Re: Dig 9.9 FORMERR with NetWare

2013-04-30 Thread Kevin Darcy
The last (and presumably final) point release (6.5) of NetWare was in 2003, only 4 years after RFC 2671. Just saying... - Kevin On 4/30/2013 7:08 PM, Pascal wrote: Thank you. That does appear to be the problem. -Pascal On 4/30/2013 5:

Re: DDOS attack Bind 9.9 - P2

2013-04-30 Thread Vernon Schryver
> Patch BIND to include the RRL (Response Rate Limiting) patches > (http://www.redbarn.org/dns/ratelimits), blackhole/ignore those > clients requesting. The fact that Response Rate Limiting (RRL) does not blackhole/ignore clients is a feature and why it is a better mitigation for DNS Reflection Do

Re: Dig 9.9 FORMERR with NetWare

2013-04-30 Thread Pascal
Thank you. That does appear to be the problem. -Pascal On 4/30/2013 5:17 PM, Mark Andrews wrote: BIND 9.9 dig turns on EDNS by default. You really should be asking why 172.31.123.6 doesn't suppport EDNS nearly 14 years after it was specified (RFC 2671 August 1999). Add +noedns to the comman

Re: Dig 9.9 FORMERR with NetWare

2013-04-30 Thread Pascal
Sorry, I guess I wasn't clear enough. I was just using www.alarmspecs.com as a sample domain. As you see, that domain is working fine. My problem is 172.31.123.6 is a NetWare DNS server. I maintain several in different locations and trees. Any time I try to use Dig 9.9 against one of them

Re: Dig 9.9 FORMERR with NetWare

2013-04-30 Thread Mark Andrews
In message <51803fd2.3070...@users.sourceforge.net>, Pascal writes: > Dig 9.9 consistently gives me "FORMERR" against NetWare DNS servers. > Previous versions worked fine. Suggestions on how to figure out if the > bug is in Dig or NetWare? > > -Pascal BIND 9.9 dig turns on EDNS by default. Y

Re: Dig 9.9 FORMERR with NetWare

2013-04-30 Thread Noel Butler
On Tue, 2013-04-30 at 17:04 -0500, Pascal wrote: > Dig 9.9 consistently gives me "FORMERR" against NetWare DNS servers. > Previous versions worked fine. Suggestions on how to figure out if the > bug is in Dig or NetWare? > > -Pascal > > O:\Documents and Settings\admin\dig\9.9.2-P2>dig www.

Dig 9.9 FORMERR with NetWare

2013-04-30 Thread Pascal
Dig 9.9 consistently gives me "FORMERR" against NetWare DNS servers. Previous versions worked fine. Suggestions on how to figure out if the bug is in Dig or NetWare? -Pascal O:\Documents and Settings\admin\dig>dig www.alarmspecs.com @172.31.123.6 ; <<>> DiG 9.8.4-P2 <<>> www.alarmspecs.com

Re: DDOS attack Bind 9.9 - P2

2013-04-30 Thread Noel Butler
On Tue, 2013-04-30 at 22:07 +0100, Steven Carr wrote: > You asked this question a few weeks ago. > > Patch BIND to include the RRL (Response Rate Limiting) patches > (http://www.redbarn.org/dns/ratelimits), blackhole/ignore those > clients requesting. > Many people will not compromise critical

Re: DDOS attack Bind 9.9 - P2

2013-04-30 Thread Jay Ford
On Tue, 30 Apr 2013, Jose Manuel Delgado G. wrote: I have isc.org attack." isc.org internet *?". It comes from my own clients that I have allowed in my ACL. the question is how to stop this attack? this causes my traffic on the interface is intense and also up my cpu percentage. that I can do t

Re: DDOS attack Bind 9.9 - P2

2013-04-30 Thread Steven Carr
You asked this question a few weeks ago. Patch BIND to include the RRL (Response Rate Limiting) patches (http://www.redbarn.org/dns/ratelimits), blackhole/ignore those clients requesting. On 30 April 2013 21:49, Jose Manuel Delgado G. wrote: > I have isc.org attack." isc.org internet *?". It com

DDOS attack Bind 9.9 - P2

2013-04-30 Thread Jose Manuel Delgado G.
I have isc.org attack."* isc.org internet *?".* It comes from my own clients that I have allowed in my ACL. the question is how to stop this attack? this causes my traffic on the interface is intense and also up my cpu percentage. that I can do to prevent it?? __

Re: Views Question

2013-04-30 Thread Evan Hunt
> If the 'type' info in a zone statement determines master or slave, can > you have 2 views in the same named.conf file, one with type master zones > and the other with type slave zones? There are a couple of ways to read this question, and the answer depends on which way you intended it. A quer

Re: Views Question

2013-04-30 Thread /dev/rob0
On Tue, Apr 30, 2013 at 04:36:52PM +, Manson, John wrote: > If the 'type' info in a zone statement determines master or slave, Yes, this is so. There are other types as well, such as hint, stub, and forward. See Bv9ARM.ch06.html#zone_statement_grammar for details and other types. > can you

Re: Views Question

2013-04-30 Thread Carlos M. Martinez
I think views have mostly to do with the source of the queries, thus presenting a different 'view' of zone data depending on who the client is. You could have one view only with master zones and other view with salve zones, but I'm not sure what the purpose would be, unless for example you want to

Views Question

2013-04-30 Thread Manson, John
If the 'type' info in a zone statement determines master or slave, can you have 2 views in the same named.conf file, one with type master zones and the other with type slave zones? John Manson CAO/HIR/NAF Data-Communications | U.S. House of Representatives | Washington, DC 20515 Desk: 202-226

Re: ISC Courses

2013-04-30 Thread Eric Kom
On 27/04/2013 14:55, Mark Elkins wrote: If you live in Africa and can get South, ZACR (UniForum SA), the "co.za" registry people provide free DNS Courses in Johannesburg and Cape Town. You still have to cover personal travel, food and lodging though. These are proper DNS training courses, three d

Re: NS geo-distribution

2013-04-30 Thread Sten Carlsen
On 30/04/13 10:30, Dave Warren wrote: > On 2013-04-30 00:49, Sten Carlsen wrote: >> Don't forget that most users will get the address out of "some" >> cache, not directly from the authoritative servers. > > Absolutely. This is even more true in our case as many of our clients > are serve very loca

Re: NS geo-distribution

2013-04-30 Thread Dave Warren
On 2013-04-30 00:49, Sten Carlsen wrote: Don't forget that most users will get the address out of "some" cache, not directly from the authoritative servers. Absolutely. This is even more true in our case as many of our clients are serve very local areas and 2-3 ISPs and 3-4 mobile providers p

Re: NS geo-distribution

2013-04-30 Thread Sten Carlsen
Don't forget that most users will get the address out of "some" cache, not directly from the authoritative servers. On 30/04/13 6:48, Chris Buxton wrote: > On Apr 29, 2013, at 9:01 PM, Dave Warren wrote: >> With the vast majority of our customers being in North America (probably 75% >> of users