Hot answers tagged

13

This RFC explains the DNS system http://www.ietf.org/rfc/rfc1035.txt. And most importantly, the section "3.5. IN-ADDR.ARPA domain" explains how these names are set for reverse lookup of the IP addresses. So yes, for intermittent hosts which are probably routers, one can set these to pretty much random names and these would turn up in the X.Y.Z.W.IN-ADDR....


12

Is there a way to turn off reverse lookups and leave forward lookups on? Summary: Use no domain-lookup under line vty 0 4... Details: You're right, the default behavior is to perform & cache a forward / reverse lookup for the addresses in show commands. This config starts similar to yours... Baseline behaviour: Forward / Reverse lookups HotCoffee#...


10

Who mainly provides IP addresses to domains? As in, who commands, "www.google.com, 103.233.38.93 is yours; www.stackexchange.com I will assign 104.16.115.182 to you; etc." Normally IP addresses are given out by providers to their customers. Small hosting customers will get IPv4 IPs allocated one at a time to their servers. Some organsiations will run ...


9

Reverse DNS for IPv4 is specified in RFC1035 Section 3.5. The special in-addr.arpa domain was created for this. For IPv6 the special domain is ip6.arpa as specified in RFC3596. The record type that gets requested for reverse lookup is the PTRrecord. For IPv4 the IP address is reversed on the "dot" boundaries after every byte: 192.168.0.1 gets ...


8

Answering my own question to help future googlers. I spent about 3 hours on the phone with TAC; we finally got to the root cause of the issue. The solution is to add a special NAT entry, which matches the IP address in the DNS A-Record when it arrives on the INSIDE interface. object network DNS_NAT_masd1 description xlate A-Record DMZ src 1.195.18.182 to ...


8

The PTR record doesn't have to be a valid FQDN. (for internal / non-internet DNS servers, this is not uncommon.) Eg: 1.1.168.192.in-addr.arpa. IN PTR i.saw.a.squirrel.


8

Short answer: There is not requirement that IP addresses provide a reverse lookup, so there are many IP addresses that do not have any reverse DNS lookup zone associated with them. Long answer: DNS was really designed to do look ups from a human readable name to an IP address. When you do normal DNS query, say for www.example.com", the DNS query is ...


8

DNS is a application layer protocol, because DNS query and answer is the application level communications. Application layer only understand the query and answer section in the DNS packet. so application layer DNS query/answer is encapsulated in layer 4 udp then layer 3 IP.....and so on.


7

I've attempted many time to setup DNS doctoring but I just cant get it work, I believe because our ISR doesnt have the capability to peform the commands I'm trying Your first problem is that you're using Cisco ASA commands on a Cisco router; you're also assuming this is a problem with your Cisco router. In reality, this is a DNS issue that can be solved ...


7

Experiment There is a lot of conflicting information about what actually happens on a Windows client when using split-dns. So much that I decided to gather some evidence and see where it points. I set up a simultaneous packet capture on both the VPN-connected Windows client and the ASA to which that client is connected. Here is a diagram of the test setup:...


6

Yes, it's possible. But you would have to advertise a /24 network (or larger), based on current Internet routing policies. So if your name server IP was 1.2.3.4, you would have to advertise 1.2.3.0/24 from each of your locations. The rest of the addresses in that subnet would be, practically speaking, wasted. You also would have to have your own provider-...


6

I actually found what I was looking for in RFC4074: Suppose that an authoritative server has an A RR but has no AAAA RR for a host name. Then, the server should return a response to a query for an AAAA RR of the name with the response code (RCODE) being 0 (indicating no error) and with an empty answer section (see Sections 4.3.2 and 6.2.4 of 1). Such a ...


6

Ron is right with his comment. IP-over-DNS tunneling (or more common name DNS tunneling) is a kind of attack, that allows to bypass usual network protection and send/receive data over DNS protocol, which tends to be less checked. The downside of it is a bit more complicated setup and the speed is very slow, as all data are sent inside DNS requests, which ...


6

Protocols at the Physical, Data-Link, Network, or Transport layers do not use names. Only applications need to use names, so DNS is an application-layer protocol because it allows the application to translate a name into a network address.


