seq=6 ttl=50 time=96.9 ms
^C
--- http.us.debian.org ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5026ms
rtt min/avg/max/mdev = 96.201/102.139/124.373/10.082 ms
debby:/home/adam#

This is what I got from an online website when I asked it to ping the same url:

Code:

--- PING http.us.debian.org (35.9.37.225) 56(84) bytes of data. ---
64 bytes from ike.egr.msu.edu (35.9.37.225): icmp_seq=1 ttl=53 time=117 ms
64 bytes from ike.egr.msu.edu (35.9.37.225): icmp_seq=2 ttl=53 time=119 ms
64 bytes from ike.egr.msu.edu (35.9.37.225): icmp_seq=3 ttl=53 time=118 ms
64 bytes from ike.egr.msu.edu (35.9.37.225): icmp_seq=4 ttl=53 time=118 ms

bathory · 02-04-2009, 04:08 AM

It seems that the dns used in the second case is the correct one:

Code:

 dig http.us.debian.org

; <<>> DiG 9.6.0-P1 <<>> http.us.debian.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36028
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 3, ADDITIONAL: 0

;; QUESTION SECTION:
;http.us.debian.org.            IN      A

;; ANSWER SECTION:
http.us.debian.org.     300     IN      A       64.50.238.52
http.us.debian.org.     300     IN      A       128.30.2.36
http.us.debian.org.     300     IN      A       35.9.37.225
http.us.debian.org.     300     IN      A       64.50.236.52

;; AUTHORITY SECTION:
debian.org.             1428    IN      NS      raff.debian.org.
debian.org.             1428    IN      NS      rietz.debian.org.
debian.org.             1428    IN      NS      klecker.debian.org.

;; Query time: 112 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Feb  4 12:04:29 2009
;; MSG SIZE  rcvd: 161

Check your /etc/resolv.conf and use another dns that is more reliable than the one you use now.

Regards

rossonieri#1 · 02-04-2009, 04:31 AM

hi jim,

Quote:

--- PING http.us.debian.org (35.9.37.225) 56(84) bytes of data. ---
64 bytes from ike.egr.msu.edu (35.9.37.225): icmp_seq=1 ttl=53 time=117 ms
64 bytes from ike.egr.msu.edu (35.9.37.225): icmp_seq=2 ttl=53 time=119 ms

you mean why there are 2 different hostname?
its a normal behavior since any internet DNS record doesnt have to be match with a real target name.

so it - for example : the ike.egr.msu.edu is the real target hostname - could be translated to any name on the internet DNS record like http2.us.debian.org, http3.us.debian.org but they still use the same real target host - which is ike.egr.msu.edu.

and, what you've pinged is the real target which answer it.

and bathory has given you a better resolution to try changing the DNS server for better name resolution.

HTH.