Re: 9.18 behavior change for mDNS queries with dig

satisfied with that response and since my use of dig for mDNS lookups was legacy code in my script that was no longer needed (there was another way to accomplish the end goal of the script), it was a good excuse to clean up the script. -- Larry Stone lston...@stonejongleux.com > On Ju

Re: 9.18 behavior change for mDNS queries with dig

Thanks. Submitted - #3428. -- Larry Stone lston...@stonejongleux.com > On Jun 27, 2022, at 1:26 AM, Evan Hunt wrote: > > On Sun, Jun 26, 2022 at 10:00:08PM -0500, Larry Stone wrote: >> I recently moved from 9.16 to 9.18 and just noticed that dig no longer >>

Re: 9.18 behavior change for mDNS queries with dig

Greg, thanks. Exactly what I needed. Need to head out for a few hours but will get on this later today. -- Larry Stone lston...@stonejongleux.com > On Jun 27, 2022, at 8:18 AM, Greg Choules > wrote: > > Hi Larry. > sudo tcpdump -ni any -c 1000 -w .pcap port 5353 >

Re: 9.18 behavior change for mDNS queries with dig

. My issue is on a small home network so very little goes wrong. The appropriate tcpdump command to get what is needed should be all I need. -- Larry Stone lston...@stonejongleux.com > On Jun 27, 2022, at 1:48 AM, Petr Špaček wrote: > > On 27. 06. 22 8:26, Evan Hunt wrote: >&

9.18 behavior change for mDNS queries with dig

source-building to MacPorts); on the Monterey Mac, I have not built from source so just the MacPorts port. -- Larry Stone lston...@stonejongleux.com -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid

Missing n in man page for rndc(8)?

:( Where should I report this? Or is here sufficient? -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: l...@lerctr.org US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 -- Visit https://lists.isc.org/mailman/listinfo/bind-users to

Re: DNSSEC: Why aren't the old keys going hidden?

] | -checkds [-key id [-alg algorithm]] [-when time] published | withdraw)) zone [class [view]] s/withdraw/withdrawn/ withdraw garners a syntax error :( Thanks for the inbound clue-by-four. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640

DNSSEC: Why aren't the old keys going hidden?

I have 2 domains where I switched from Alg 8 to Alg 13, but the old keys don't seem to be going away. Attached are the state files, and the rndc dnssec -status outputs. Ideas? -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Ma

Re: DNSSEC

parent-ds-ttl 3600; parent-propagation-delay 300; nsec3param iterations 0 salt-length 0; }; If I can help, let me know. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: l...@lerctr.org US Mail: 5708 Sabbia Dr, R

Re: Reading secondary PTR files

nformation Technology Shared Services The University of Tennessee 103c5 Kingston Pike Building 2309 Kingston Pk. Knoxville, TN 37996 Phone: 974-1599 -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: l...@lerctr.org US Mail: 5708 Sabbia

Re: Why does DNSVIZ complain about the NS RRSET here?

Query time: 217 msec ;; SERVER: 216.82.192.149#53(pdns06.thin-nology.com) (UDP) ;; WHEN: Tue Apr 19 07:55:29 AEST 2022 ;; MSG SIZE rcvd: 452 % [snip] -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: l...@lerctr.org US Mail: 5708 Sab

Why does DNSVIZ complain about the NS RRSET here?

.0.0.b.d.c.f.2.0.6.2.ip6.arpa. [omitted] ;; Query time: 676 msec ;; SERVER: 1.0.0.1#53(1.0.0.1) ;; WHEN: Sat Apr 16 09:52:06 CDT 2022 ;; MSG SIZE rcvd: 414 -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: l...@lerctr.org US Mail: 5708 S

Re: BIND 9.18.0 and Mac OS X 10.15.7 - cannot build

make sense. But the new computer, new (to me) OS version, and new architecture makes this the perfect time to switch. -- Larry Stone lston...@stonejongleux.com > On Feb 26, 2022, at 3:27 AM, @lbutlr wrote: > > On 2022 Feb 22, at 04:31, Julien Salort wrote: >> For informati

Re: BIND 9.18.0 and Mac OS X 10.15.7 - cannot build

Ondrej, thanks. Some quick searching tells me it’s a long-standing issue with Xcode 10 (and before). Since Bind 9.16.26 works, not a pressing issue for me and the system is likely to be replaced before 9.16 reaches EOL. -- Larry Stone lston...@stonejongleux.com > On Feb 21, 2022, at 10

