Re: 9.18 BIND not resolving .gov.bd site

[Marco M.]

Am 30.10.2023 um 12:25:32 Uhr schrieb Mosharaf Hossain:

> mofa.gov.bd.86400   IN  NS  ns1.bcc.gov.bd.
> mofa.gov.bd.86400   IN  NS  ns2.bcc.gov.bd.
> couldn't get address for 'ns1.bcc.gov.bd': not found
> couldn't get address for 'ns2.bcc.gov.bd': not found
> dig: couldn't get address for 'ns1.bcc.gov.bd': no more
> root@ns1:/etc/bind#

I can resolve them, but only A records exist.
Please try it again.

dig a ns2.bcc.gov.bd
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: 9.18 BIND not resolving .gov.bd site

[Lefteris Tsintjelis via bind-users]

Everything looks good from here in a Debian with 9.18

# nslookup mofa.gov.bd
Server: 193.93.164.194
Address:193.93.164.194#53

Non-authoritative answer:
Name:   mofa.gov.bd
Address: 103.163.210.121
Name:   mofa.gov.bd
Address: 103.163.210.117

# dig ns mofa.gov.bd

; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> ns mofa.gov.bd
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10354
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mofa.gov.bd.   IN  NS

;; ANSWER SECTION:
mofa.gov.bd.31394   IN  NS  ns2.bcc.gov.bd.
mofa.gov.bd.31394   IN  NS  ns1.bcc.gov.bd.

;; ADDITIONAL SECTION:
ns1.bcc.gov.bd. 31394   IN  A   114.130.54.123
ns2.bcc.gov.bd. 31394   IN  A   114.130.54.124

;; Query time: 0 msec
;; SERVER: 193.93.164.194#53(193.93.164.194) (UDP)
;; WHEN: Mon Oct 30 10:24:37 EET 2023
;; MSG SIZE  rcvd: 118

On 30/10/2023 9:46, Marco M. wrote:

Am 30.10.2023 um 12:25:32 Uhr schrieb Mosharaf Hossain:


mofa.gov.bd.86400   IN  NS  ns1.bcc.gov.bd.
mofa.gov.bd.86400   IN  NS  ns2.bcc.gov.bd.
couldn't get address for 'ns1.bcc.gov.bd': not found
couldn't get address for 'ns2.bcc.gov.bd': not found
dig: couldn't get address for 'ns1.bcc.gov.bd': no more
root@ns1:/etc/bind#


I can resolve them, but only A records exist.
Please try it again.

dig a ns2.bcc.gov.bd


--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: 9.18 BIND not resolving .gov.bd site

[Timothe Litt]

On 30-Oct-23 03:46, Marco M. wrote:

Am 30.10.2023 um 12:25:32 Uhr schrieb Mosharaf Hossain:


mofa.gov.bd.86400   IN  NS  ns1.bcc.gov.bd.
mofa.gov.bd.86400   IN  NS  ns2.bcc.gov.bd.
couldn't get address for 'ns1.bcc.gov.bd': not found
couldn't get address for 'ns2.bcc.gov.bd': not found
dig: couldn't get address for 'ns1.bcc.gov.bd': no more
root@ns1:/etc/bind#

I can resolve them, but only A records exist.
Please try it again.

dig a ns2.bcc.gov.bd


When encountering these sorts of errors, particularly if not a DNS 
expert, the easiest diagnostic to use is https://dnsviz.net


It's graphical, detailed and while oriented toward DNSSEC, detects many 
other misconfigurations.


Fix the errors and warnings shown at 
https://dnsviz.net/d/mofa.gov.bd/dnssec/ and retest.



Timothe Litt
ACM Distinguished Engineer
--
This communication may not represent the ACM or my employer's views,
if any, on the matters discussed.



OpenPGP_signature.asc
Description: OpenPGP digital signature
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

RE: 9.18 BIND not iterated over all authoritative nameservers

[Michael Martinell via bind-users]

Thanks to all who responded. Putting qname-minimization disabled; in named.conf 
resolves the issue in my testing.

I did try specifying relaxed (which appears to be the default), but that didn’t 
work either.
I agree it would be great if the far ends would make sure what they publish is 
correct, but it will take a large company to push them to do so.



