Hi guys, Clement's getting success with % dig www.healthalliance.co.nz @210.54.1.142 from his workstation, but not from the DNS server - the latter times out. I guess the reply packet is being lost somewhere, but I don't know whether that's e.g. a routing thing internal to UofA, or if it's something wrong at healthalliance, or if someone has decided UofA was attacking their server on port 53 and has dropped all traffic from that IP. I wish I could discount the latter theory, but experience shows not. Clement: Once your sure the query is exiting the UofA network, I think you need to debug this with the healthalliance admins. cheers, Jamie On 23/05/06, Mark Foster wrote:

A bit vague Clement. A little more info as to exactly what you're seeing would make life much easier. Have you compared what the Uni NS are seeing to that seen elsewhere?

I tried a random lookup:

;; ANSWER SECTION (1 record) www.countiesmanukaudhb.org.nz. 1d IN A 210.54.1.139

;; AUTHORITY SECTION (2 records) countiesmanukaudhb.org.nz. 23h46m43s IN NS ns1.healthalliance.co.nz. countiesmanukaudhb.org.nz. 23h46m43s IN NS ns2.healthalliance.co.nz.

Don't see any immediate problems in their DNS, perhaps you need to do some further troubleshooting as to whether your NS can infact get a response out of ns1/ns2.healthalliance.co.nz.

The only observation i'll make is that the responses don't seem to be hugely fast, but that could be because i'm limited to a web based DNS tool at the moment.

Mark.

...

Hi,

If somebody could throw some light on this issue would very much appreciate.

We are having problems resolving few of the following URLs from our DNS servers at the University.

www.countiesmanukaudhb.org.nz http://www.countiesmanukaudhb.org.nz/

webmail.middlemore.co.nz

www.waitematahealth.co.nz http://www.waitematahealth.co.nz/

www.healthalliance.co.nz

and others.

All these names are registered with Healthalliance. There have been no changes to our DNS whatsoever and the reverse-lookups are working fine.

Clement Ashwal Sr Network Analyst - ITSS The University of Auckland Private Bag 92019 Auckland New Zealand Phone + 64 9 3737599 x 87993

CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify the sender immediately.

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

-- Jamie Riden / jamesr(a)europe.com / jamie.riden(a)computer.org NZ Honeynet project - http://www.nz-honeynet.org/

On Tue, 2006-05-23 at 13:21 +1200, Jamie Riden wrote:

Hi guys,

Clement's getting success with

% dig www.healthalliance.co.nz @210.54.1.142

from his workstation, but not from the DNS server - the latter times out.

Um, so his DNS server is having trouble reaching 210.54.1.142 then? (or maybe you meant cannot dig @hisDNSserver) Some things you may want to try: Traceroute to 210.54.1.142 can you telnet/netcat over port 53? What do you see if you tcpdump the traffic while doing this? Also, the IP above appears to be ns2, where ns1 is 210.54.1.143. I also cannot get to this, it disappears after getting to global gateway. If you're having issues like this maybe you'll want to get in touch with the tech contact for the domain the dns resides on and chat to them about it. -- Daniel Cross Systems Administrator Cell +64 21535975 WorldxChange DDI +64 9 9501354