Re: BIND 9.18.0 and Mac OS X 10.15.7 - cannot build

^~ ./include/isc/assertions.h:46:11: note: expanded from macro 'ISC_REQUIRE' ((void)((cond) || \ ^~~~ 2 errors generated. make[4]: *** [netmgr/libisc_la-netmgr.lo] Error 1 make[3]: *** [all

BIND 9.18.0 and Mac OS X 10.15.7 - cannot build

ort in OpenSSL is mandatory” error and not sure what direction to go. I think it’s an issue with OpenSSL but I can’t see what it is (and Bind 9.16.x builds fine). Probably something simple but I need a nudge in the right direction. Thanks. -- Larry Stone lston...@stonejongleux.com

Re: dnssec: ds showing hidden 3+ days after key roll

that little nuance documented? (The need for KSK and ZSK to be aligned on type of key) -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: l...@lerctr.org US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 -- Visit https://lists.isc.org/ma

Re: dnssec: ds showing hidden 3+ days after key roll

9T02:18:28.588453-06:00 thebighonker.lerctr.org named 44101 - - 09-Feb-2022 02:18:28.588 dnssec: debug 1: keymgr: dnssec says no to KSK lerctr.org/RSASHA256/269 type DS state HIDDEN to state RUMOURED ler in thebighonker in ~ via ☕ v1.8.0 via 🐪 v5.32.1 via 💎 v2.7.5 as 🧙 ❯ On 02/10/2022 6:20 am,

dnssec: ds showing hidden 3+ days after key roll

- dnskey: omnipresent - ds: hidden - key rrsig: omnipresent ler in thebighonker in namedb🔒 on  master [!] as 🧙 ❯ Is it normal to see the ds as hidden? It IS published, and I told rndc that. Any insight appreciated. -- Larry Rosenman http

Re: BIND 9.16.13 and Mac OS X 10.13.6 - problems with ./configure

I also found I needed to update Xcode but that may have been for a separate issue. But I agree with Ondřej, having already installed libuv via Homebrew, why are you not using Homebrew for BIND? -- Larry Stone lston...@stonejongleux.com ___ Plea

Re: BIND 9.16.13 and Mac OS X 10.13.6 - problems with ./configure

e of them if not both use their own set of directories so something built with one of them will not be found by something coming from the other or done from scratch. Those instructions from krypted.com appear to be doing a “from scratch” version so if you installed libuv with homebr

Re: A And Cname-record

But if there is a possibly relevant spelling error, it would be helpful to point out exactly where the error is rather than just saying “check your spelling”. Our eyes frequently see what we expect to see and therefore don’t see the error, even when told there is an error. -- Larry Stone

Re: Compile error Bind 9.16.1 on MacOS 10.14.6

Xcode to the latest for my MacOS version and then bind built fine. But my Xcode was very, very old - version 7. Current is 11.x (11.3.1 for MacOS Mojave, 11.4 for Catalina). -- Larry Stone lston...@stonejongleux.com > On Mar 24, 2020, at 5:40 PM, Mark Andrews wrote: > > You

Re: Compile error Bind 9.16.1 on MacOS 10.14.6

from the Apple Developers website. And honestly, I hadn’t realized how out of date my version of Xcode was as I only use the command line tools and everything had been working fine until today. Something to add to the MacOS upgrade checklist. -- Larry Stone lston...@stonejongleux.com >

Compile error Bind 9.16.1 on MacOS 10.14.6

I’ve been building Bind from source for a number of years on Macintoshes. Made my first attempt at Bind 9.16.1 today. After navigating the new dependency for libuv and getting a good configure, I tried make and errored at: gcc -include /Users/larry/ServerAppsNoBackup/bind-9.16.1/config.h -I

Re: BIND 9.12.4 python error building on MacOS

Thanks. A simple $ sudo python -m ensure pip —default-pip $ sudo pip install —upgrade-pip $ sudo pip install ply took care of it. -- Larry Stone lston...@stonejongleux.com > On Mar 1, 2019, at 2:41 PM, Mark Andrews wrote: > > We had a bug report that dnssec-checkds, dnssec-cov

BIND 9.12.4 python error building on MacOS

h configures OK it says python support … disabled. I’m not seeing anything in the Release Notes about a change in Python requirements. Python is the version distributed with MacOS by Apple. -- Larry Stone lston...@stonejongleux.com ___ Please vi

