Hot answers tagged

13

This RFC explains the DNS system http://www.ietf.org/rfc/rfc1035.txt. And most importantly, the section "3.5. IN-ADDR.ARPA domain" explains how these names are set for reverse lookup of the IP addresses. So yes, for intermittent hosts which are probably routers, one can set these to pretty much random names and these would turn up in the X.Y.Z.W.IN-ADDR....


12

Is there a way to turn off reverse lookups and leave forward lookups on? Summary: Use no domain-lookup under line vty 0 4... Details: You're right, the default behavior is to perform & cache a forward / reverse lookup for the addresses in show commands. This config starts similar to yours... Baseline behaviour: Forward / Reverse lookups HotCoffee#...


9

Reverse DNS for IPv4 is specified in RFC1035 Section 3.5. The special in-addr.arpa domain was created for this. For IPv6 the special domain is ip6.arpa as specified in RFC3596. The record type that gets requested for reverse lookup is the PTRrecord. For IPv4 the IP address is reversed on the "dot" boundaries after every byte: 192.168.0.1 gets transformed ...


9

Who mainly provides IP addresses to domains? As in, who commands, "www.google.com, 103.233.38.93 is yours; www.stackexchange.com I will assign 104.16.115.182 to you; etc." Normally IP addresses are given out by providers to their customers. Small hosting customers will get IPv4 IPs allocated one at a time to their servers. Some organsiations will run ...


8

The PTR record doesn't have to be a valid FQDN. (for internal / non-internet DNS servers, this is not uncommon.) Eg: 1.1.168.192.in-addr.arpa. IN PTR i.saw.a.squirrel.


8

Answering my own question to help future googlers. I spent about 3 hours on the phone with TAC; we finally got to the root cause of the issue. The solution is to add a special NAT entry, which matches the IP address in the DNS A-Record when it arrives on the INSIDE interface. object network DNS_NAT_masd1 description xlate A-Record DMZ src 1.195.18.182 to ...


8

Short answer: There is not requirement that IP addresses provide a reverse lookup, so there are many IP addresses that do not have any reverse DNS lookup zone associated with them. Long answer: DNS was really designed to do look ups from a human readable name to an IP address. When you do normal DNS query, say for "www.my-example.com", the DNS query is ...


7

Experiment There is a lot of conflicting information about what actually happens on a Windows client when using split-dns. So much that I decided to gather some evidence and see where it points. I set up a simultaneous packet capture on both the VPN-connected Windows client and the ASA to which that client is connected. Here is a diagram of the test ...


7

I've attempted many time to setup DNS doctoring but I just cant get it work, I believe because our ISR doesnt have the capability to peform the commands I'm trying Your first problem is that you're using Cisco ASA commands on a Cisco router; you're also assuming this is a problem with your Cisco router. In reality, this is a DNS issue that can be solved ...


6

I actually found what I was looking for in RFC4074: Suppose that an authoritative server has an A RR but has no AAAA RR for a host name. Then, the server should return a response to a query for an AAAA RR of the name with the response code (RCODE) being 0 (indicating no error) and with an empty answer section (see Sections 4.3.2 and 6.2.4 of 1). ...


6

Yes, it's possible. But you would have to advertise a /24 network (or larger), based on current Internet routing policies. So if your name server IP was 1.2.3.4, you would have to advertise 1.2.3.0/24 from each of your locations. The rest of the addresses in that subnet would be, practically speaking, wasted. You also would have to have your own provider-...


6

worldwide? Not on your life. Those domain info sites know what IP is what because they're doing DNS lookups of a lot of hosts, and they keep detailed records of the answer(s). They can tell you want domains are (or have been) using an IP based on the domains they've queried. They cannot tell you about something they aren't tracking! The same is true of ...


6

Short answer: No. Any site purporting to have a list of domains mapped to IP addresses won't be 100% accurate and it's based on what was seen, not what exists. Unless you have access to the name servers that may have CNAME records aliases to your domain that you could query or dump the zone files, the best you could do is capture the other hosts names ...


6

Ron is right with his comment. IP-over-DNS tunneling (or more common name DNS tunneling) is a kind of attack, that allows to bypass usual network protection and send/receive data over DNS protocol, which tends to be less checked. The downside of it is a bit more complicated setup and the speed is very slow, as all data are sent inside DNS requests, which ...


