Hi Guys,
I'm sending this to both LVS and Keepalived mailings lists, as both
technologies are involved here, and I'm not sure where the failure might
be. It's conceivable that it should go to the netfilter list too, but
perhaps you can advise me on that.
The basic gist of the problem is that my DNS cluster has multiple
external VIPS, being highly available using keepalived. DNS requests
are load balanced across 6 back-end real servers. In most cases, DNS
requests come in on one of three external VIPS (the 88.88.192.250,
193.250 and 192.254 addresses), and the responses go back out from those
IPs, although I'm not sure if the LVS NAT or iptables NAT is taking care
of that side of things - it's just magic.
A few times now, we have had big external providers come to us saying
that no requests to our nameservers were working. Looking in to it, it
looks like we're replying on the wrong VIPs (ie, not the one that the
requests came in on). If you have a look at the attached tcpdump.txt,
you'll see one provider (Virgin Media), constantly getting responses
from the wrong IPs. This doesn't happen forever however, it just seems
to go really badly wrong for an extended period! The tcpdump doesn't
take in to account the traffic to the real servers unfortunately. I'm
just waiting for this to happen again so I can get a dump from the LB to
the real servers in parallel to compare (although I'm praying that it
doesn't happen again at the same time..)
Could anyone advise me why the NAT/connection tracking has been failing
in these cases?
Please see my keepalived.conf attached (although some information has
been replaced)
*Here are my IP addresses:*
[root@dns-lb-02 ~]# ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast master bond0 qlen 1000
link/ether 00:22:19:57:97:ca brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast master bond0 qlen 1000
link/ether 00:22:19:57:97:ca brd ff:ff:ff:ff:ff:ff
4: sit0: <NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0
5: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue
link/ether 00:22:19:57:97:ca brd ff:ff:ff:ff:ff:ff
inet6 fe80::222:19ff:fe57:97ca/64 scope link
valid_lft forever preferred_lft forever
8: bond0.192@bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500
qdisc noqueue
link/ether 00:22:19:57:97:ca brd ff:ff:ff:ff:ff:ff
inet 88.88.192.36/23 brd 88.88.193.255 scope global bond0.192
inet 88.88.192.250/23 scope global secondary bond0.192
inet 88.88.193.250/23 scope global secondary bond0.192
inet 88.88.192.254/23 scope global secondary bond0.192
inet 88.88.192.37/23 scope global secondary bond0.192
inet6 fe80::222:19ff:fe57:97ca/64 scope link
valid_lft forever preferred_lft forever
9: bond0.81@bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500
qdisc noqueue
link/ether 00:22:19:57:97:ca brd ff:ff:ff:ff:ff:ff
inet 10.44.81.110/24 brd 10.44.81.255 scope global bond0.81
inet 10.44.81.108/24 scope global secondary bond0.81
inet6 fe80::222:19ff:fe57:97ca/64 scope link
valid_lft forever preferred_lft forever
*routing table:*
[root@dns-lb-02 ~]# ip ro s
10.44.81.0/24 dev bond0.81 proto kernel scope link src 10.44.81.110
88.88.192.0/23 dev bond0.192 proto kernel scope link src 88.88.192.36
169.254.0.0/16 dev bond0.81 scope link
10.216.0.0/16 via 10.44.81.1 dev bond0.81
10.44.0.0/16 via 10.44.81.1 dev bond0.81
default via 88.88.192.1 dev bond0.192
*This is my iptables nat table:*
[root@dns-lb-02 ~]# iptables -t nat -nL -v
Chain PREROUTING (policy ACCEPT 1032M packets, 82G bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 23M packets, 1372M bytes)
pkts bytes target prot opt in out source
destination
7378 592K MASQUERADE all -- * bond0.192 0.0.0.0/0
0.0.0.0/0
Chain OUTPUT (policy ACCEPT 23M packets, 1372M bytes)
pkts bytes target prot opt in out source
destination
*here is my IPVS table:*
[root@dns-lb-02 ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
UDP 88.88.192.37:53 lc persistent 600
-> 10.44.81.151:53 Masq 10 0 0
-> 10.44.81.153:53 Masq 10 0 0
-> 10.44.81.152:53 Masq 10 0 0
-> 10.44.81.154:53 Masq 10 0 0
-> 10.44.81.155:53 Masq 10 0 0
-> 10.44.81.150:53 Masq 10 0 0
TCP 88.88.192.37:53 lc persistent 600
-> 10.44.81.155:53 Masq 10 0 0
-> 10.44.81.151:53 Masq 10 0 0
-> 10.44.81.153:53 Masq 10 0 0
-> 10.44.81.152:53 Masq 10 0 0
-> 10.44.81.154:53 Masq 10 0 0
-> 10.44.81.150:53 Masq 10 0 0
TCP 88.88.193.250:53 lc persistent 600
-> 10.44.81.155:53 Masq 10 0 10
-> 10.44.81.151:53 Masq 10 0 6
-> 10.44.81.153:53 Masq 10 0 5
-> 10.44.81.152:53 Masq 10 0 6
-> 10.44.81.154:53 Masq 10 0 4
-> 10.44.81.150:53 Masq 10 0 5
TCP 88.88.192.250:53 lc persistent 600
-> 10.44.81.155:53 Masq 10 0 5
-> 10.44.81.151:53 Masq 10 0 7
-> 10.44.81.152:53 Masq 10 0 6
-> 10.44.81.153:53 Masq 10 0 6
-> 10.44.81.154:53 Masq 10 0 6
-> 10.44.81.150:53 Masq 10 0 5