6

As others have already answered, most usually a host sends a recursive query to a nominated resolver, often a local server or router, often belonging to an ISP or Google's well-known (distributed) 8.8.8.8 and 8.8.4.4. Typically it will have a couple defined, and if the first doesn't respond, it will move to the next after a timeout. Name resolvers are free ...


5

MX, CNAME, PTR, and NS records point to hostnames. A records point to IP addresses. Putting an IP address in an NS record is a pretty common DNS misconfiguration. One reason is that you might have NS records pointing to servers outside of your domain for someone doing secondary DNS for you. That remote domain might change the IP address of the server (but ...


5

This is almost certainly single host with many IP addresses routed to it and simple script to make it appear like it's traversing many hosts. Comparable hack for IPv6 can be seen here https://github.com/job/ipv6-traceroute-faker Like Ricky+Laazik say no limits what PTR can point to, like no limits where A can point to, just you won't be able to have it PTR ...


5

DynDNS Using DynDNS is not a viable solution for your usecase since its primary use case is mapping a dynamic ip address to a dns record. If you have two Upstreams with different ip subnets you would need to edit ip address or nat confiuration on failure which could be scripted but is prone to error. GSLB Another way of using DNS would be GSLB, which ...


5

Most of the information can be found here: http://www.root-servers.org/ There are several in different regions of the world, see link above for map There are 12 companies that operate them, they are funded by whatever their primary business is There are 13 root DNS servers, there is therefore redundancy The root servers aren't the ones that generally handle ...


5

Reverse DNS is a term for looking up the DNS PTR record for an IP address - essentially resolving it 'backwards' to a host name (in contrast to 'forward' resolving a host name to an IP address using the A record). While this should be supported everywhere, it often isn't due to a lack of setup or to security concerns. You'll need to set up your DNS ...


5

A couple of examples are: api.twitter.com one.one.one.one dns.google There are always exceptions however - you'll notice that within China, the IP for say api.twitter.com is different for reasons that are most likely not technical.


5

That seems to use the term 'request' both for DNS queries and for HTTP requests, which makes it a bit confusing. Most load balancers however are able to balance all kinds of application protocols, including HTTP, DNS, SMTP, RDP, etc.


4

When the routers NAT they will first check if the "correct" source address is available if so they will map that to that nat translation. If it is not available it will select a number as src port from a pool 1-512 (or 1024) for the service under port 512 (or 1024). Which ever is the first available and place that in the translation. Going by this, and this ...


4

Large networks typically have a configuration management database (CMDB) software which will automatically generate DNS entries based on the networking equipment in that database. Smaller networks will configure DNS by hand. There are no rules on how DNS labels must be named, the scheme mentioned in the presentation is just one which is commonly used, but ...


4

Routers learn about routes in three ways: Directly connected networks Manually configured static routes Dynamically through routing protocols A router, receiving a packet on an interface will look at the destination address of the packet, and it will look in its routing table to see if it knows how to forward the packet toward its destination. If the ...


4

Multi-ASN in this case is more of a proxy for a high degree of network resilience. The basic idea is that primary and secondary servers should be deployed in such a way that the loss of even multiple significant infrastructure elements (servers, links, routers, even entire sites) shouldn't result in a condition where no resolvers are online for a given ...


4

I think that DNS is an application layer protocol because if for example i want to create a TCP connection i need the destination ip address in layer 4, Am i correct? IP is a layer 3 protocol. DNS is just a service that translates host names into IP addresses, you need this because humans are better at remembering names than numbers. So once you enter ...


4

A normal DNS client just queries the (DHCP or statically) assigned DNS servers. Only DNS servers usually query root servers, doing a recursive query. You can use a packet capture of your choice and filter for UDP (TCP) source or destination port 53 to see the communication with any DNS server. Which servers and exact method a DNS client uses is up to the ...


4

Depending on the firewall type, hairpinning can get pretty messy. If your LAN client try to access the public IP address (which actually is your router's, not your server's), their sessions are bound for the Internet - they're source NATed by the router, then turned sharply around ("hairpin" curve) by the destination NAT rule aka port forwarding, ...


4

Application-layer protocols such as HTTP generally have this capability. At the network layer, no, you can't tell.


Only top voted, non community-wiki answers of a minimum length are eligible