Hi all,
I'm trying to understand the mechanism by which dnsmasq uses the resolvers
specified (in this case they are all specified in /etc/resolv.conf).
Specifically I am trying to work out why dnsmasq is (erratically) sending
the same query to multiple servers, and not listening beyond the first
response.
As I understand it the default (i.e. non dnsmasq) resolver behaviour is to
try the first name server entry first, then the second etc. This can be
changed by use of the 'rotate' option in that file.
However, dnsmasq reads it's name servers from /etc/resolv.conf, but the
defaults are different - relevant options from the man page say:
*-o, --strict-order*By default, dnsmasq will send queries to any of the
upstream servers it knows about and tries to favour servers that are known
to be up. Setting this flag forces dnsmasq to try each query with each
server strictly in the order they appear in /etc/resolv.conf*--all-servers*By
default, when dnsmasq has more than one upstream server available, it will
send queries to just one server. Setting this flag forces dnsmasq to send
all queries to all available servers. The reply from the server which
answers first will be returned to the original requester.
To me that means that, by default, dnsmasq will send to any one of the
upstream servers, favouring servers it thinks are up - that seems
reasonable.
What I am seeing is that sometimes (and I can't figure a packet count, a
query count, or a time based correlation) dnsmasq forwards a query to both
of the listed name servers (I presume this is part of the 'aliveness'
testing?).
When this happens dnsmasq then only listens to the first reply, meaning
that the server which is slightly slower/further away then gets their
response bounced in an ICMP port unreachable message from the dnsmasq box.
I then see dnsmasq stick to the 'first responding' server until it forwards
a query to both again (always in the same order, that listed in
/etc/resolv.conf) and, depending on the first response, it either sticks or
flips it's preferred server until ???
Two questions:
- What triggers dnsmasq to forward a query to multiple upstream resolvers
(aside from the first query after startup, which seems reasonable)
- Why does dnsmasq not bother to listen for the second (or more) response
- which would surely be useful in terms of timing/aliveness information, as
well as less odd for the upstream server*.
Cheers,
John
* I can imagine an upstream server eventually deciding that it is being
used in an amplification attack and just not responding any more.
--
___
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