TCP 88.88.192.254:53 lc persistent 600
-> 10.44.81.155:53 Masq 10 0 7
-> 10.44.81.151:53 Masq 10 1 5
-> 10.44.81.153:53 Masq 10 0 6
-> 10.44.81.152:53 Masq 10 0 5
-> 10.44.81.154:53 Masq 10 0 5
-> 10.44.81.150:53 Masq 10 0 5
UDP 88.88.192.254:53 lc persistent 600
-> 10.44.81.151:53 Masq 10 0 23976
-> 10.44.81.155:53 Masq 10 0 23961
-> 10.44.81.150:53 Masq 10 0 23966
-> 10.44.81.153:53 Masq 10 0 23969
-> 10.44.81.154:53 Masq 10 0 23969
-> 10.44.81.152:53 Masq 10 0 23985
UDP 88.88.193.250:53 lc persistent 600
-> 10.44.81.151:53 Masq 10 0 49915
-> 10.44.81.155:53 Masq 10 0 49916
-> 10.44.81.153:53 Masq 10 0 50559
-> 10.44.81.154:53 Masq 10 0 49982
-> 10.44.81.152:53 Masq 10 0 50210
-> 10.44.81.150:53 Masq 10 0 49945
UDP 88.88.192.250:53 lc persistent 600
-> 10.44.81.151:53 Masq 10 0 48668
-> 10.44.81.152:53 Masq 10 0 48668
-> 10.44.81.154:53 Masq 10 0 48686
-> 10.44.81.155:53 Masq 10 0 48650
-> 10.44.81.153:53 Masq 10 0 49025
-> 10.44.81.150:53 Masq 10 0 48655
*This is the ip/route information from a real server:
*[root@dns-be-01 ~]# ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
qlen 1000
link/ether 00:22:19:57:97:cf brd ff:ff:ff:ff:ff:ff
inet 10.44.81.150/24 brd 10.44.81.255 scope global eth0
inet6 fe80::222:19ff:fe57:97cf/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
link/ether 00:22:19:57:97:d1 brd ff:ff:ff:ff:ff:ff
4: sit0: <NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0
[root@dns-be-01 ~]# ip ro s
10.44.81.0/24 dev eth0 proto kernel scope link src 10.44.81.150
10.216.0.0/16 via 10.44.81.1 dev eth0
10.44.0.0/16 via 10.44.81.1 dev eth0
default via 10.44.81.108 dev eth0
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 10.44.222.128
smtp_connect_timeout 30
lvs_id DNS_LB2
router_id dns-lb-02
}
vrrp_instance DNS_LB2 {
state SLAVE
interface bond0.81
lvs_sync_daemon_interface bond0.81
virtual_router_id 40
priority 100
advert_int 1
smtp_alert
authentication {
auth_type AH
auth_pass supersecretpassword
}
virtual_ipaddress {
10.44.81.108/24 dev bond0.81
88.88.192.250/23 dev bond0.192
88.88.193.250/23 dev bond0.192
88.88.192.254/23 dev bond0.192
88.88.192.37/23 dev bond0.192
}
}
virtual_server 88.88.192.37 53 {
delay_loop 6
lb_algo lc
lb_kind NAT
persistence_timeout 0
protocol TCP
quorum = 1
real_server 10.44.81.150 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.150 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.151 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.151 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.152 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.152 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.153 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.153 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.154 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.154 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.155 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.155 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
}
virtual_server 88.88.192.37 53 {
delay_loop 6
lb_algo lc
lb_kind NAT
persistence_timeout 0
protocol UDP
quorum = 1
real_server 10.44.81.150 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.150 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.151 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.151 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.152 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.152 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.153 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.153 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.154 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.154 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.155 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.155 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
}
virtual_server 88.88.192.250 53 {
delay_loop 6
lb_algo lc
lb_kind NAT
persistence_timeout 0
protocol TCP
quorum = 1
real_server 10.44.81.150 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.150 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.151 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.151 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.152 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.152 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.153 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.153 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.154 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.154 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.155 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.155 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
}
virtual_server 88.88.192.250 53 {
delay_loop 6
lb_algo lc
lb_kind NAT
persistence_timeout 0
protocol UDP
quorum = 1