Michael Martinell
Network/Broadband Technician
Interstate Telecommunications Coop., Inc.
From: bind-users  On Behalf Of Paul Stead
Sent: Saturday, October 28, 2023 11:35 AM
Cc: bind-users@lists.isc.org
Subject: Re: 9.18 BIND not iterated over all authoritative nameservers

I wasn't

On Sat, Oct 28, 2023, 5:23 PM Ondřej Surý 
mailto:ond...@isc.org>> wrote:
Please don’t use Postel’s Law as excuse for implementations that break 
standards: 
https://datatracker.ietf.org/doc/html/rfc9413
--
Ondřej Surý — ISC (He/Him)

My working hours and your working hours may be different. Please do not feel 
obligated to reply outside your normal working hours.


On 28. 10. 2023, at 17:50, Paul Stead 
mailto:paul.st...@gmail.com>> wrote:

As a previous ISP admin I too have come across similar situations and 
frustrations.

I can only say that Google and Cloudflare seem to follow Postel's Law moreso 
than BIND.

I agree this perpetuates bad practices but end users aren't interested in 
technical reasoning, especially when "it works everywhere else, you must be 
broken"

Paul

On Sat, Oct 28, 2023, 3:56 PM Rick Frey 
mailto:grib...@gmail.com>> wrote:
As Mark mentions, the NS records gtm.bankeasy.com need 
to be corrected and failure is not due to lack of iterating through all auth 
nameservers (all of the auth nameservers have the bad NS record anyway).

Not sure how many other domains you are running into similar problem, but you 
could disable qname-minimization in 9.18 to mimic previous behavior of 9.16 if 
that number is large.  I believe qname-minimization is a global directive so it 
would remove privacy benefits of QNAME minimization for all recursive queries 
from your nameserver.

As DNS admin of another ISP, I sympathize dealing with failures caused by 
non-compliant authoritative nameservers.  These non-compliant auth nameservers 
can have little motivation to fix, especially when other large ISPs or public 
resolvers (looking at you Google and Cloudflare) don’t enforce DNS standards.   
Many non-compliant nameservers/records would be cleaned up if 
public/centralized DNS providers such as Google/Cloudflare would enforce since 
it would inflict those failures on a much larger user base.

 - Rick




On Oct 27, 2023, at 6:31 PM, Mark Andrews mailto:ma...@isc.org>> 
wrote:



Named now uses NS lookups to perform QNAME minimisation.  If one puts garbage 
in the NS
records then they should expect lookups to fail.  The NS records on both sides 
of a zone
cut are supposed to be IDENTICAL.  This is not a new requirement.  It has been 
this way
since the very beginning.

The bank needs to fix what they publish.

Mark


On 28 Oct 2023, at 02:36, Michael Martinell via bind-users 
mailto:bind-users@lists.isc.org>> wrote:

Hello,
At this point I am hoping that somebody might have a workaround so that we can 
exclude domains from this behavior if they are broken on the far end. Does 
anybody have a workaround for this?
We are a small ISP and run BIND compiled from source. We currently run 9.16.x
Every time we try to move forward with 9.18 customers start to complain that 
they are unable to reach certain websites.  This includes banks, universities, 
and other organizations.
I understand the goal is to get all DNS to RFC 6891, but from a practical 
standpoint, this isn’t working for customers, so we are prevented from 
upgrading either.
Related website:
https://gitlab.isc.org/isc-projects/bind9/-/issues/3152
Our source code compile options:
./configure --with-gnu-ld --with-libxml2 --with-json-c 
--with-openssl=/usr/local/openssl && make && make install && ldconfig



Interstate Telecommunications Coop., Inc.
312 4th Street West • Clear Lake, SD 57226
Phone: (605) 874-8313
michael.martin...@itccoop.com
www.itc-web.com


--
Visit 
https://lists.isc.org/mailman/listinfo/bind-users
 to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for 
more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
--
Visit 
https://lists.isc.org/mailman/listinfo/bind-users
 to unsubscribe from this list

ISC funds the development of this softw

Re: 9.18 BIND not iterated over all authoritative nameservers

[Rainer Duffner]

> Am 30.10.2023 um 16:59 schrieb Michael Martinell via bind-users 
> :
> 
> Thanks to all who responded. Putting qname-minimization disabled; in 
> named.conf resolves the issue in my testing.
> 
> I did try specifying relaxed (which appears to be the default), but that 
> didn’t work either.
> 
> I agree it would be great if the far ends would make sure what they publish 
> is correct, but it will take a large company to push them to do so.
>  


I usually tell people that the other side needs to fix their stuff.

Mostly happens when people fubar their DNSSEC setup.
But this name server stuff (more often then not, it’s some  Load-Balancer 
acting as a DNS-server)

In both cases: I usually ask them if they can be absolutely sure if the other 
side hasn’t been hacked?