RE: Openssl issue

Please disregard apparently Openssl does not see the /dev/random in my chroot directory as a valid random provider. So its off to google and oracle to see what it will take to make a valid /dev/random available from within the jail. Larry Stewart, CISSP Contractor - Jacobs Technology Network

Openssl issue

have any suggestions on how to overcome this issue? Larry Stewart, CISSP Contractor - Jacobs Technology Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larry.c.stewart@mail.mil smime.p7s Description: S/MIME cryptographic sign

Re: BIND 9.11.x build failing on Mac OS X - gssapi errors

for make install. I don’t think that should make a difference. -- Larry Stone lston...@stonejongleux.com > On Jun 15, 2017, at 1:44 AM, James Brown via bind-users > wrote: > > I couldn’t get 9.11 to compile for me on OS X 10.12.5. Same problem with > 9.11.1-P1. sudo ma

Re: Bind Queries log file format

CD, local address 9.11.0: client, qname, qclass, qtype, RD, signed, EDNS + version, TCP, DO, CD, local address, cookies 9.12.0: client, qname, qclass, qtype, RD, signed, EDNS + version, TCP, DO, CD, local address, cookies, ecs -- Larry Stone lston...@stonejongleux.com __

Re: Bind Queries log file format

S, TCP, DO, CD, cookies, > local address, EDNSversion, ecs -- Larry Stone lston...@stonejongleux.com > On Feb 7, 2017, at 9:06 PM, Mark Andrews wrote: > > > In message > rod.outlook.com>, Paul Roberts writes: >> I have to say I agree with the approach of putting

Auto zone signing

I recently set up DNSSEC using some older tutorials and today found one for auto zone signing. My question, are there any gottchas in converting over from manual to auto? Larry Stewart, CISSP Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251

Re: ip6tables with raw table(no conntrack) drop fragmented packet

:::0020 LEN=358 TC=0 HOPLIMIT=52 FLOWLBL=0 OPT ( FRAG:3696 ID:90c4bbe8 ) PROTO=UDP TRACE: raw:OUTPUT:rule:3 IN= OUT=eth0 SRC=2001:0468:0002:0183::::0020 DST=2001:0500:0060:::::0030 LEN=84 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=38537 DPT=53 LEN=44 UID=0 GID=0

ip6tables with raw table(no conntrack) drop fragmented packet

6-adm-prohibited -A FORWARD -j REJECT --reject-with icmp6-adm-prohibited COMMIT Thanks in advance!! Larry ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org

RE: Crypto failure Issues

Thanks Larry Stewart, CISSP Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larry.c.stewart@mail.mil -Original Message- From: Tony Finch [mailto:fa...@hermes.cam.ac.uk] On Behalf Of Tony Finch Sent: Monday, July 27, 2015 1:58 PM To

RE: Crypto failure Issues

Thank you that was the trick. What impact does that have on crypto operations used by BIND? Larry Stewart, CISSP Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larry.c.stewart@mail.mil -Original Message- From: Tony Finch [mailto:fa

RE: Crypto failure Issues

I am using a prebuilt binary will give compiling it myself a try and see what that yields. Larry Stewart, CISSP Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larry.c.stewart@mail.mil -Original Message- From: bind-users-boun

RE: Crypto failure Issues

I am using the older version of openssl. Looking on line this issue seems to have raised its head with the release of openssl 1.0.0, but I have yet to discover a solution on line. Larry Stewart, CISSP Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larr

Crypto failure Issues

0.9.8zf. My system is a Solaris 10 x86 OS Larry Stewart, CISSP Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larry.c.stewart@mail.mil smime.p7s Description: S/MIME cryptographic signature ___ Please

RE: daemon warning

Ok so that was not a good troubleshooting technique, was trying to determine what did not have the correct permissions and thus causing the warning. I guess I will go ahead and run it the way I have been for the last 5 years, unless I find it is causing me problems. Larry Stewart, CISSP, CCNA

RE: daemon warning

So I logged in as the user that I normally start named with and I get the following error: Named: chroot(): Not owner Larry Stewart, CISSP, CCNA Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larry.c.stewart@mail.mil -Original Message

