How not to cache a DNS lookup

[David Barkman]

Hello

Is it possible to make a client or a server not cache the results of an nslookup?

I am using name resolution to contact a server that for security reasons, changes its IP address about every 15-30 seconds. So on a regular basis, I can't connect, I assume because I'm using incorrect cache.

My client is an R390 running HP-UX 11.0. I'm not sure what the server is, but I could setup DNS on the client and have it just use itself for resolution, but would still need it not to cache lookups for this one site.

Thanks in advance for any help!

[Mark Grant]

Is it DNS or arp that's the problem here? You'd probably want delete the arp entries.

I'm really interested to know what useful connection you can make to a machine that changes it's IP address every 15-30 seconds though.

[doug mielke]

I'd love to hear more about this.

Our systems take about 2 minutes for an IP address change to propagate through the switches, and 10 or 15 minutes for a DNS change to be seen throughout the building. More time still for the WAN to catch up.

If you do decide to clear the ARP table, and not just an entry, be prepared for the short flood and delay on a big net when everyone sends out new arp requests.

[David Barkman]

Thanks for the replies so far.

We are connecting a commerce server to a credit card processor, so the connections rarely last more than a second.

Looking closer, I found the cc processor rolls its IP between three IPs every 15, 30, 45, or 60 seconds, which IP it uses and how long it will use it for is completely random.

They only way they will let us connect is through name resolution, but as before, if we cache that IP, it may not work in the near future.

We are also calling the cc processor to see if they know how to setup our DNS to not cache their address. But if anyone knows a way, please respond.

Thanks again!

[A. Clay Stephenson · Accepted solution]

I assume that you are using BIND9; if you ain't you should be and the best place to get it is from www.isc.org since they develop and maintain it. I always download the source and compile/link it and 9.2.0 works very well on 11.0.

If you want to completely disable caching in the named.conf file options section:

options {
recursion no;
};

but I doubt you want to do that. The better answer would be to instruct all DNS queries about a particular zone (e.g. "creditcard.abc") to be directed to a particular forwarder and not attempt to do any local resolution.

zone "creditcard.abc" {
type forward;
forwarders {65.165.23.17};
forward only;
};

This will have the effect of forwarding all requests concerning "xxx.creditcard.abc" to 65.165.23.17. The syntax also allows for non-default ports for that DNS server.

[U.SivaKumar_2]

Hi,

I beg to differ. Disabling Recursion in a Caching only DNS server( in forwarding setup ) will disable the name resolving ability of the caching server.

I would suggest to use max-cache-ttl option in named.conf.

For example, in named.conf put

max-cache-ttl 5

will expire the cached entries after 5 seconds and perform a fresh recursive lookup.

regards,

U.SivaKumar.

[rick jones]

Does the CC company give any particularly compelling reason for rotating the IPs? On the surface, it sounds rather bogus. Are they trying to do load balancing or something?

In addition to all the discussion of how to get a caching DNS server to not cache replies, you have to consider client application behaviour. While the HP-UX name resolver library will not cache replies (IIRC), you have to make sure that your client application makes a fresh gethostbyname/getaddrinfo (prefered to gethostbyname so you can start getting ready for IPv6...) call before each attempt to connect().

If the client code is run from scratch on each request then that will happen naturally.

[A. Clay Stephenson]

After thinking about this more, it sounds as though the credit card company is using a "round-robin" pool of IP addresses for the same hostname. This is a fairly common method of ditributing services among a number of servers. When I first read your posting, it seemed that a given IP address would only be valid for 15 seconds or so but typically those DNS servers which hand out round robin IP addresses expect ANY of the IP addresses so returned to be valid with no restrictions. The idea is that client A gets one IP address, client B gets another, and client C gets still another until the circular list rolls over. --- but all three should be able to use the same IP address. You really need to find out if this really matters.