real_server 10.44.81.150 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.150 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.151 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.151 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.152 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.152 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.153 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.153 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.154 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.154 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.155 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.155 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
}
virtual_server 88.88.193.250 53 {
delay_loop 6
lb_algo lc
lb_kind NAT
persistence_timeout 0
protocol TCP
quorum = 1
real_server 10.44.81.150 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.150 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.151 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.151 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.152 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.152 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.153 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.153 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.154 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.154 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.155 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.155 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
}
virtual_server 88.88.193.250 53 {
delay_loop 6
lb_algo lc
lb_kind NAT
persistence_timeout 0
protocol UDP
quorum = 1
real_server 10.44.81.150 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.150 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.151 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.151 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.152 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.152 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.153 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.153 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.154 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.154 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.155 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.155 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
}
virtual_server 88.88.192.254 53 {
delay_loop 6
lb_algo lc
lb_kind NAT
persistence_timeout 0
protocol TCP
quorum = 1
real_server 10.44.81.150 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.150 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.151 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.151 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.152 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.152 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.153 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.153 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.154 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.154 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.155 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.155 a testdomain.com +time=5 +tcp
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
}
virtual_server 88.88.192.254 53 {
delay_loop 6
lb_algo lc
lb_kind NAT
persistence_timeout 0
protocol UDP
quorum = 1
real_server 10.44.81.150 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.150 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.151 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.151 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.152 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.152 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.153 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.153 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.154 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.154 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
real_server 10.44.81.155 53 {
weight 10
MISC_CHECK {
misc_path "/usr/bin/dig @10.44.81.155 a testdomain.com +time=5
+tries=5 +fail > /dev/null"
misc_timeout 6
}
}
}
16:10:12.605269 IP (tos 0x0, ttl 244, id 57210, offset 0, flags [DF], proto:
UDP (17), length: 75) 81.103.221.61.36715 > 88.88.192.250.53: 51825% [1au] MX?
safer-training.com. (47)
16:10:12.605431 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 107) 88.88.192.254.53 > 81.103.221.61.36715: 51825*- 1/0/1
safer-training.com. MX[|domain]
16:10:12.613322 IP (tos 0x0, ttl 244, id 46819, offset 0, flags [DF], proto:
UDP (17), length: 72) 81.103.221.61.36715 > 88.88.193.250.53: 50635% [1au] MX?
gpsmarine.co.uk. (44)
16:10:12.613502 IP (tos 0x0, ttl 244, id 46820, offset 0, flags [DF], proto:
UDP (17), length: 74) 81.103.221.61.36715 > 88.88.193.250.53: 62960% [1au] MX?
