Hello,my name is Jan Petto and I am currently studying computer science at TU Darmstadt, Germany. During the research for my thesis, I have found some odd behavior regarding DNS over TCP, which neither I nor my supervisor can explain. I am hoping somebody here can tell me what I am observing:
For my research, I am sending DNS requests over TCP to many different recursive DNS servers all over the world. A significant portion of these servers is sending the DNS response in two separate TCP segments, even though it would easily fit into one packet. Only after my client has acknowledged the first segment, the second part of the response is sent. The first TCP segment always contains only one or two bytes, never more.
I know a DNS message sent over TCP is prefixed by a two-byte field containing the message length. My first thought was that the first TCP segment contains this length field, and the second segment contains the DNS message, but then I discovered cases where only one of the two length bytes was contained in the first segment. In any case, sending the message length as a separate packet does not make much sense to me from an application design perspective. Maybe this is some sort of attack mitigation?
I have attached a packet capture containing two such examples. You can reproduce the behavior with any DNS client, e.g. dig:
# dig example.org +tcp @100.37.202.139Also attached is a list of public DNS server IP addresses, where I have observed this behavior. They were found via scans of the IP address space, I have no affiliation with these servers.
I would greatly appreciate any input as to why so many servers are sending their responses in such a way.
Kind regards, Jan
ipsize-dns-fragmented.pcapng
Description: application/pcapng
196.178.99.42 196.178.97.74 196.178.100.75 196.178.97.33 186.96.181.137 2a00:1a48:7805:112:52f4:c70e:ff08:410b 196.178.97.19 146.234.4.9 94.113.255.203 85.97.108.112 213.89.54.107 96.244.44.210 146.234.6.22 50.195.74.209 109.238.128.2 94.199.109.83 80.50.143.70 128.92.181.234 85.105.101.244 94.121.14.48 94.190.57.64 196.178.97.22 68.129.212.234 65.212.192.190 199.16.96.117 146.234.4.76 62.154.249.210 210.183.167.70 71.13.93.234 94.199.109.118 213.47.151.33 84.248.207.134 74.115.78.103 46.127.32.30 85.99.121.187 219.249.252.199 65.204.37.126 12.26.58.58 84.238.110.212 68.161.180.132 1.231.78.168 84.250.22.253 47.46.242.45 1.254.12.156 96.39.117.49 221.140.146.234 221.141.114.252 84.251.33.239 158.193.168.87 219.240.29.214 97.68.237.221 65.204.37.125 65.220.42.38 47.22.26.100 207.229.159.102 73.206.222.60 162.246.127.108 47.7.35.32 84.202.177.92 211.229.85.122 85.100.126.39 84.250.31.50 8.40.199.130 71.13.8.253 65.204.37.121 68.132.214.202 85.105.243.3 213.81.205.219 211.244.46.28 85.105.127.19 219.240.41.167 97.94.37.153 117.123.213.235 73.47.162.91 67.203.65.119 213.95.17.117 84.238.101.91 37.186.246.227 73.204.89.144 71.8.217.101 190.196.237.181 68.204.213.178 