You don’t go and try to override broken SSL certificate setups with HSTS, do 
you?

That said, I’m still on 9.16, too.


-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: 9.18 BIND not resolving .gov.bd site

[Mark Andrews]

> On 30 Oct 2023, at 17:25, Mosharaf Hossain  
> wrote:
> 
> mofa.gov.bd.86400   IN  NS  ns1.bcc.gov.bd.
> mofa.gov.bd.86400   IN  NS  ns2.bcc.gov.bd.
> couldn't get address for 'ns1.bcc.gov.bd': not found
> couldn't get address for 'ns2.bcc.gov.bd': not found
> dig: couldn't get address for 'ns1.bcc.gov.bd': no more
> root@ns1:/etc/bind# 

So you got this this point and that is saying that the lookup of
the addresses of the nameservers is failing.  The next step would to
do a 'dig +trace' or a 'dig +trace +all' of those names.

% dig +trace ns1.bcc.gov.bd. +all -4
;; BADCOOKIE, retrying.

; <<>> DiG 9.19.18-dev <<>> +trace ns1.bcc.gov.bd. +all -4
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11927
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 14, AUTHORITY: 0, ADDITIONAL: 27

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: 69a562ec1c50e2280100654052b51e141922bd619839 (good)
;; QUESTION SECTION:
;. IN NS

;; ANSWER SECTION:
. 193742 IN NS b.root-servers.net.
. 193742 IN NS c.root-servers.net.
. 193742 IN NS d.root-servers.net.
. 193742 IN NS g.root-servers.net.
. 193742 IN NS j.root-servers.net.
. 193742 IN NS l.root-servers.net.
. 193742 IN NS i.root-servers.net.
. 193742 IN NS h.root-servers.net.
. 193742 IN NS k.root-servers.net.
. 193742 IN NS a.root-servers.net.
. 193742 IN NS f.root-servers.net.
. 193742 IN NS e.root-servers.net.
. 193742 IN NS m.root-servers.net.
. 193742 IN RRSIG NS 8 0 518400 2023110905 2023102704 46780 . 
CkAeB9x0RdrjpMfUJWlZS8F8YwnNj8KY7CYkukIncgzX1eve21wHBkgF 
kXrIEQP7Atkq4/KYqsgs4fKnFwIkxtEqqDDvkU/635/cYgOFaBKiU5Di 
4sPC5Q/q8jORU4WPM7vg+j7bY48qEaoTImPuT+EQpI4HF5uHekYm9F35 
tJENhmLryMv8K4+072w2eaOTc45wirnVNxhxZ2QK8aZylubq2ELQ43aJ 
GgRmrFhujt8jzi20OvySAq1MNCd3Dy0Xqh99DSu6YkhflypgZXeUEiRV 
8/HB33V9yQBs/GNXjajxSw/NwxLAxMDNv8kdkE08YBWTZLQfPmY/+ZDU FEchxA==

;; ADDITIONAL SECTION:
l.root-servers.net. 135488 IN A 199.7.83.42
g.root-servers.net. 135488 IN A 192.112.36.4
i.root-servers.net. 135488 IN A 192.36.148.17
h.root-servers.net. 135488 IN A 198.97.190.53
k.root-servers.net. 135488 IN A 193.0.14.129
j.root-servers.net. 135488 IN A 192.58.128.30
d.root-servers.net. 135488 IN A 199.7.91.13
b.root-servers.net. 135488 IN A 199.9.14.201
a.root-servers.net. 135488 IN A 198.41.0.4
f.root-servers.net. 135488 IN A 192.5.5.241
e.root-servers.net. 135488 IN A 192.203.230.10
c.root-servers.net. 135488 IN A 192.33.4.12
m.root-servers.net. 135488 IN A 202.12.27.33
l.root-servers.net. 135488 IN  2001:500:9f::42
g.root-servers.net. 135488 IN  2001:500:12::d0d
i.root-servers.net. 135488 IN  2001:7fe::53
h.root-servers.net. 135488 IN  2001:500:1::53
k.root-servers.net. 135488 IN  2001:7fd::1
j.root-servers.net. 135488 IN  2001:503:c27::2:30
d.root-servers.net. 135488 IN  2001:500:2d::d
b.root-servers.net. 135488 IN  2001:500:200::b
a.root-servers.net. 135488 IN  2001:503:ba3e::2:30
f.root-servers.net. 135488 IN  2001:500:2f::f
e.root-servers.net. 135488 IN  2001:500:a8::e
c.root-servers.net. 135488 IN  2001:500:2::c
m.root-servers.net. 135488 IN  2001:dc3::35