angeltomney.co.uk. (46)
16:10:12.613571 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 104) 88.88.192.254.53 > 81.103.221.61.36715: 50635*- 1/0/1
gpsmarine.co.uk. MX[|domain]
16:10:12.613699 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 106) 88.88.192.254.53 > 81.103.221.61.36715: 62960*- 1/0/1
angeltomney.co.uk. MX[|domain]
16:10:12.645458 IP (tos 0x0, ttl 244, id 48649, offset 0, flags [DF], proto:
UDP (17), length: 75) 81.103.221.62.61077 > 88.88.193.250.53: 13829% [1au] MX?
saxonsawake.org.uk. (47)
16:10:12.645666 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 107) 88.88.192.254.53 > 81.103.221.62.61077: 13829*- 1/0/1
saxonsawake.org.uk. MX[|domain]
16:10:12.695522 IP (tos 0x0, ttl 244, id 57211, offset 0, flags [DF], proto:
UDP (17), length: 71) 81.103.221.61.36715 > 88.88.192.250.53: 35637% [1au] MX?
kirkwold.co.uk. (43)
16:10:12.695717 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 103) 88.88.192.254.53 > 81.103.221.61.36715: 35637*- 1/0/1
kirkwold.co.uk. MX[|domain]
16:10:12.704337 IP (tos 0x0, ttl 244, id 45092, offset 0, flags [DF], proto:
UDP (17), length: 82) 81.103.221.62.61077 > 88.88.192.250.53: 24020% [1au] MX?
chinesepaintedquail.co.uk. (54)
16:10:12.704551 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 114) 88.88.192.254.53 > 81.103.221.62.61077: 24020*- 1/0/1
chinesepaintedquail.co.uk. (86)
16:10:12.734467 IP (tos 0x0, ttl 244, id 45093, offset 0, flags [DF], proto:
UDP (17), length: 68) 81.103.221.62.61077 > 88.88.192.250.53: 32383% [1au] MX?
soulego.com. (40)
16:10:12.734674 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 100) 88.88.192.254.53 > 81.103.221.62.61077: 32383*- 1/0/1
soulego.com. MX[|domain]
16:10:12.736233 IP (tos 0x0, ttl 244, id 57212, offset 0, flags [DF], proto:
UDP (17), length: 73) 81.103.221.61.36715 > 88.88.192.250.53: 34767% [1au] MX?
hypeagency.co.uk. (45)
16:10:12.736423 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 105) 88.88.192.254.53 > 81.103.221.61.36715: 34767*- 1/0/1
hypeagency.co.uk. MX[|domain]
16:10:12.764245 IP (tos 0x0, ttl 244, id 45094, offset 0, flags [DF], proto:
UDP (17), length: 70) 81.103.221.62.61077 > 88.88.192.250.53: 26385% [1au] MX?
jodshop.co.uk. (42)
16:10:12.764442 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 102) 88.88.192.254.53 > 81.103.221.62.61077: 26385*- 1/0/1
jodshop.co.uk. MX[|domain]
16:10:12.794273 IP (tos 0x0, ttl 244, id 45095, offset 0, flags [DF], proto:
UDP (17), length: 69) 81.103.221.62.61077 > 88.88.192.250.53: 28938% [1au] MX?
linnet.co.uk. (41)
16:10:12.794516 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 101) 88.88.192.254.53 > 81.103.221.62.61077: 28938*- 1/0/1
linnet.co.uk. MX[|domain]
16:10:12.805067 IP (tos 0x0, ttl 244, id 57213, offset 0, flags [DF], proto:
UDP (17), length: 73) 81.103.221.61.36715 > 88.88.192.250.53: 30644% [1au] MX?
vaseinabox.co.uk. (45)
16:10:12.805288 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 105) 88.88.192.254.53 > 81.103.221.61.36715: 30644*- 1/0/1
vaseinabox.co.uk. MX[|domain]
16:10:12.834246 IP (tos 0x0, ttl 244, id 45096, offset 0, flags [DF], proto:
UDP (17), length: 79) 81.103.221.62.61077 > 88.88.192.250.53: 3508% [1au] MX?