63.145.195.171 210.181.78.148 210.123.59.52 178.174.156.158 136.25.188.10 97.90.69.137 71.37.163.73 68.188.125.109 201.6.108.239 80.50.102.198 46.105.240.201 114.108.101.221 96.39.85.241 221.143.78.43 1.251.73.59 76.136.193.229 219.248.220.60 97.95.243.248 177.135.246.125 96.35.180.153 96.38.247.157 69.195.19.126 77.26.206.123 221.143.145.6 1.234.251.218 155.4.142.2 98.121.86.8 85.105.227.211 63.158.233.242 80.67.102.78 85.97.203.192 65.204.37.123 1.236.228.56 1.228.40.81 219.248.62.20 181.80.221.28 1.250.177.66 47.17.84.151 85.198.220.79 184.74.4.90 201.6.157.195 221.142.156.120 2a00:19a0:3:73:0:d9c6:73a7:1 1.229.138.117 71.14.129.11 199.88.54.147 135.26.231.217 121.1.101.20 1.236.135.117 211.245.1.186 47.23.39.75 1.234.72.194 71.78.111.122 71.15.61.49 69.36.56.194 210.97.122.146 189.1.130.178 1.248.180.17 74.142.250.122 186.103.169.13 1.241.255.209 124.43.16.128 219.251.80.2 219.250.233.64 2a00:19a0:3:73:0:d9c6:73a8:1 211.250.7.187 219.251.64.249 152.179.195.50 47.180.183.29 219.254.58.51 203.232.126.117 219.254.55.117 61.80.243.144 219.255.19.117 219.241.23.181 84.238.118.126 131.148.23.33 24.142.130.69 146.234.12.61 219.251.65.136 65.204.37.120 47.22.167.70 89.36.12.46 210.181.125.174 1.237.63.49 219.250.166.235 219.248.22.70 196.178.97.28 74.62.223.150 134.249.122.58 1.243.175.200 210.103.56.198 221.143.39.141 2600:8803:2400:2:b675:eff:fef8:9184 47.23.129.29 189.120.98.146 66.214.36.201 61.85.73.87 96.39.19.209 1.243.177.174 221.138.56.206 219.240.64.67 73.84.59.219 23.92.4.192 2a00:19a0:3:73:0:d9c6:73b1:1 181.47.46.133 95.209.148.48 1.237.70.173 61.85.1.84 219.251.80.203 85.230.180.208 85.105.234.248 219.250.155.177 210.96.2.24 1.240.209.144 2a00:19a0:3:73:0:d9c6:732c:1 47.47.63.77 210.183.180.18 210.224.86.126 84.33.37.139 82.222.24.4 203.229.17.12 202.152.112.223 138.59.177.89 2001:559:8451::1 201.6.111.12 1.224.93.120 153.230.202.70 219.250.166.77 1.228.222.187 219.248.235.39 219.240.242.171 208.29.185.192 83.99.165.47 178.176.245.92 208.29.185.196 210.104.171.63 85.105.47.187 210.117.20.16 221.143.84.224 221.157.145.248 201.69.254.97 97.86.80.189 199.83.119.73 199.0.193.48 76.180.91.108 1.251.162.114 97.87.88.121 190.196.224.206 85.98.209.48 47.50.157.169 1.228.136.6 221.140.55.15 190.128.118.169 1.246.55.22 24.157.45.170 61.81.58.212 74.143.157.25 85.98.45.245 86.60.145.82 86.60.184.118 92.154.38.19 2001:559:800c:1900::1536 221.143.33.18 221.141.147.207 219.255.107.86 190.196.234.252 219.251.80.86 12.28.27.174 1.236.220.97 1.228.222.181 221.142.206.222 134.195.116.204 210.106.122.195 190.181.23.34 210.117.32.167 186.190.232.58 196.178.99.16 12.215.32.133 1.235.249.112 47.49.15.17 1.239.153.248 221.143.248.81 1.243.15.85 135.26.231.43 219.254.58.105 219.251.86.192 219.254.58.38 219.255.227.47 76.170.200.166 221.140.194.151 1.228.191.208 221.140.57.9 2001:579:d120:7:6238:e0ff:fe6f:5d7f 95.209.148.254 219.255.19.84 201.18.5.153 221.140.74.68 188.231.144.6 65.204.37.116 65.201.145.197 