6

Protocols at the Physical, Data-Link, Network, or Transport layers do not use names. Only applications need to use names, so DNS is an application-layer protocol because it allows the application to translate a name into a network address.


6

DNS is a application layer protocol, because DNS query and answer is the application level communications. Application layer only understand the query and answer section in the DNS packet. so application layer DNS query/answer is encapsulated in layer 4 udp then layer 3 IP.....and so on.


5

This is almost certainly single host with many IP addresses routed to it and simple script to make it appear like it's traversing many hosts. Comparable hack for IPv6 can be seen here https://github.com/job/ipv6-traceroute-faker Like Ricky+Laazik say no limits what PTR can point to, like no limits where A can point to, just you won't be able to have it PTR ...


5

As others have already answered, most usually a host sends a recursive query to a nominated resolver, often a local server or router, often belonging to an ISP or Google's well-known (distributed) 8.8.8.8 and 8.8.4.4. Typically it will have a couple defined, and if the first doesn't respond, it will move to the next after a timeout. Name resolvers are free ...


5

Reverse DNS is a term for looking up the DNS PTR record for an IP address - essentially resolving it 'backwards' to a host name (in contrast to 'forward' resolving a host name to an IP address using the A record). While this should be supported everywhere, it often isn't due to a lack of setup or to security concerns. You'll need to set up your DNS ...


4

When the routers NAT they will first check if the "correct" source address is available if so they will map that to that nat translation. If it is not available it will select a number as src port from a pool 1-512 (or 1024) for the service under port 512 (or 1024). Which ever is the first available and place that in the translation. Going by this, and this ...


4

Large networks typically have a configuration management database (CMDB) software which will automatically generate DNS entries based on the networking equipment in that database. Smaller networks will configure DNS by hand. There are no rules on how DNS labels must be named, the scheme mentioned in the presentation is just one which is commonly used, but ...


4

MX, CNAME, PTR, and NS records point to hostnames. A records point to IP addresses. Putting an IP address in an NS record is a pretty common DNS misconfiguration. One reason is that you might have NS records pointing to servers outside of your domain for someone doing secondary DNS for you. That remote domain might change the IP address of the server (but ...


4

Most of the information can be found here: http://www.root-servers.org/ There are several in different regions of the world, see link above for map There are 12 companies that operate them, they are funded by whatever their primary business is There are 13 root DNS servers, there is therefore redundancy The root servers aren't the ones that generally handle ...


4

Multi-ASN in this case is more of a proxy for a high degree of network resilience. The basic idea is that primary and secondary servers should be deployed in such a way that the loss of even multiple significant infrastructure elements (servers, links, routers, even entire sites) shouldn't result in a condition where no resolvers are online for a given ...


4

I think that DNS is an application layer protocol because if for example i want to create a TCP connection i need the destination ip address in layer 4, Am i correct? IP is a layer 3 protocol. DNS is just a service that translates host names into IP addresses, you need this because humans are better at remembering names than numbers. So once you enter ...


3

Study BIND's logging clause.[1][2][3] Here's what I've used for decades: logging { channel syslog_debug { syslog daemon; severity debug; print-category yes; print-severity yes; }; channel statistics_log { file "logs/statistics" versions 5 size 10M; ...


3

A transparent proxy is a device that operating on the network layer is able to redirect the traffic to a proxy server without any configuration on the client side. The following configuration will address the problem of how to configure the ASA (version 8.4) as DNS transparent proxy. With very little effort it is possible to configure the ASA as HTTP ...


3

I assume you are using OpenDNS' web filtering functionality here, and it looks like that essentially involves using their DNS servers to handle lookups, rather than your own. You could define two SSIDs, associate them with different VLANs (on a single physical port) behind the APs, and then simply differentiate the settings that you provide to clients over ...


3

Change your ISP. Blocking access to root DNS servers with "DoS prevention" is not something a serious ISP would practice (unless you live in a country with government regulations in place). Alternatively, use a web service.


3

If your DHCP and DNS servers both implement DDNS (that's Dynamic [updates] to DNS, I know ISC's Open Source servers do this, and I'm sure there are several others), you can have the DHCP server update the DNS each time it gives out a lease. If you do that right, the name each system wants will be registered in the DNS. Notice that there are some ...


Only top voted, non community-wiki answers of a minimum length are eligible