topic Re: howto check if DNS sever caches queries correctly ? in Operating System - Linux

howto check if DNS sever caches queries correctly ?

'chris' — Sun, 26 Jun 2005 09:43:51 GMT

hi

howto check if DNS sever caches queries correctly ?
I've installed an internal DNS server BIND 9 on Debian.

under options I have forwarders of my ISP:

options {
directory "/var/cache/bind";

forwarders { 211.12.X.X; 211.12.X.X; 194.15.X.X; };

forward first;

.....................................................................................................

howto be sure, that caches all queries
and doesn't go each time to the internet to ask DNS servers of my ISP ?

kind regards
chris

Re: howto check if DNS sever caches queries correctly ?

Kodjo Agbenu — Sun, 26 Jun 2005 17:24:52 GMT

Hello Chris,

Quite straightforward :
* nslookup or dig
* unplug the network cable
* nslookup or dig

You may also try a "soft" method by using tcpdump or ethereal as a spy for outgoing network traffic (monitor port 53, TCP and UDP).

Good lcuk.
Kodjo

Re: howto check if DNS sever caches queries correctly ?

'chris' — Sun, 26 Jun 2005 17:34:17 GMT

thanks,

I've tried and this is working,
but I cannot find any Bind cache files.

/var/cache/bind is always empty.

where is Bind putting its cache files ?

greetings
chris

Re: howto check if DNS sever caches queries correctly ?

Stuart Browne — Sun, 26 Jun 2005 18:09:36 GMT

It's in memory.

Re: howto check if DNS sever caches queries correctly ?

Karsten Breivik_1 — Mon, 27 Jun 2005 03:46:31 GMT

Interesting thread. At my work I have discovered that the DSN servers may in some cases return different answers depending on if your client computer is logged on to the domain or not. We are using MS based DNS servers and I have not bothered to look into why this is happening. I am sure The Sysadmin in all his wisdom propably have a perfectly good explanation for this. However, it is useful to be aware that this behavior can happen.

Re: howto check if DNS sever caches queries correctly ?

Stuart Browne — Mon, 27 Jun 2005 07:51:15 GMT

Windows PC's also have local caching of DNS names. Unfortunately, it frequently also caches failed lookups, and doesn't honor TTL's nicely.

If you get weird results like that, you can flush the DNS cache using the command 'ipconfig /flushdns' (on the windows box).

anyway ;)

Re: howto check if DNS sever caches queries correctly ?

'chris' — Mon, 27 Jun 2005 14:57:07 GMT

@Stuart Browne

"It's in memory"

You mean RAM Memory ?

Re: howto check if DNS sever caches queries correctly ?

Stuart Browne — Mon, 27 Jun 2005 19:05:22 GMT

In the proces memory space, yea. As in a 'ps' will show how much memory it is using.

Re: howto check if DNS sever caches queries correctly ?

Bejoy C Alias — Tue, 28 Jun 2005 02:29:26 GMT

Dear Cris,
The dns cache is in ur ram memory . When u restart ur dns server all the cache is lost . Bind is not storing any dns cache in files . U cant modify the amount of memory bind uses to allocate for the cache , bind allocates the memory depending on ur total memory . U can check whether the query is resolved from the cache or from the isp server by using the steps from Kodgo or u can see the query time it takes to check whether it is resolving from cache or ur isp server. Pls see the attachment and see the query time difference.

Re: howto check if DNS sever caches queries correctly ?

Schmid Marco — Sun, 03 Jul 2005 11:04:06 GMT

i understand why the cache is held in ram, but how to deal with the following situation:

in a large scale structure the dns cache helps to avoid
a lot of unnescessary querys for the same domain. but if someone moves a server from one ip to another and i have to update the cache entrys just for that specific host what would be the best method ???

remember, i dont want to loose the whole cache with a restart

Re: howto check if DNS sever caches queries correctly ?

