BIND9 and empty responses

[David Bandel]

On 6/14/05, Matthew Carpenter <matt at eisgr.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
[snip]

> Should we assume, since you moved the master to the other box, that
> restarting named didn't resolv the issue?
> Would you mind making your named.conf and the two zone files available?

restarting didn't do anything.  But I may have the answer anyway.

> 
> If a restart resolved the issue, I would suggest an unknown bug (or
> known by bad folks) in the service itself.  Bit the service bug would
> be resolved by killing the process and restarting it.

No bug, but the condition is reproducible.

> 
> What process did you follow, exactly, in switching the slave to a
> master and what was the last access-time for the slave zone files?

in named.conf just changed the type from master to slave (and vice
versa in the slave server), also the file line and masters line, then
moved the zone files and reloaded.

> 
> Wierd.  I don't suppose you can now reproduce it (ie.  files all
> modified from the slave <-> master swap)?  If everything was as you
> describe, I'm now intrigued as well.

I must say first that the master server is not isolated like it should
be, it does recursion and answers client requests.  Not good, will be
changing that soon.

A few days ago, a new client was added.  That client is a "publicist"
(translation: spammer).  The server is now seeing a 180% increase in
DNS requests.  The load is always over 2.5, and the traffic is around
350kbits/sec, all port 53 traffic.

So I'm going to move the master off to another IP, isolate it, make it
non-recursive and only respond to the slaves.  The slaves will answer
all clients and pull zones from the master.

Watching tcpdump on this system, it was amazing how many SERV FAILs I
saw.  I'm still astounded the system could keep up with the traffic.

Ciao,

David A. Bandel
-- 
Focus on the dream, not the competition.
            - Nemesis Air Racing Team motto