howto check if DNS sever caches queries correctly ?

['chris']

hi

howto check if DNS sever caches queries correctly ?
I've installed an internal DNS server BIND 9 on Debian.

under options I have forwarders of my ISP:

options {
directory "/var/cache/bind";

forwarders { 211.12.X.X; 211.12.X.X; 194.15.X.X; };

forward first;

.....................................................................................................


howto be sure, that caches all queries
and doesn't go each time to the internet to ask DNS servers of my ISP ?

kind regards
chris

[Kodjo Agbenu]

Hello Chris,

Quite straightforward :
* nslookup or dig
* unplug the network cable
* nslookup or dig

You may also try a "soft" method by using tcpdump or ethereal as a spy for outgoing network traffic (monitor port 53, TCP and UDP).

Good lcuk.
Kodjo

['chris']

thanks,

I've tried and this is working,
but I cannot find any Bind cache files.

/var/cache/bind is always empty.

where is Bind putting its cache files ?

greetings
chris

[Stuart Browne · Accepted solution]

It's in memory.

[Karsten Breivik_1]

Interesting thread. At my work I have discovered that the DSN servers may in some cases return different answers depending on if your client computer is logged on to the domain or not. We are using MS based DNS servers and I have not bothered to look into why this is happening. I am sure The Sysadmin in all his wisdom propably have a perfectly good explanation for this. However, it is useful to be aware that this behavior can happen.

[Stuart Browne]

Windows PC's also have local caching of DNS names. Unfortunately, it frequently also caches failed lookups, and doesn't honor TTL's nicely.

If you get weird results like that, you can flush the DNS cache using the command 'ipconfig /flushdns' (on the windows box).

anyway ;)

['chris']

@Stuart Browne

"It's in memory"

You mean RAM Memory ?

[Stuart Browne]

In the proces memory space, yea. As in a 'ps' will show how much memory it is using.

[Bejoy C Alias]

Dear Cris,
The dns cache is in ur ram memory . When u restart ur dns server all the cache is lost . Bind is not storing any dns cache in files . U cant modify the amount of memory bind uses to allocate for the cache , bind allocates the memory depending on ur total memory . U can check whether the query is resolved from the cache or from the isp server by using the steps from Kodgo or u can see the query time it takes to check whether it is resolving from cache or ur isp server. Pls see the attachment and see the query time difference.

[Schmid Marco]

i understand why the cache is held in ram, but how to deal with the following situation:

in a large scale structure the dns cache helps to avoid
a lot of unnescessary querys for the same domain. but if someone moves a server from one ip to another and i have to update the cache entrys just for that specific host what would be the best method ???

remember, i dont want to loose the whole cache with a restart

[Matti_Kurkela]

If you want a persistent (=on-disk) cache for some domains you're using a lot, have you considered making your DNS server a "slave" for that zone?

You can be a "stealth-slave": that is, your DNS server does not need to be announced to the world in NS records, so you don't get random queries to that zone from the outside world.

To be a "stealth-slave" for a zone, you first ensure that your server is permitted to "suck" a copy of the desired zone's data from some DNS server that already is authoritative for the zone.

Then you configure something like this in you r named.conf:

zone "some.domain.example" {
type slave;
masters { authoritative.server.ip.addr; };
file { "/etc/bind/slave/db.some.domain"; };
};

Ensure that the bind process can write to the file mentioned in "file" directive, and you're all set. Restart BIND (or say "rndc reconfig" if you've set up rndc properly) and it will automatically fetch the current data for the zone, store it into the file and keep the file up to date.

If the domain's content is changing often, it would be good to have the domain's master server set up an "also-notify" for you: normally a slave server checks periodically on its master for changes to the duplicated zone data, but the master can also send NOTIFY messages to the slaves when the data changes. This is done automatically for official slaves (those mentioned in the zone's NS records), but for stealth-slaves the master server must be configured explicitly to send the notify message, because the master has no other way to know about the slave's existence.

['chris']

thanks,

but howto modify the amount of memory bind uses ?

[Stuart Browne]

There are no configuration options that I'm aware of to do this.

If you're really desperate to limit the amount of memory bind uses, then it's back to the source for you! ;)

[Bejoy C Alias]

Chris,
U cant modify the amount of memory bind uses for caching. The amount of memory which bind allocates is depending upon the total memory u have in ur system.

['chris']

I have 2 questions:

1.) Howto modify the amount of memory bind uses for caching ?

2.) How can I check how much memory uses BIND now ?

[Stuart Browne]

1) Source code modification, recompile. Not simple.

2) ps -elf | grep named, check the SZ (10th) column, in kilobytes.

['chris']

thanks, but which one is SZ column ?

# ps -elf | grep named
1 S root 1338 1 0 69 0 - 561 select Jul08 ? 00:00:00 /sbin/syslogd -a /var/lib/named/dev/log
1 S bind 1349 1 0 69 0 - 3002 rt_sig Jul08 ? 00:00:00 /usr/sbin/named -u bind -t /var/lib/named
1 S bind 1352 1349 0 69 0 - 3002 poll Jul08 ? 00:00:00 /usr/sbin/named -u bind -t /var/lib/named
5 S bind 1353 1352 0 70 0 - 3002 rt_sig Jul08 ? 00:00:37 /usr/sbin/named -u bind -t /var/lib/named
1 S bind 1354 1352 0 69 0 - 3002 nanosl Jul08 ? 00:00:00 /usr/sbin/named -u bind -t /var/lib/named
1 S bind 1355 1352 0 69 0 - 3002 select Jul08 ? 00:00:04 /usr/sbin/named -u bind -t /var/lib/named

[Stuart Browne]

the 10th column. the '3002'. So about 3MB of memory for you.