RE: daemon warning

Correct, so is there some negative impact I can expect or is it just a log entry I can ignore? Larry Stewart, CISSP, CCNA Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larry.c.stewart@mail.mil -Original Message- From: Tony Finch

daemon warning

this is something to chase down or not. Larry Stewart, CISSP, CCNA Contractor - ManTech Network Engineer Office: 520-538-4227 DSN: 879-4227 Cell phone: 520-227-8251 larry.c.stewart@mail.mil smime.p7s Description: S/MIME cryptographic sign

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

. > > However I will look into the issue and put the "sleep" back in if needed > (or find a better patch to inform BIND on changes of the network config). > > @Larry: let me know if your are using the Men & Mice compiled BIND > installer packages, and if the issue st

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

es. But I’m not a C programmer so trying to make the same changes to what ISC distributes is probably beyond me. Nor is it probably worth the effort. The startup delay script works and boot are few and far between. What’s another 30 seconds when you’re rebooting a SOHO server with a number of us

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

gt; Wouldn’t even start. Repeatedly (about 150 per second) logged: Jan 24 18:37:35 host.example.com launchproxy[518]: launch_msg(CheckIn): Operation not permitted Jan 24 18:37:35 host com.apple.launchd[1] (org.isc.named[518]): Exited with code: 1 > to tell the system not to start bind un

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

me, with a startup delay script and an hourly monitoring job, I have a "comfortable" environment. -- Larry Stone lston...@stonejongleux.com ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

On Jan 21, 2014, at 11:38 PM, LuKreme wrote: > > On 18 Jan 2014, at 06:52 , Larry Stone wrote: > >> That is not the problem. > > In the launchd plist do you have something like > > > NetworkState > > > > or maybe > > inetdCompatibili

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

. > > However I will look into the issue and put the "sleep" back in if needed > (or find a better patch to inform BIND on changes of the network config). > > @Larry: let me know if your are using the Men & Mice compiled BIND > installer packages, and if the issue stil

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

’m not seeing. In any event, as I said, I have a “good enough” solution for my needs so anything further on this will be mostly of intellectual interest. -- Larry Stone lston...@stonejongleux.com http://www.stonejongleux.com/ smime.p7s Description: S/MIME cryptographic signature ___

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

launchd plist run a script that does a sleep 30 before starting named (15 seconds was too short). There might be a way to use a Listeners clause in the launchd list but that syntax is currently beyond me. I will search in Mac OS X forums for that. -- Larry Stone lston...@stonejongleux.com http

Re: Non-responsive name servers when started during boot on OS X Mavericks 10.9

belongs in /Library/LaunchDaemons/. -- Larry Stone lston...@stonejongleux.com http://www.stonejongleux.com/ On Jan 17, 2014, at 11:10 PM, Eduardo Bonsi wrote: > Hello Larry, > > I had the same "head-ache" when I upgraded to 10.9. It seems that instead > going forw

Non-responsive name servers when started during boot on OS X Mavericks 10.9

not providing much information but there’s nothing else I can find so any help with just figuring out why it fails when started at boot time will be a help. -- Larry Stone lston...@stonejongleux.com http://www.stonejongleux.com/ smime.p7s Description: S/MIME cryptographic signature

Re: Convice Bind to listen on IP alias with a range of IPs.

ething is responding for it. This does NOT mean it is on THAT specific server. If it is not on THAT server then bind cant use it. This isn't rocket science :) - -- Larry Brower, CCNA Linux System Administrator II HostGator.com LLC lbro...@hostgator.com Http://www.hostgator.com Http://support

Re: Convice Bind to listen on IP alias with a range of IPs.

to do with lo:1 > Given all that, can anyone suggest a reason why Bind won't listen on > that address? Because you are doing it wrong. You need to actually have the IP bound to an interface on the server for it to work. - -- Larry Brower, CCNA Linux System Administrator II Host

Re: Convice Bind to listen on IP alias with a range of IPs.