pinnerdarlington.co.uk. (51)
16:10:12.836225 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 111) 88.88.192.254.53 > 81.103.221.62.61077: 3508*- 1/0/1
pinnerdarlington.co.uk. MX[|domain]
16:10:12.845693 IP (tos 0x0, ttl 244, id 57214, offset 0, flags [DF], proto:
UDP (17), length: 78) 81.103.221.61.36715 > 88.88.192.250.53: 5219% [1au] MX?
crusenortheast.org.uk. (50)
16:10:12.845929 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 110) 88.88.192.254.53 > 81.103.221.61.36715: 5219*- 1/0/1
crusenortheast.org.uk. MX[|domain]
16:10:12.854637 IP (tos 0x0, ttl 244, id 57215, offset 0, flags [DF], proto:
UDP (17), length: 77) 81.103.221.61.36715 > 88.88.192.250.53: 19130% [1au] MX?
lmsurveyservices.com. (49)
16:10:12.855100 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 109) 88.88.192.254.53 > 81.103.221.61.36715: 19130*- 1/0/1
lmsurveyservices.com. MX[|domain]
16:10:12.884668 IP (tos 0x0, ttl 244, id 57216, offset 0, flags [DF], proto:
UDP (17), length: 73) 81.103.221.61.36715 > 88.88.192.250.53: 55009% [1au] MX?
barrahotel.co.uk. (45)
16:10:12.884847 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 105) 88.88.192.254.53 > 81.103.221.61.36715: 55009*- 1/0/1
barrahotel.co.uk. MX[|domain]
16:10:12.903256 IP (tos 0x0, ttl 244, id 46821, offset 0, flags [DF], proto:
UDP (17), length: 77) 81.103.221.61.36715 > 88.88.193.250.53: 27290% [1au] MX?
tempustraining.co.uk. (49)
16:10:12.903464 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 109) 88.88.192.254.53 > 81.103.221.61.36715: 27290*- 1/0/1
tempustraining.co.uk. MX[|domain]
16:10:12.923274 IP (tos 0x0, ttl 244, id 46822, offset 0, flags [DF], proto:
UDP (17), length: 76) 81.103.221.61.36715 > 88.88.193.250.53: 4072% [1au] MX?
easthammotors.co.uk. (48)
16:10:12.923536 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 108) 88.88.192.254.53 > 81.103.221.61.36715: 4072*- 1/0/1
easthammotors.co.uk. MX[|domain]
16:10:12.925511 IP (tos 0x0, ttl 244, id 48650, offset 0, flags [DF], proto:
UDP (17), length: 70) 81.103.221.62.61077 > 88.88.193.250.53: 3594% [1au] MX?
wlwref.org.uk. (42)
16:10:12.925720 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 102) 88.88.192.254.53 > 81.103.221.62.61077: 3594*- 1/0/1
wlwref.org.uk. MX[|domain]
16:10:12.935589 IP (tos 0x0, ttl 244, id 45097, offset 0, flags [DF], proto:
UDP (17), length: 76) 81.103.221.62.61077 > 88.88.192.250.53: 20649% [1au] MX?
genesis-media.co.uk. (48)
16:10:12.935779 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 108) 88.88.192.254.53 > 81.103.221.62.61077: 20649*- 1/0/1
genesis-media.co.uk. MX[|domain]
16:10:12.936536 IP (tos 0x0, ttl 244, id 45098, offset 0, flags [DF], proto:
UDP (17), length: 69) 81.103.221.62.61077 > 88.88.192.250.53: 24982% [1au] MX?
roosleap.com. (41)
16:10:12.936721 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 101) 88.88.192.254.53 > 81.103.221.62.61077: 24982*- 1/0/1
roosleap.com. MX[|domain]
16:10:12.955455 IP (tos 0x0, ttl 244, id 48651, offset 0, flags [DF], proto:
UDP (17), length: 69) 81.103.221.62.61077 > 88.88.193.250.53: 7278% [1au] MX?