Matti_Kurkela — Mon, 04 Jul 2005 09:13:10 GMT

If you want a persistent (=on-disk) cache for some domains you're using a lot, have you considered making your DNS server a "slave" for that zone?

You can be a "stealth-slave": that is, your DNS server does not need to be announced to the world in NS records, so you don't get random queries to that zone from the outside world.

To be a "stealth-slave" for a zone, you first ensure that your server is permitted to "suck" a copy of the desired zone's data from some DNS server that already is authoritative for the zone.

Then you configure something like this in you r named.conf:

zone "some.domain.example" {
type slave;
masters { authoritative.server.ip.addr; };
file { "/etc/bind/slave/db.some.domain"; };
};

Ensure that the bind process can write to the file mentioned in "file" directive, and you're all set. Restart BIND (or say "rndc reconfig" if you've set up rndc properly) and it will automatically fetch the current data for the zone, store it into the file and keep the file up to date.

If the domain's content is changing often, it would be good to have the domain's master server set up an "also-notify" for you: normally a slave server checks periodically on its master for changes to the duplicated zone data, but the master can also send NOTIFY messages to the slaves when the data changes. This is done automatically for official slaves (those mentioned in the zone's NS records), but for stealth-slaves the master server must be configured explicitly to send the notify message, because the master has no other way to know about the slave's existence.

Re: howto check if DNS sever caches queries correctly ?

'chris' — Wed, 06 Jul 2005 19:49:23 GMT

thanks,

but howto modify the amount of memory bind uses ?

Re: howto check if DNS sever caches queries correctly ?

Stuart Browne — Wed, 06 Jul 2005 19:59:41 GMT

There are no configuration options that I'm aware of to do this.

If you're really desperate to limit the amount of memory bind uses, then it's back to the source for you! ;)

Re: howto check if DNS sever caches queries correctly ?

Bejoy C Alias — Wed, 06 Jul 2005 23:21:01 GMT

Chris,
U cant modify the amount of memory bind uses for caching. The amount of memory which bind allocates is depending upon the total memory u have in ur system.

Re: howto check if DNS sever caches queries correctly ?

'chris' — Sun, 10 Jul 2005 06:42:37 GMT

I have 2 questions:

1.) Howto modify the amount of memory bind uses for caching ?

2.) How can I check how much memory uses BIND now ?

Re: howto check if DNS sever caches queries correctly ?

Stuart Browne — Sun, 10 Jul 2005 06:49:48 GMT

1) Source code modification, recompile. Not simple.

2) ps -elf | grep named, check the SZ (10th) column, in kilobytes.

Re: howto check if DNS sever caches queries correctly ?

'chris' — Sun, 10 Jul 2005 07:25:03 GMT

thanks, but which one is SZ column ?

# ps -elf | grep named
1 S root 1338 1 0 69 0 - 561 select Jul08 ? 00:00:00 /sbin/syslogd -a /var/lib/named/dev/log
1 S bind 1349 1 0 69 0 - 3002 rt_sig Jul08 ? 00:00:00 /usr/sbin/named -u bind -t /var/lib/named
1 S bind 1352 1349 0 69 0 - 3002 poll Jul08 ? 00:00:00 /usr/sbin/named -u bind -t /var/lib/named
5 S bind 1353 1352 0 70 0 - 3002 rt_sig Jul08 ? 00:00:37 /usr/sbin/named -u bind -t /var/lib/named
1 S bind 1354 1352 0 69 0 - 3002 nanosl Jul08 ? 00:00:00 /usr/sbin/named -u bind -t /var/lib/named
1 S bind 1355 1352 0 69 0 - 3002 select Jul08 ? 00:00:04 /usr/sbin/named -u bind -t /var/lib/named

Re: howto check if DNS sever caches queries correctly ?

Stuart Browne — Sun, 10 Jul 2005 16:11:58 GMT

the 10th column. the '3002'. So about 3MB of memory for you.