219.251.203.125 61.47.240.210 219.251.171.91 219.255.107.157 221.142.156.35 177.135.246.161 1.228.33.45 1.224.176.85 213.81.198.252 201.76.161.162 219.240.89.194 76.155.209.84 219.248.235.48 47.50.180.149 94.79.137.62 221.157.53.232 74.143.80.153 211.243.117.184 1.254.89.44 221.142.142.16 1.224.182.233 62.150.238.171 1.254.237.248 210.181.78.193 47.14.67.232 47.50.186.17 209.73.95.29 1.249.49.167 85.97.201.156 219.251.80.50 219.254.207.193 74.142.203.217 138.36.1.131 74.143.22.13 221.141.240.148 80.79.241.180 2a00:19a0:3:73:0:d9c6:73a6:1 201.21.206.81 219.254.83.168 201.6.121.81 185.90.150.2 219.251.253.164 92.27.111.120 131.108.100.216 61.80.244.144 209.73.92.67 47.47.79.193 1.229.13.175 153.225.33.158 221.142.251.45 1.234.72.238 221.142.9.34 1.237.46.38 47.49.156.9 126.207.74.45 97.89.209.157 221.142.206.156 211.245.70.49 219.248.237.116 223.131.125.199 1.239.141.157 219.251.253.69 201.7.1.228 219.250.166.53 1.243.204.252 47.50.218.41 181.39.10.131 12.3.202.230 219.251.253.221 209.73.85.1 219.250.181.48 219.250.166.225 158.75.69.5 219.251.80.127 201.6.102.193 219.248.24.171 24.153.133.217 201.2.196.60 93.43.7.68 124.43.16.247 1.243.177.149 219.251.168.239 85.105.185.89 1.234.251.240 1.228.182.10 5.79.229.225 1.224.156.101 197.91.157.63 219.251.80.83 219.251.80.179 1.231.34.66 221.139.159.81 219.250.233.72 219.251.43.11 69.204.50.204 1.231.155.51 221.138.163.158 190.143.245.84 163.123.2.223 219.254.253.145 122.16.53.205 94.121.14.233 134.119.188.105 85.105.30.152 95.209.148.47 1.228.229.106 219.254.141.69 179.253.13.29 163.53.180.141 211.228.55.182 212.220.204.109 221.141.241.110 66.207.84.163 221.140.55.41 153.233.252.12 41.90.112.194 193.168.153.182 201.93.178.74 152.170.61.77 164.132.28.106 189.122.38.104 1.224.79.136 85.105.89.23 221.143.235.49 124.46.160.39 219.254.21.174 152.170.117.55 174.56.1.217 69.38.175.206 116.34.82.177 134.119.188.109 201.18.146.94 199.227.108.101 201.2.196.53 1.229.208.121 94.70.135.161 168.235.72.175 201.18.68.210 152.231.92.158 162.247.149.172 124.46.160.12 186.122.36.11 96.35.199.85 136.143.205.147 68.174.32.22 190.190.83.48 124.46.160.62 176.178.183.177 189.4.63.229 47.46.177.33 122.23.0.89 85.221.235.142 2a00:ea8:100:f::73 163.53.180.51 165.84.164.108 190.196.225.238 94.70.199.49 155.0.179.29 134.119.188.123 134.119.188.122 124.46.160.19 85.105.74.245 134.119.188.110 217.182.234.187 47.23.92.70 190.196.225.254 134.119.188.120 71.26.220.61 86.57.207.30 86.60.199.23 128.127.66.206 201.17.130.47 97.94.217.194 152.170.63.21 134.119.188.108 189.112.44.180 134.119.188.125 47.46.175.185 190.196.237.162 190.196.224.222 170.187.201.167 134.119.188.103 89.216.103.160 124.46.160.61 97.69.225.21 126.143.24.74 74.62.85.165 126.143.30.246 134.119.188.118 190.196.224.172 134.119.188.121 163.53.180.50 76.243.124.202 124.46.160.48 192.171.210.33 72.139.71.98 89.35.117.208 136.25.170.47 195.210.2.229 97.89.92.153 139.60.81.166 89.33.238.200 89.33.239.224 126.143.33.150 