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Tue Oct 31 12:04:53 AEDT 2023
;; MSG SIZE  rcvd: 1125

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38819
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 7, ADDITIONAL: 9

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: 69a562ec1c50e2280100654052b5f101b47fe1d10f06 (good)
;; QUESTION SECTION:
;ns1.bcc.gov.bd. IN A

;; AUTHORITY SECTION:
bd. 172800 IN NS dns.bd.
bd. 172800 IN NS surma.btcl.net.bd.
bd. 172800 IN NS bd-ns.anycast.pch.net.
bd. 172800 IN NS jamuna.btcl.net.bd.
bd. 86400 IN DS 26044 8 1 2DAD1B7F8CA778464F536FDDD15EFD24CCCB62EF
bd. 86400 IN DS 26044 8 2 
BD01C4B4345D21FC38AA88129F7BC00FDD7B422799CC6703736E3B38 1F37DD5B
bd. 86400 IN RRSIG DS 8 1 86400 2023111217 2023103016 46780 . 
IFF4dDc0UEceikw9rf2bEaz/4LZtyCHeKAxX+gD8okseRzK1EcheFZ53 
m8ZJtUa/ptVRIm6Hvwc8HTq7KeRKoCULw2isoqB/gNJDc+PasE0/2Uq8 
vEY0CCPJad/zKRAjSXxkI6tmvOt3a3Mk6soTIOFCiK0eITwx2sJsdIGZ 
/wL3cfaqSHh1735dWtg0kWFstyesSida7YHjNyOsJ/X/mUMEInhFdHzR 
mg3Sa64FUy8BamA/yTUazNb3VG3yRS9ZUFJXeMib7qjSspDEqb2dTKzy 
RvFxiNKOD5rDoCN3/Da6hi/dBhCLL9Zh+6mhsV0KHLahoKI2Bl2xw2v3 F9hFyA==

;; ADDITIONAL SECTION:
jamuna.btcl.net.bd. 172800 IN A 203.112.194.231
surma.btcl.net.bd. 172800 IN A 203.112.194.232
bd-ns.anycast.pch.net. 172800 IN A 204.61.216.108
dns.bd. 172800 IN A 123.49.12.112
jamuna.btcl.net.bd. 172800 IN  2407:5000:88:4::231
surma.btcl.net.bd. 172800 IN  2407:5000:88:4::232
bd-ns.anycast.pch.net. 172800 IN  2001:500:14:6108:ad::1
dns.bd. 172800 IN  2407:5000:88:5::3

;; Query time: 19 msec
;; SERVER: 192.33.4.12#53(c.root-servers.net) (UDP)
;; WHEN: Tue Oct 31 12:04:53 AEDT 2023
;; MSG SIZE  rcvd: 725

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 

Re: 9.18 BIND not resolving .gov.bd site

[Mosharaf Hossain]

Hello All
The problem of the .gov.bd domain resolution has been successfully
resolved.
In the zone file configuration, there was a forward entry for .gov.bd, and
after commenting out those lines, all .gov.bd domains are now functioning
correctly.

Thank you all for providing the right guidance that helped us pinpoint the
issue."

root@ns1:/# dig  mofa.gov.bd +trace
\
; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> mofa.gov.bd +trace
;; global options: +cmd
.   452497  IN  NS  m.root-servers.net.
.   452497  IN  NS  i.root-servers.net.
.   452497  IN  NS  e.root-servers.net.
.   452497  IN  NS  g.root-servers.net.
.   452497  IN  NS  l.root-servers.net.
.   452497  IN  NS  a.root-servers.net.
.   452497  IN  NS  j.root-servers.net.
.   452497  IN  NS  b.root-servers.net.
.   452497  IN  NS  c.root-servers.net.
.   452497  IN  NS  f.root-servers.net.
.   452497  IN  NS  h.root-servers.net.
.   452497  IN  NS  d.root-servers.net.
.   452497  IN  NS  k.root-servers.net.
.   452497  IN  RRSIG   NS 8 0 518400
2023111205 2023103004 46780 .
KOSvh8dmDkcY070FSYz+vAkH6BC+ZR4nGbEu0plshkZZX47oFXFpsHTJ
/LiU7G7KXp6gE+g+QDcHk/HPEljGFNY5RwvzQaCjHGG063ypr+Huj1vJ
0SR03fSwm1FALKZ0EFNI2aIfpxY/1S8xc2HzZmHuneQcp7mTY7i+KtOY
z8ljk2jQbdCjHYPg/AgIPtF2+507LnFScSCTw+zOVFYFktoPHyy/wDIk
3G0VQQIQG5+1kjn7YZl1yuyxiSqJhq1+7tSkrL3AKhA4fJtynJcBbZsw
dq3mVHPfARjUjby2WNt/M2clERoo+W/zYsZpkKamUpvTNm6gYnnt2xUV 8F5/Ow==
;; Received 1137 bytes from 202.84.32.22#53(202.84.32.22) in 0 ms

