LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 01-28-2011, 07:33 AM   #1
wischad
LQ Newbie
 
Registered: Apr 2009
Location: Madison, WI
Distribution: Red Hat, CentOS, SUSE
Posts: 21

Rep: Reputation: 1
BIND - How do you remove "Authoritative nameservers" in UDP message?


We have our Microsoft AD DNS servers replicating to our Sidewinder - which uses BIND for its DNS server. We ran into a situation where reverse lookup requests to the Sidewinder returned back a truncated UDP packet to the DNS client. When we added another DNS Microsoft Domain Controller, it added that name in the authoritative nameservers section of the UDP message which put it beyond the 512 byte limit. It was at about 500 bytes before we added the domain controller - then it moved to 529 which caused BIND to set the truncation flag bit in the UDP header causing the DNS client to come back in TCP mode to get the full message.

Microsoft DNS doesn't send back the "Authoritative nameservers" section in its UDP responses to reverse lookups - they probably learned that the hard way and took it out and only send back the Question and Answer section.

Is there a way to modify BIND to not send the "Authoritative nameservers" section in its UDP responses and only the Question and Answer?
 
Old 01-28-2011, 10:29 AM   #2
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,292

Rep: Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697
Hi,

You can use:
Code:
max-udp-size 512;
edns-udp-size 512;
to limit each packet to 512 bytes. In your case just max-udp-size should do.

Regards
 
Old 01-29-2011, 08:49 AM   #3
wischad
LQ Newbie
 
Registered: Apr 2009
Location: Madison, WI
Distribution: Red Hat, CentOS, SUSE
Posts: 21

Original Poster
Rep: Reputation: 1
Wouldn't the truncation bit still be set by BIND on the Sidewinder then? Or does the act of limiting this remove the "Authentication nameservers" section of the UDP reverse lookup return packet?

Thanks.
 
Old 01-29-2011, 11:53 AM   #4
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,292

Rep: Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697Reputation: 1697
Quote:
Wouldn't the truncation bit still be set by BIND on the Sidewinder then?
Yes, I guess the truncation bit will be set as the response still does not fit in 512 bytes.
Quote:
Or does the act of limiting this remove the "Authentication nameservers" section of the UDP reverse lookup return packet?
No it won't. But reading the bind documentation, I've found the option:
Code:
minimal-responses yes;
that removes the Authority section in the response. So I guess that will do in your case

Regards
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Evolution - How can I remove the "On [date] [person] wrote:" message? jsteel Linux - General 2 03-24-2010 04:47 AM
error message "add remove program" wesam2004 Fedora 8 02-06-2007 04:54 PM
How do I find out what are the authoritative nameservers for the domain? bwoodwar Linux - Networking 3 09-13-2005 11:18 PM
SuSE 9.2 XDM turn "off" authoritative DNS queries confused-but-committ Linux - Software 1 07-29-2005 05:32 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:09 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration