On Fri, Mar 19, 2004 at 02:54:37AM +0100, [EMAIL PROTECTED] wrote:
> I have set up a FreeBSD (5.2.1-RELEASE) box acting as a gateway and
> running version 8.3.7-REL of BIND. For testing purposes my
> configuration file looks as follows:
>
> options {
> directory "/etc/namedb";
> pid-file "/var/run/named/pid";
>
> forward only;
>
> forwarders {
> 195.62.99.42;
> 195.62.97.177;
> };
>
> query-source address * port 53;
> };
>
> zone "." {
> type hint;
> file "named.root";
> };
>
> This setup (actually a replacement for just adding the two nameservers
> to resolv.conf) works fine with lookup tools like "host", "nslookup",
> or "dnsquery". However, when I try to telnet or ftp a server whose
> name is a CNAME record, it takes about 77 seconds until the lookup is
> complete. This appears quite odd to me, as "host" does the lookup
> perfectly well and fast. Connections to A name records are no problem
> however.
How long does it take to do a reverse-lookup on the result of the
previous lookups? The applications may be trying to resolve a PTR
record for the final IP address they end up with.
> My first assumption was that "ftp" or "telnet" were not doing lookups
> properly. But modifying resolv.conf in a way that it uses the two
> nameservers directly (instead of the local nameserver) solved the
> CNAME lookup problem.
Strange. The first issue wouldn't really explain that. You can try the
following two tests and compare the difference,
1) Put the two external servers in resolv.conf, and run,
# tcpdump -s512 port 53
And try your ftp or telnet.
2) Put 127.0.0.1 back into resolv.conf, clear the cache of the local
BIND (not sure of a way to do that other than killing and
restarting in 8.x.x), and run the same thing,
# tcpdump -s512 port 53
And again try the ftp or telnet.
--
Crist J. Clark | [EMAIL PROTECTED]
| [EMAIL PROTECTED]
http://people.freebsd.org/~cjc/ | [EMAIL PROTECTED]
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