wadski.co.uk. (41)
16:10:12.955657 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 101) 88.88.192.254.53 > 81.103.221.62.61077: 7278*- 1/0/1
wadski.co.uk. MX[|domain]
16:10:12.955661 IP (tos 0x0, ttl 244, id 48652, offset 0, flags [DF], proto:
UDP (17), length: 72) 81.103.221.62.61077 > 88.88.193.250.53: 22849% [1au] MX?
hawthorn.org.uk. (44)
16:10:12.955914 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 104) 88.88.192.254.53 > 81.103.221.62.61077: 22849*- 1/0/1
hawthorn.org.uk. MX[|domain]
16:10:12.963304 IP (tos 0x0, ttl 244, id 46823, offset 0, flags [DF], proto:
UDP (17), length: 78) 81.103.221.61.36715 > 88.88.193.250.53: 32848% [1au] MX?
carolinepitcher.co.uk. (50)
16:10:12.963546 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 110) 88.88.192.254.53 > 81.103.221.61.36715: 32848*- 1/0/1
carolinepitcher.co.uk. MX[|domain]
16:10:12.984308 IP (tos 0x0, ttl 244, id 45099, offset 0, flags [DF], proto:
UDP (17), length: 75) 81.103.221.62.61077 > 88.88.192.250.53: 65062% [1au] MX?
nbarchitecture.com. (47)
16:10:12.984526 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 107) 88.88.192.254.53 > 81.103.221.62.61077: 65062*- 1/0/1
nbarchitecture.com. MX[|domain]
16:10:12.993348 IP (tos 0x0, ttl 244, id 46824, offset 0, flags [DF], proto:
UDP (17), length: 70) 81.103.221.61.36715 > 88.88.193.250.53: 46148% [1au] MX?
ttm-ltd.co.uk. (42)
16:10:12.993528 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 102) 88.88.192.254.53 > 81.103.221.61.36715: 46148*- 1/0/1
ttm-ltd.co.uk. MX[|domain]
16:10:13.005478 IP (tos 0x0, ttl 244, id 48653, offset 0, flags [DF], proto:
UDP (17), length: 73) 81.103.221.62.61077 > 88.88.193.250.53: 42349% [1au] MX?
stallandev.co.uk. (45)
16:10:13.005665 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 105) 88.88.192.254.53 > 81.103.221.62.61077: 42349*- 1/0/1
stallandev.co.uk. MX[|domain]
16:10:13.015532 IP (tos 0x0, ttl 244, id 57217, offset 0, flags [DF], proto:
UDP (17), length: 82) 81.103.221.61.36715 > 88.88.192.250.53: 23538% [1au] MX?
brogdalecollections.co.uk. (54)
16:10:13.015714 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 114) 88.88.192.254.53 > 81.103.221.61.36715: 23538*- 1/0/1
brogdalecollections.co.uk. (86)
16:10:13.055470 IP (tos 0x0, ttl 244, id 48654, offset 0, flags [DF], proto:
UDP (17), length: 77) 81.103.221.62.61077 > 88.88.193.250.53: 57283% [1au] MX?
insightsystems.co.uk. (49)
16:10:13.055719 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 173) 88.88.192.254.53 > 81.103.221.62.61077: 57283*- 3/0/1
insightsystems.co.uk. MX[|domain]
16:10:13.061194 IP (tos 0x0, ttl 243, id 3543, offset 0, flags [DF], proto: UDP
(17), length: 79) 81.103.221.35.21447 > 88.88.193.250.53: 25919 [1au] MX?
bernadetteharris.co.uk. (51)
16:10:13.061528 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 111) 88.88.193.250.53 > 81.103.221.35.21447: 25919*- 1/0/1
bernadetteharris.co.uk. MX[|domain]
16:10:13.104687 IP (tos 0x0, ttl 244, id 57218, offset 0, flags [DF], proto:
UDP (17), length: 85) 81.103.221.61.36715 > 88.88.192.250.53: 2148% [1au] MX?
