topic Re: DNS, UDP & ICMP in Operating System - OpenVMS

DNS, UDP & ICMP

Wim Van den Wyngaert — Wed, 09 Apr 2008 11:19:10 GMT

I did a tcptrace/prot=udp and found many udp packets arriving on ports without the VMS node responding to it (ports 2301, 67, 138). No ICMP UNREACH was generated.

However, for DNS I get from time to time a packet from the DNS server (coming from port 53) on which my system reacts with ICMP UNREACH. Looking further, I found that the package of DNS came 8 seconds after VMS sended the request. I guess my udp listener was no longer there.

When does TCP generate an ICMP UNREACH for incoming UDP packets without a UDP listener ?

Wim

Re: DNS, UDP & ICMP

Richard Whalen — Wed, 09 Apr 2008 12:12:55 GMT

TCP does not generate ICMP UNREACH for incoming UDP packets. UDP might, but it won't for broadcast or multicast packets. I doubt that tcptrace with /prot=udp is sending broadcast/multicast packet as the typical way to do a tcptrace is to send the packet with a small TTL (time to live/hop limit). When the IP layer processes the packet and notices that the TTL is zero, but the packet is not at the destination it will send an ICMP Time Exceeded packet back to the source. TCPTRACE will start the TTL at 1 and increase it until the packet reaches the destination.

DNS packets are most likely sent with a TTL of 255 (the maximum) to begin with, so they can wander around a lot longer trying to get to the destination.

Re: DNS, UDP & ICMP

Wim Van den Wyngaert — Wed, 09 Apr 2008 12:23:38 GMT

Richard,

With TCP I meant the TCP software. But indeed the UDP layer of it.

I didn't think of that. DNS is indead to an address and all other UDP packets were broadcasts. So, it's logical that only DNS got the ICMP.

And I think you confuse tcptrace with traceroute (tcptrace doesn't send any packages.

Solved.

Wim

Re: DNS, UDP & ICMP

Richard Whalen — Wed, 09 Apr 2008 17:56:08 GMT

Yes, I did confuse tcptrace with traceroute. I don't regularly use TCP/IP services, so I don't know all of the utilities by name. From looking at the documentation I now see that tcptrace is effectively tcpdump.

I suspect that part of the answer you don't see ICMP UNREACH packets is that you asked tcptrace to only report on the UDP protocol so it won't display ICMP packets.

Re: DNS, UDP & ICMP

Wim Van den Wyngaert — Mon, 14 Apr 2008 05:51:59 GMT

Richard,

I first did a trace of ICMP. Then a full trace of all IP packets for that node. And then wait until the word ICMP came up.

Wim

Re: DNS, UDP & ICMP

Wim Van den Wyngaert — Mon, 14 Apr 2008 13:03:38 GMT

Still strange. See enclosed trace.

I have in ucx sho nam
retry : 4
timeout : 4
1 DNS server (was 2 but removed 1)

Why is the DNS "listener" gone after 2 of the 4 retries ? Is the listener temporary gone for some time during the retries ?

Wim