On Tue, Oct 03, 2023 at 02:10:50PM +0100, Ben Cox via dns-operations wrote:
> I would suspect this is caused by NO_DELAY being enabled (as it
> should) and some code writing out the dns response buffer in two
> parts. That server in the pcap appears to be running unbound 1.4.22:
I assume you mean to say "NO_DELAY *not* being enabled (as it should)".
Without "NO_DELAY", Nagle's algorithm may kick in, and subsequent
"short" writes may be delayed waiting for even more data, as reported.
So, certainly, a 2-byte initial response with a following delay is
entirely consistent with sloppy server code (not consolidating the
writes) and Nagle.
The one-byte writes are a bit more surprising, but perhaps this is how
some programmers handle network byte order, instead of using htons(3).
--
Viktor.
_______________________________________________
dns-operations mailing list
[email protected]
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
