Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am configuring bind9 on a server with two network interfaces, one is connected to the LAN and the other is connected to the Internet through NAT so bind is not faced directly to the Internet. Everything seems to work fine, clients can do both forward and reverse lookups but somethings seems strange.

On the server if i try to ping www.google.com one time, a great amount of network activity is genereated, alot more that one would expect so i decided to sniff the traffic with tcpdump. When loading the dump into Wireshark i can see about 250 entries with "Standard query A" and "Standard query response" Here a some of the entries from the dump

DNS Standard query A www.google.com
DNS Standard query A blackhole-1.iana.org
DNS Standard query A blackhole-2.iana.org
DNS Standard query response
DNS Standard query A ns2.isc-sns.com
DNS Standard query A ns1.isc-sns.net
DNS Standard query A ns3.isc-sns.info
DNS Standard query response PTR b.iana-servers.net RRSIG
DNS Standard query A auth2.dns.cogentco.com
DNS Standard query A ns1.crsnic.net
DNS Standard query A ns2.nsiregistry.net
DNS Standard query A ns3.verisign-grs.net
DNS Standard query A ns4.verisign-grs.net
DNS Standard query PTR

I do not have too much experince with DNS yet, but i am pretty sure that something is wrong. Anybody that have an idea of whats is going on?

share|improve this question
I did the capture with tcpdump [tcpdump -lnni eth0 -w dump -s 65535] and afterwards moved the dump file to a machine with Wireshark for better overview. –  Nickolas R. Mar 14 '10 at 21:58

3 Answers 3

up vote 1 down vote accepted

If this is the first time you are asking for google.com then your DNS server must do some extra work to look things starting fron the root.

The Address resolution mechanism in the Wikipedia Domain Name System page describes the process.

When you did your capture did you make sure that you disabled DNS resolution in wireshark? Wireshark will make lots of DNS requests during the capture if this is enabled.

You should also make sure you prevent anything else from using the DNS server or you will just see lots of unrelated cruft in your capture.

share|improve this answer
Now things make more sense. So even if the ISP DNS server is specified in /etc/resolv.conf bind9 won't care about it and go directly to the root servers specified in db.root? How is blackhole-1.iana.org related to the root servers? –  Nickolas R. Mar 14 '10 at 22:12
You are correct. But does not use your /etc/resolv.conf at all. You can set forwarders in bind if you want. Blackhole-1.iana.org usually relates to reverse lookup for a RFC1918 address. –  Zoredache Mar 14 '10 at 22:44
Ah ok. So i guess that nothing is strange or wrong with the setup, just me that does not understand the concepts of DNS well enough. –  Nickolas R. Mar 14 '10 at 22:51

It looks like it's just a typical recursive DNS lookup - your server keeps queries nameservers until it finds the authoritive one.

share|improve this answer

with an empty cache a server will do something quite similar to what the output of

dig a www.google.com +trace

will show you.

Additionally ping does make a reverse (PTR) record lookup to show you the name of the IP address it is trying to reach.

dig -x +trace

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.