Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm tryıng to understand how to interpret "additional section" in my dig query.

Here is the additional section for my specific query:

;; ADDITIONAL SECTION:
janus.radore.com.   831 IN  A   109.235.251.213
mimas.rh.com.tr.    458 IN  A   77.75.34.2
titan.radore.com.   586 IN  A   95.211.70.4

What do the figures mean? What is 831?

Here is the same section from a dig for google.com:

;; ADDITIONAL SECTION:
ns1.google.com.     74569   IN  A   216.239.32.10
ns2.google.com.     45794   IN  A   216.239.34.10
ns3.google.com.     74569   IN  A   216.239.36.10
ns4.google.com.     45794   IN  A   216.239.38.10

My ultimate goal is to find the performance of the nameservers my domain uses. But still I would like to learn how to interpret "additional section" too.

Thanks, Haluk

share|improve this question
    
if you run the DNS servers in question, you can run queryperf. It's a utility for stress testing bind included with the distribution (it not installed by default, you have to install it yourself from the source). –  Chris S Nov 21 '10 at 17:46
add comment

2 Answers

up vote 4 down vote accepted

I don't have an official answer (yet), but running dig multiple times in a row shows that number decrementing -- about once a second.

To me that would indicate that's the remaining TTL on the specific entry listed. So,in your example ns4.google.com has 45794 seconds remaining before it is checked again for updates.

Edit: I actually just found this which would corroborate my initial findings:

http://www.madboa.com/geek/dig/#ttl

share|improve this answer
3  
The official answer is yes, that's the TTL of the cached record in the recursive server it was fetched from. If you query an authoritative server the TTL should not be returned. –  Chris S Nov 21 '10 at 17:37
    
Now I understand why it was counting down. Thanks a lot! –  Haluk Nov 21 '10 at 19:54
2  
@Chris the TTL will be included for records the server is authoritative for, it just won't count down. For example, if you query one of google's DNS servers for google's NS records (dig -t ns google.com @ns1.google.com), they will always come back with a TTL of 345600 (4 days in seconds). –  Gordon Davisson Nov 21 '10 at 21:23
    
@Gordon, There's no "Additional Section" when you query and authoritative server. Pretty hard to get the TTL from a section that isn't there. –  Chris S Nov 22 '10 at 0:34
2  
@Chris Er, no. First, all resource records in the response contain TTLs, no matter which section (authority, answer, or additional) they're in. Second, whether there's an additional section has nothing to do with whether the server's authoritative or not (and just to complicate things, a single DNS response can contain a mix of authoritative and cached data). Try the dig example I gave before, and you'll get a fully authoritative response with an additional section (and both the answer and additional sections will have TTLs). –  Gordon Davisson Nov 22 '10 at 6:45
add comment

"Additional section" means: other information that is relevant to your question but not actually the answer to it. For example:

;; QUESTION SECTION:
;google.com.            IN  A

We asked for the address (A) of google.com.

;; ANSWER SECTION:
google.com.     165 IN  A   66.102.11.104

This is its IP address.

;; AUTHORITY SECTION:
google.com.     21770   IN  NS  ns4.google.com.
google.com.     21770   IN  NS  ns3.google.com.
google.com.     21770   IN  NS  ns2.google.com.
google.com.     21770   IN  NS  ns1.google.com.

These are the authorities for that question.

;; ADDITIONAL SECTION:
ns1.google.com.     19431   IN  A   216.239.32.10
ns2.google.com.     19542   IN  A   216.239.34.10
ns3.google.com.     19368   IN  A   216.239.36.10
ns4.google.com.     19543   IN  A   216.239.38.10

Oh and by the way, in case it's useful, here is some additional information you might care about, specifically the addresses of the authoritative servers.

If I recall correctly this is actually present in the DNS answer packet as a way to avoid additional roundtrips.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.