0

why dig works OK, but dig my NetGear router directly doesn't (while first goes to it too, because it is my DNS, NetGear itself has 8.8.8.8 set as prim dns). My NetGear has IP 192.168.1.1 on LAN. Here I attached complete scenario. My analysis of frames shows IMO both requests come to router NetGear 192.168.1.1 on port 53 on top of UDP. Don't differ in anything else, or do they? please help.

only difference apart from different frame numbers and other obvious differences, observable for me is

[Coloring Rule Name: UDP]
[Coloring Rule String: udp]

present in OK frame and lack of it in failed packet (failed - I mean no response at all from 192.168.1.1)

dig cf16.eu

; <<>> DiG 9.9.2-P2 <<>> cf16.eu
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24482
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;cf16.eu.           IN  A

;; ANSWER SECTION:
cf16.eu.        3600    IN  A   89.75.41.50

;; Query time: 10 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Wed May  8 17:47:05 2013
;; MSG SIZE  rcvd: 52

but:

dig @192.168.1.1 cf16.eu

; <<>> DiG 9.9.2-P2 <<>> @192.168.1.1 cf16.eu
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

Wireshark packets: dig cf16.eu [OK]

No.     Time           Source                Destination           Protocol Length Info
    340 4.775113000    192.168.1.3           192.168.1.1           DNS      78     Standard query 0x5fa2  A cf16.eu

Frame 340: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
    Interface id: 0
    WTAP_ENCAP: 1
    Arrival Time: May  8, 2013 17:47:04.131360000 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1368028024.131360000 seconds
    [Time delta from previous captured frame: 0.005265000 seconds]
    [Time delta from previous displayed frame: 0.005265000 seconds]
    [Time since reference or first frame: 4.775113000 seconds]
    Frame Number: 340
    Frame Length: 78 bytes (624 bits)
    Capture Length: 78 bytes (624 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:udp:dns]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: Micro-St_4b:47:dc (d4:3d:7e:4b:47:dc), Dst: Netgear_bb:b7:2c (00:1b:2f:bb:b7:2c)
    Destination: Netgear_bb:b7:2c (00:1b:2f:bb:b7:2c)
        Address: Netgear_bb:b7:2c (00:1b:2f:bb:b7:2c)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Micro-St_4b:47:dc (d4:3d:7e:4b:47:dc)
        Address: Micro-St_4b:47:dc (d4:3d:7e:4b:47:dc)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 192.168.1.3 (192.168.1.3), Dst: 192.168.1.1 (192.168.1.1)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 64
    Identification: 0xf650 (63056)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: UDP (17)
    Header checksum: 0x0108 [correct]
        [Good: True]
        [Bad: False]
    Source: 192.168.1.3 (192.168.1.3)
    Destination: 192.168.1.1 (192.168.1.1)
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 47841 (47841), Dst Port: domain (53)
    Source port: 47841 (47841)
    Destination port: domain (53)
    Length: 44
    Checksum: 0x4831 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Domain Name System (query)
    Transaction ID: 0x5fa2
    Flags: 0x0120 Standard query
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..1. .... = AD bit: Set
            [Expert Info (Warn/Security): AD bit set in DNS Query]
                [Message: AD bit set in DNS Query]
                [Severity level: Warn]
                [Group: Security]
        .... .... ...0 .... = Non-authenticated data: Unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 1
    Queries
        cf16.eu: type A, class IN
            Name: cf16.eu
            Type: A (Host address)
            Class: IN (0x0001)
    Additional records
        <Root>: type OPT
            Name: <Root>
            Type: OPT (EDNS0 option)
            UDP payload size: 4096
            Higher bits in extended RCODE: 0x0
            EDNS0 version: 0
            Z: 0x0
            Data length: 0

dig 192.168.1.1 cf16.eu [fail]

No.     Time           Source                Destination           Protocol Length Info
    603 7.972662000    192.168.1.3           192.168.1.1           DNS      78     Standard query 0xc755  A cf16.eu