advanceglassandglazing.co.uk. (57)
16:10:13.104903 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 117) 88.88.192.254.53 > 81.103.221.61.36715: 2148*- 1/0/1
advanceglassandglazing.co.uk. (89)
16:10:13.115423 IP (tos 0x0, ttl 244, id 48655, offset 0, flags [DF], proto:
UDP (17), length: 71) 81.103.221.62.61077 > 88.88.193.250.53: 47343% [1au] MX?
jackson.uk.net. (43)
16:10:13.115660 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 103) 88.88.192.254.53 > 81.103.221.62.61077: 47343*- 1/0/1
jackson.uk.net. MX[|domain]
16:10:13.121445 IP (tos 0x0, ttl 244, id 45100, offset 0, flags [DF], proto:
UDP (17), length: 71) 81.103.221.62.61077 > 88.88.192.250.53: 8079% [1au] MX?
geplegal.co.uk. (43)
16:10:13.121627 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 103) 88.88.192.254.53 > 81.103.221.62.61077: 8079*- 1/0/1
geplegal.co.uk. MX[|domain]
16:10:13.124508 IP (tos 0x0, ttl 244, id 57219, offset 0, flags [DF], proto:
UDP (17), length: 74) 81.103.221.61.36715 > 88.88.192.250.53: 34947% [1au] MX?
vikingkayak.co.uk. (46)
16:10:13.133271 IP (tos 0x0, ttl 244, id 46825, offset 0, flags [DF], proto:
UDP (17), length: 81) 81.103.221.61.36715 > 88.88.193.250.53: 5227% [1au] MX?
lourdes-associates.co.uk. (53)
16:10:13.143344 IP (tos 0x0, ttl 244, id 46826, offset 0, flags [DF], proto:
UDP (17), length: 77) 81.103.221.61.36715 > 88.88.193.250.53: 49914% [1au] MX?
hambleriversc.org.uk. (49)
16:10:13.145687 IP (tos 0x0, ttl 244, id 57220, offset 0, flags [DF], proto:
UDP (17), length: 74) 81.103.221.61.36715 > 88.88.192.250.53: 12129% [1au] MX?
suziwilson1.co.uk. (46)
16:10:13.194907 IP (tos 0x0, ttl 244, id 57221, offset 0, flags [DF], proto:
UDP (17), length: 69) 81.103.221.61.36715 > 88.88.192.250.53: 63222% [1au] MX?
glanville.gg. (41)
16:10:13.205474 IP (tos 0x0, ttl 244, id 57222, offset 0, flags [DF], proto:
UDP (17), length: 69) 81.103.221.61.36715 > 88.88.192.250.53: 13772% [1au] MX?
dimmock.info. (41)
16:10:13.224306 IP (tos 0x0, ttl 244, id 45101, offset 0, flags [DF], proto:
UDP (17), length: 70) 81.103.221.62.61077 > 88.88.192.250.53: 57538% [1au] MX?
chaddas.co.uk. (42)
16:10:13.224504 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 102) 88.88.192.254.53 > 81.103.221.62.61077: 57538*- 1/0/1
chaddas.co.uk. MX[|domain]
16:10:13.234417 IP (tos 0x0, ttl 244, id 45102, offset 0, flags [DF], proto:
UDP (17), length: 72) 81.103.221.62.61077 > 88.88.192.250.53: 61298% [1au] MX?
neilhodge.co.uk. (44)
16:10:13.236140 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 104) 88.88.192.254.53 > 81.103.221.62.61077: 61298*- 1/0/1
neilhodge.co.uk. MX[|domain]
16:10:13.264791 IP (tos 0x0, ttl 244, id 57223, offset 0, flags [DF], proto:
UDP (17), length: 69) 81.103.221.61.36715 > 88.88.192.250.53: 11433% [1au] MX?