> > "named[15035]: not listening on any interfaces" > is 10.0.0.2 bound to the server? can you show the ip address or ifconfig output ? - -- Larry Brower, CCNA Fedora Ambassador - North America Fedora Quality Assurance lbro...@f

Re: new here

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 04/22/2012 10:05 PM, David Milholen wrote: > listen-on { > 9x.1xx.104.14; > }; Perhaps add 127.0.0.1; into the listen on clause. - -- Larry Brower, CCENT Fedora Ambassador - North America Fedora Quality Assur

Re: How can someone know Sub-Domains?

ot;extortion" since arround 2 weeks and > I am not willing to pay. > > Thanks, Greetings and nice Day/Evening > Michelle Konzack > Why would you give them a subdomain? How do you know they weren't being targeted prior to coming to you? Why haven't you nulled them

Re: udp vs tcp query

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 10/22/2011 10:24 PM, Benny Pedersen wrote: > can i control this pr zone when bind is dns client ? > Why would you want to? Just fix the problem. > remote server is rbldnsd with is not supporting tcp, how to solve this ? Use a server that is san

Re: Help to solve ROOT DNS query

> root DNS servers parallelly. > > Please help us to resove this problem. > > > > ___ > bind-users mailing list > bind-users@lists.isc.org > https://lists.isc.org/mailman/listinfo/bind-users - -- Larry Brower Level II Lin

Re: why queries rejected?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 01/18/2011 12:26 AM, p...@mail.nsbeta.info wrote: > > Hi, > I saw this piece from named.stats: > [XXX.com] > 812922 auth queries rejected > 116 recursive queries rejected > 4 transfer requests reject

Re: Defining custom root zone by subnet.

Nadir Aliyev wrote: Hi friends, Its possible in bind define fake root zone by subnet? (in this case just for zone1) Sounds like you need to use views. Why would you want to do this though? It is silly. ___ bind-users mailing list bind-users

Re: synchronization between maste and slave no working

Yunfeng Xu wrote: Hi, all I tried to add one A record on the master, but the slave did not get the new record. my slave settting is : zone "mydomain.com.cn " IN { type slave; file "mydomain.com.cn.zone"; masters {10.69.3.1;}; }; 10.69.3.1 is m

Re: Installing 9.7?

Daniel Morgan wrote: Apologies - my mailer half sent the post Following advice on a duplicate query issue, I've downloaded and built 9.7 from source as per the readme: "To build, just ./configure make" This completed just fine - but what I can't find is any details on how to physically ins

Re: Installing 9.7?

Daniel Morgan wrote: This may seem like a retarded question. Following advice to update I've downloaded the 9.7 source and built it as per the readme: Was there a question somewhere? ___ bind-users mailing list bind-users@lists.isc.org https://lists.

Re: loading zone: creating database: out of memory

万善义 wrote: > CentOS release 5.4 (Final) + BIND 9.6.1-P1 > > Intel(R) Xeon(R) CPU E5506 @ 2.13GHz > 8G Memory > > > Load 500,000 domains, the loading process, the following error: > > loading zone: creating database: out of memory > > 2009-11-24 > --

Re: How See what is Cached?

Agarwal Vivek-RNGB36 wrote: Hi All Iam trying to run the same command on Red Hat Linux; but its not giving any output. How can I check the cache in the redhat linux Regards Vivek Aggarwal +973-36583058 It would help if you said which version of Bind you were using. smime.p7s Descript

Odd issue with some domain queries

NS ns2.qualdns.net. ;; Received 135 bytes from 174.132.225.18#53(ns1.qualdns.net) in 128 ms Any ideas on what could be the issue? Thanks in advance for your help. -L -- Larry Ludwig ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

Re: How to forward domain totally not using CNAME?

MontyRee wrote: > > Hello, all. > > > I would like to CNAME like below. > > example.com. IN CNAMEexample2.com. > > > But I know that this is wrong. > then, is there any way or solution to solve this problem? > > > I searched and found that below is a similar s

Re: DNS Appliance

-wide. I like the integrated database and API. If you want an appliance to manage DNS & DHCP that provides a unified view of the two worlds, Infoblox is worth considering. --Larry -- Larry Fahnoe, Fahnoe Technology Consulting, fah...@fahnoetech.com 952/925-0744 Minneapolis,

Re: GeoIP like RBLDNS

What about using bind-dlz and use a mysql database for the records? Michelle Konzack wrote: >Hello Bind9 Geeks/Nerds and whoever, > >I have the need for a GeoIP Database but the one from Maxmind peoduce a >Disk-IO as the hell. Now my Idea is to use my bind9 to archive my goal. > >In general, I

Re: can't see nameserver externally

Davenport, Steve M wrote: Hello, I noticed that one of our nameservers is no longer responding with the correct address externally. The server is ns-2.hosp.utmck.edu and is listed as a server in the registration record for utmck.edu. The address should be 165.6.6.27 but a dig/nslookup from