bd. 172800  IN  NS  surma.btcl.net.bd.
bd. 172800  IN  NS  dns.bd.
bd. 172800  IN  NS  bd-ns.anycast.pch.net.
bd. 172800  IN  NS  jamuna.btcl.net.bd.
bd. 86400   IN  DS  26044 8 2
BD01C4B4345D21FC38AA88129F7BC00FDD7B422799CC6703736E3B38 1F37DD5B
bd. 86400   IN  DS  26044 8 1
2DAD1B7F8CA778464F536FDDD15EFD24CCCB62EF
bd. 86400   IN  RRSIG   DS 8 1 86400 2023111217
2023103016 46780 .
IFF4dDc0UEceikw9rf2bEaz/4LZtyCHeKAxX+gD8okseRzK1EcheFZ53
m8ZJtUa/ptVRIm6Hvwc8HTq7KeRKoCULw2isoqB/gNJDc+PasE0/2Uq8
vEY0CCPJad/zKRAjSXxkI6tmvOt3a3Mk6soTIOFCiK0eITwx2sJsdIGZ
/wL3cfaqSHh1735dWtg0kWFstyesSida7YHjNyOsJ/X/mUMEInhFdHzR
mg3Sa64FUy8BamA/yTUazNb3VG3yRS9ZUFJXeMib7qjSspDEqb2dTKzy
RvFxiNKOD5rDoCN3/Da6hi/dBhCLL9Zh+6mhsV0KHLahoKI2Bl2xw2v3 F9hFyA==
;; Received 722 bytes from 192.36.148.17#53(i.root-servers.net) in 51 ms

mofa.gov.bd.86400   IN  NS  ns1.bcc.gov.bd.
mofa.gov.bd.86400   IN  NS  ns2.bcc.gov.bd.
;; Received 146 bytes from 204.61.216.108#53(bd-ns.anycast.pch.net) in 0 ms

mofa.gov.bd.38400   IN  A   103.163.210.117
mofa.gov.bd.38400   IN  A   103.163.210.121
mofa.gov.bd.38400   IN  NS  ns1.bcc.gov.bd.
mofa.gov.bd.38400   IN  NS  ns2.bcc.gov.bd.
;; Received 146 bytes from 114.130.54.124#53(ns2.bcc.gov.bd) in 0 ms

Regards
Mosharaf Hossain
Manager, Product Development
IT Division

Bangladesh Export Import Company Ltd.

Level-8, SAM Tower, Plot #4, Road #22, Gulshan-1, Dhaka-1212,Bangladesh

Tel: +880 9609 000 999, +880 2 5881 5559, Ext: 14191, Fax: +880 2 9895757

Cell: +8801787680828, Email: mosharaf.hoss...@bol-online.com, Web:
www.bol-online.com




On Tue, Oct 31, 2023 at 7:15 AM Mark Andrews  wrote:

>
>
> > On 30 Oct 2023, at 17:25, Mosharaf Hossain <
> mosharaf.hoss...@bol-online.com> wrote:
> >
> > mofa.gov.bd.86400   IN  NS  ns1.bcc.gov.bd.
> > mofa.gov.bd.86400   IN  NS  ns2.bcc.gov.bd.
> > couldn't get address for 'ns1.bcc.gov.bd': not found
> > couldn't get address for 'ns2.bcc.gov.bd': not found
> > dig: couldn't get address for 'ns1.bcc.gov.bd': no more
> > root@ns1:/etc/bind#
>
> So you got this this point and that is saying that the lookup of
> the addresses of the nameservers is failing.  The next step would to
> do a 'dig +trace' or a 'dig +trace +all' of those names.
>
> % dig +trace ns1.bcc.gov.bd. +all -4
> ;; BADCOOKIE, retrying.
>
> ; <<>> DiG 9.19.18-dev <<>> +trace ns1.bcc.gov.bd. +all -4
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11927
> ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 14, AUTHORITY: 0, ADDITIONAL: 27
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 1232
> ; COOKIE: 69a562ec1c50e2280100654052b51e141922bd6198