201.16.208.139 74.62.175.3 124.46.160.34 201.6.103.129 126.143.22.222 72.137.169.66 190.196.224.242 201.18.144.129 201.7.1.17 94.203.238.82 126.143.2.50 97.77.106.4 186.96.253.149 194.206.119.99 176.178.182.37 124.46.160.59 126.143.25.78 212.220.210.230 85.99.245.24 42.82.38.246 199.19.62.213 96.36.248.12 141.105.61.104 192.36.182.144 85.98.10.171 213.91.171.189 126.143.10.54 126.143.21.118 213.186.143.119 82.209.228.117 210.123.8.237 190.193.64.16 199.233.236.76 199.241.30.225 2804:2264:8000:0:fa7f:a5ff:fe07:fce6 95.211.209.41 85.105.178.9 153.230.171.177 77.62.163.7 164.132.189.37 199.244.50.239 23.96.94.187 162.222.23.242 190.196.224.139 8.41.42.210 158.51.80.141 2a01:d0:ffff:50a::f3e7 65.255.197.147 94.205.212.142 190.196.225.43 190.196.239.231 104.240.239.213 96.35.212.17 194.213.21.188 208.138.27.230 89.42.238.234 190.196.225.92 153.228.153.12 2.50.190.192 192.160.248.46 94.201.105.155 98.126.207.68 47.88.4.199 210.186.176.198 177.220.188.100 2.50.168.71 109.28.235.166 211.243.210.211 62.156.151.181 125.1.51.53 86.57.234.16 2800:160:1168:1::14 146.234.4.77 198.31.32.13 153.246.191.15 102.50.248.57 192.169.7.39 217.178.113.52 199.68.191.78 153.231.79.18 148.69.179.183 94.205.212.140 210.186.176.95 2.50.30.100 212.205.243.1 217.165.114.137 102.50.245.142 72.130.78.198 162.247.150.182 217.178.113.51 72.0.242.64 94.204.104.203 208.131.164.11 212.205.210.41 116.49.147.248 124.159.92.54 85.105.128.48 68.170.92.184 210.186.176.115 74.133.228.111 94.202.53.34 80.70.233.234 211.238.78.2 181.28.131.24 185.72.149.1 74.62.198.28 185.67.2.242 103.49.59.110 88.37.226.84 200.228.168.3 94.200.134.58 190.149.255.185 88.37.226.82 194.206.119.100 153.246.9.160 189.14.192.30 212.220.110.82 213.172.5.100 94.201.105.185 162.212.232.14 94.206.205.35 76.179.67.50 100.38.149.212 47.44.72.167 68.185.109.132 162.254.207.3 81.4.160.179 116.49.234.249 65.255.197.146 212.71.238.118 208.138.28.42 126.34.147.146 76.8.202.50 40.122.75.101 213.92.197.135 76.173.80.21 124.47.199.231 197.255.217.218 199.241.31.83 181.29.205.166 150.129.62.145 201.73.96.34 197.246.171.19 177.130.49.107 40.122.150.136 153.231.6.202 3.144.47.60 52.237.75.71 192.240.114.34 85.105.7.71 106.51.76.42 192.240.114.36 97.78.86.62 134.119.188.106 114.30.135.195 162.247.146.115 67.209.206.71 103.49.57.162 85.26.248.144 103.35.142.23 104.244.77.67 103.49.59.253 192.240.114.35 64.183.93.234 198.136.51.251 5.89.30.10 103.35.142.113 103.49.58.31 124.47.220.163 193.185.161.72 104.243.228.225 40.122.133.169 41.33.215.89 162.250.114.113 103.49.58.119 92.154.51.178 106.51.85.179 217.178.36.225 103.49.57.239 106.51.126.193 134.119.188.126 189.8.82.132 150.147.38.6 40.122.213.18 134.119.188.107 1.32.99.14 2605:8900:3000:1001:a:0:8f:1 103.49.56.249 212.205.243.161 190.144.33.116 2605:8900:3000:1001:a:0:8c:1 103.49.58.162 196.178.97.117 40.122.167.150 192.160.246.57 194.190.30.184 103.49.59.215 152.44.112.181 2605:8900:3000:1001:a:0:90:1 134.119.188.104 96.239.56.53 