Frame 603: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
    Interface id: 0
    WTAP_ENCAP: 1
    Arrival Time: May  8, 2013 17:49:36.816366000 CEST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1368028176.816366000 seconds
    [Time delta from previous captured frame: 0.402535000 seconds]
    [Time delta from previous displayed frame: 0.402535000 seconds]
    [Time since reference or first frame: 7.972662000 seconds]
    Frame Number: 603
    Frame Length: 78 bytes (624 bits)
    Capture Length: 78 bytes (624 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:udp:dns]
Ethernet II, Src: Micro-St_4b:47:dc (d4:3d:7e:4b:47:dc), Dst: Netgear_bb:b7:2c (00:1b:2f:bb:b7:2c)
    Destination: Netgear_bb:b7:2c (00:1b:2f:bb:b7:2c)
        Address: Netgear_bb:b7:2c (00:1b:2f:bb:b7:2c)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Micro-St_4b:47:dc (d4:3d:7e:4b:47:dc)
        Address: Micro-St_4b:47:dc (d4:3d:7e:4b:47:dc)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 192.168.1.3 (192.168.1.3), Dst: 192.168.1.1 (192.168.1.1)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 64
    Identification: 0xf651 (63057)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: UDP (17)
    Header checksum: 0x0107 [correct]
        [Good: True]
        [Bad: False]
    Source: 192.168.1.3 (192.168.1.3)
    Destination: 192.168.1.1 (192.168.1.1)
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 37226 (37226), Dst Port: domain (53)
    Source port: 37226 (37226)
    Destination port: domain (53)
    Length: 44
    Checksum: 0x09f5 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Domain Name System (query)
    Transaction ID: 0xc755
    Flags: 0x0120 Standard query
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..1. .... = AD bit: Set
            [Expert Info (Warn/Security): AD bit set in DNS Query]
                [Message: AD bit set in DNS Query]
                [Severity level: Warn]
                [Group: Security]
        .... .... ...0 .... = Non-authenticated data: Unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 1
    Queries
        cf16.eu: type A, class IN
            Name: cf16.eu
            Type: A (Host address)
            Class: IN (0x0001)
    Additional records
        <Root>: type OPT
            Name: <Root>
            Type: OPT (EDNS0 option)
            UDP payload size: 4096
            Higher bits in extended RCODE: 0x0
            EDNS0 version: 0
            Z: 0x0
            Data length: 0
Improve this question

1 Answer 1

Reset to default
2

in this scenario, your router is acting as a DNS server for local requests and acts as a forwarder for unknown addresses, making the query on the 8.8.8.8 server, processing the response, and then sending back a packet indicating the result. if you use dig without a server reference, it uses the root zone to resolve, and you router will forward the lookup on to the root servers for resolution.

When you specify a server in dig, you are usually attempting to determine if the zone you have just created/imported is working fine on this server, so forwarding cannot be allowed to occur or it would hide a potential failure on the server you are specifically attempting to test. you are not saying "give me info about this domain", but instead "give me the info this specific server has about this domain".

since the domain in questions does not reside in a zone that actually exists on the router, you get no response.

See more info here: http://en.wikipedia.org/wiki/Dig_%28command%29

When a specific name server is not specified in the command invocation, it will use the operating systems default resolver, usually configured via the resolv.conf file. Without any arguments it queries the DNS root zone.

Improve this answer
9
  • I have configured 192.168.1.1 as DNS, so when I do not specify server in dig it goes to this router, right? This is what we see in wireshark: dig cf16.eu was sent to 192.168.1.1:53 ? right???? moreover: in both cases! so why it doesn't respond when we see frames are exactly same??? which lines in frames tells router to not respond in second example?
    – 4pie0
    May 8, 2013 at 16:48
  • correct. the difference is that by providing the server, you are disabling request forwarding, so the results are accurate. if you were capturing on the wan side of your router, you would see that dig without server param would send a packet to 8.8.8.8, whereas if you specify the server address, the router does not send a request to google dns.
    – Frank Thomas
    May 8, 2013 at 16:53
  • this makes sense, only one question left: where it is specified in this packet frames? It is correct to assume this info: "not to forward" has to be there, right? I see no difference in packets.
    – 4pie0
    May 8, 2013 at 16:56
  • I'm looking into that myself. from a glance at the frame, I would have expected the 8th option bit to be 0 on the second frame.
    – Frank Thomas
    May 8, 2013 at 17:00
  • And finally: shouldn't there be any answer? As mentioned there is no answer from 192.168.1.1 in the fail case. Shouldn't it send any info?
    – 4pie0
    May 8, 2013 at 17:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .