statistics / named.stats / IPv4 NS address fetch failed

2011-10-26 Thread Fabien Seisen
Hello .*, yesterday, i saw some weird behaviour on my recursive servers I make some graphs using the data provided by "rndc stats" and i saw: - a bit more of incoming queries - a lot of dropped queries - recursive slots goes to the max - cache hit dropped from 90% to 65%) - no more external que

Re: maximum number of FD events

2011-10-26 Thread Cathy Almond
On 25/10/11 21:09, Fr34k wrote: > > > Hello, > > Environment: Solaris10 SPARC and x86, BIND 9.7.3-P3 and 9.8.1 > > Anomaly: In our logs, we have been noticing "maximum number of FD events" > entries. For example, > named[8592]: [ID 873579 daemon.info] sockmgr 288760: maximum number of FD

Strange issue with signed zone

2011-10-26 Thread Peter Andreev
Hello! We have ~30 servers running BIND (9.8, 9.7, 9.6). A week ago we have signed first of our zones with RSA/SHA1 + NSEC3 + OPT-OUT. Recently we realised that our servers don't generate NSEC3 for signed zone. Problem has gone after we restarted BIND instances. Is described behaviour normal for

Re: dispatch - permission denied

2011-10-26 Thread Michael Graff
Is there something else running on those UDP ports? On Oct 26, 2011, at 12:49 AM, Benzi Mizrahi wrote: > Hi, > > I've recently upgraded our nameservers from version 9.6.2.-p3 to 9.7.4 , and > the following > messages started to appear on all nameservers logs: > > > 22-Oct-2011 16:58:41.54

Re: dispatch - permission denied

2011-10-26 Thread Chris Thompson
On Oct 26 2011, Benzi Mizrahi wrote: Hi, I've recently upgraded our nameservers from version 9.6.2.-p3 to 9.7.4 , and the following messages started to appear on all nameservers logs: 22-Oct-2011 16:58:41.548 dispatch: dispatch 5612b0: open_socket(0.0.0.0#2049) -> permission denied: conti

Using DNSSec with BIND

2011-10-26 Thread Mike Rostermund
Hi all, I've managed to set up two new DNS servers. One as a master, and the second as a slave. All works perfectly using the traditionally DNS services, but I want to get DNSSec up and running. So far I've managed to create the key's needed for my zones, sign the zones, load these zones into

Re: Using DNSSec with BIND

2011-10-26 Thread Alan Clegg
On 10/26/2011 1:53 PM, Mike Rostermund wrote: > Hi all, > > I've managed to set up two new DNS servers. One as a master, and the > second as a slave. > All works perfectly using the traditionally DNS services, but I want to > get DNSSec up and running. > So far I've managed to create the key's nee

Re: DNS Sinkhole in BIND

2011-10-26 Thread Michelle Konzack
Hello Lightner, Jeff, Am 2011-10-17 13:28:43, hacktest Du folgendes herunter: > While setting up blackholes in BIND works fine when I did this on > Linux I found that setting up iptables to do drops for known bad > IPs/ranges was slightly better as the traffic never gets to BIND in > the first pla

Re: udp vs tcp query

2011-10-26 Thread Emanuele Balla (aka Skull)
On 10/23/11 5:42 AM, Benny Pedersen wrote: > On Sat, 22 Oct 2011 22:34:48 -0500, Larry Brower wrote: >>> can i control this pr zone when bind is dns client ? >> Why would you want to? Just fix the problem. > > ask dnsbl owners to stop using rbldnsd ? No point and no need for that. TCP is needed o