71.76.171.4 40.122.164.104 103.49.56.232 40.122.209.200 103.49.58.43 2600:3c00::f03c:91ff:fedb:9953 46.45.144.184 134.119.188.119 103.49.57.21 2605:8900:3000:1001:a:0:93:1 153.225.120.125 103.49.58.140 202.124.224.163 23.91.218.38 201.21.208.136 46.45.144.188 2605:8900:3000:1001:a:0:8e:1 106.51.129.231 201.73.17.20 188.247.40.233 103.49.57.102 150.129.120.160 37.150.124.150 150.129.120.198 150.129.120.147 146.234.4.56 122.25.52.60 193.185.161.73 150.129.120.191 152.169.162.236 41.141.250.233 103.49.57.54 103.49.58.236 72.142.160.85 195.250.65.54 194.147.144.252 203.227.215.80 126.131.133.245 2a00:19a0:3:72:0:d9c6:727a:1 184.83.103.90 202.157.68.194 210.124.149.209 54.92.108.243 2400:8901::f03c:91ff:fef1:a07e 141.164.96.6 163.53.86.206 2600:3c00::f03c:91ff:fe55:b20a 95.209.161.102 182.50.68.222 106.51.39.10 181.28.73.131 43.206.226.8 65.214.70.39 41.140.245.226 196.92.1.233 150.129.120.212 106.51.132.130 155.0.181.2 168.243.205.205 203.227.216.18 2a00:19a0:3:72:0:d9c6:7210:1 77.106.161.166 150.129.63.23 177.222.254.75 197.95.196.78 117.4.33.40 190.145.38.2 47.49.229.233 2a00:19a0:3:72:0:d9c6:7211:1 213.91.150.178 150.129.120.240 203.8.30.134 41.140.244.87 150.129.120.247 164.132.212.38 128.65.186.84 85.105.192.57 203.253.253.36 94.70.210.177 96.35.215.25 12.205.173.60 202.149.204.199 94.74.128.2 190.194.148.212 203.8.30.145 202.149.204.253 213.89.210.76 179.228.172.51 82.200.198.30 202.149.205.63 213.89.223.230 202.149.205.21 192.190.162.137 177.130.49.1 202.149.205.210 202.149.204.54 202.149.205.118 24.143.77.166 177.203.53.104 198.153.111.212 190.136.20.104 150.129.120.254 86.57.193.74 190.196.225.140 202.149.205.39 103.234.94.225 202.149.205.74 202.149.205.238 184.83.60.187 62.141.27.206 71.13.181.13 201.17.131.148 84.250.253.113 217.182.234.181 94.70.205.225 212.205.210.42 210.181.78.143 124.32.164.119 92.124.145.79 96.35.193.229 202.62.95.150 202.149.204.99 139.0.18.82 73.46.233.199 190.196.225.106 197.246.11.217 103.226.226.54 221.138.30.45 122.222.113.252 84.238.114.95 118.163.84.48 164.132.212.37 202.149.205.59 200.236.7.141 202.62.95.18 210.59.236.121 122.26.142.48 150.129.120.186 210.242.211.149 118.163.60.84 122.166.167.216 52.166.182.150 150.129.62.170 213.142.213.238 136.232.49.174 202.149.205.73 216.54.23.36 117.2.105.36 179.254.6.101 164.132.212.39 177.222.249.124 196.178.97.66 112.196.183.8 84.47.134.203 83.149.31.108 150.129.120.181 135.129.129.180 112.196.183.252 201.3.242.101 150.129.120.234 2605:ea00:1:1:1:1:7424:e21c 2605:ea00:1:1:1:1:76a6:a13a 150.129.120.244 74.62.51.228 85.105.243.21 190.196.224.192 212.205.228.92 111.118.152.44 172.254.155.36 95.209.148.61 128.65.54.99 177.130.52.78 189.10.61.145 77.18.151.179 196.178.100.22 61.62.214.57 201.17.130.95 202.149.205.117 168.228.6.94 103.49.57.39 65.38.241.8 124.36.45.235
_______________________________________________ dns-operations mailing list [email protected] https://lists.dns-oarc.net/mailman/listinfo/dns-operations