brunel.co.uk. (41)
16:10:13.284580 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 106) 88.88.192.254.53 > 81.103.221.61.36715: 34947*- 1/0/1
vikingkayak.co.uk. MX[|domain]
16:10:13.284815 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 113) 88.88.192.254.53 > 81.103.221.61.36715: 5227*- 1/0/1
lourdes-associates.co.uk. MX[|domain]
16:10:13.284976 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 109) 88.88.192.254.53 > 81.103.221.61.36715: 49914*- 1/0/1
hambleriversc.org.uk. MX[|domain]
16:10:13.285144 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 106) 88.88.192.254.53 > 81.103.221.61.36715: 12129*- 1/0/1
suziwilson1.co.uk. MX[|domain]
16:10:13.286555 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 101) 88.88.192.254.53 > 81.103.221.61.36715: 63222*- 1/0/1
glanville.gg. MX[|domain]
16:10:13.286600 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 101) 88.88.192.254.53 > 81.103.221.61.36715: 13772*- 1/0/1
dimmock.info. MX[|domain]
16:10:13.287979 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 58) 88.88.192.254.53 > 81.103.221.61.36715: 11433 ServFail-
0/0/0 (30)
16:10:13.305596 IP (tos 0x0, ttl 244, id 45103, offset 0, flags [DF], proto:
UDP (17), length: 69) 81.103.221.62.61077 > 88.88.192.250.53: 21024% [1au] MX?
1anson.co.uk. (41)
16:10:13.305802 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 101) 88.88.192.254.53 > 81.103.221.62.61077: 21024*- 1/0/1
1anson.co.uk. MX[|domain]
16:10:13.306547 IP (tos 0x0, ttl 244, id 45104, offset 0, flags [DF], proto:
UDP (17), length: 72) 81.103.221.62.61077 > 88.88.192.250.53: 47792% [1au] MX?
mikedolbear.com. (44)
16:10:13.306733 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 121) 88.88.192.254.53 > 81.103.221.62.61077: 47792*- 1/0/1
mikedolbear.com. MX[|domain]
16:10:13.344491 IP (tos 0x0, ttl 244, id 45105, offset 0, flags [DF], proto:
UDP (17), length: 73) 81.103.221.62.61077 > 88.88.192.250.53: 14603% [1au] MX?
dm-windows.co.uk. (45)
16:10:13.344714 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 105) 88.88.192.254.53 > 81.103.221.62.61077: 14603*- 1/0/1
dm-windows.co.uk. MX[|domain]
16:10:13.385571 IP (tos 0x0, ttl 244, id 45106, offset 0, flags [DF], proto:
UDP (17), length: 76) 81.103.221.62.61077 > 88.88.192.250.53: 30876% [1au] MX?
abbeytextiles.co.uk. (48)
16:10:13.385792 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 108) 88.88.192.254.53 > 81.103.221.62.61077: 30876*- 1/0/1
abbeytextiles.co.uk. MX[|domain]
16:10:13.415439 IP (tos 0x0, ttl 244, id 48656, offset 0, flags [DF], proto:
UDP (17), length: 81) 81.103.221.62.61077 > 88.88.193.250.53: 49445% [1au] MX?
ssdpropertylawyers.co.uk. (53)
16:10:13.415716 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 113) 88.88.192.254.53 > 81.103.221.62.61077: 49445*- 1/0/1
ssdpropertylawyers.co.uk. MX[|domain]
16:10:13.446313 IP (tos 0x0, ttl 244, id 45107, offset 0, flags [DF], proto:
UDP (17), length: 67) 81.103.221.62.61077 > 88.88.192.250.53: 62953% [1au] MX?
esp1.co.uk. (39)
16:10:13.446605 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 99) 88.88.192.254.53 > 81.103.221.62.61077: 62953*- 1/0/1
esp1.co.uk. MX[|domain]
16:10:13.465589 IP (tos 0x0, ttl 244, id 45108, offset 0, flags [DF], proto:
UDP (17), length: 80) 81.103.221.62.61077 > 88.88.192.250.53: 20115% [1au] MX?
rascals-childcare.co.uk. (52)
16:10:13.465780 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: UDP
(17), length: 112) 88.88.192.254.53 > 81.103.221.62.61077: 20115*- 1/0/1
rascals-childcare.co.uk. MX[|domain]
_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/
LinuxVirtualServer.org mailing list - [email protected]
Send requests to [email protected]
or go to http://lists.graemef.net/mailman/listinfo/lvs-users
