Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to troubleshoot some persistent connectivity issues and I'm frequently getting the following error message when using dig or nslookup.

bash$ nslookup
> www.google.com
;; Warning: ID mismatch: expected ID 36298, got 0
;; Warning: ID mismatch: expected ID 36298, got 0
;; Warning: ID mismatch: expected ID 36298, got 0

bash$ dig www.google.com
;; Warning: ID mismatch: expected ID 34149, got 0
;; Warning: ID mismatch: expected ID 34149, got 0
;; Warning: ID mismatch: expected ID 34149, got 0

; <<>> DiG 9.8.3-P1 <<>> www.capitalone360.com
;; global options: +cmd
;; connection timed out; no servers could be reached

Can anyone shed light on what this error message means, in particular the "got 0" portion?

share|improve this question
    
Is this a virtual machine or a real box? Also what does your /etc/resolv.conf file contain? –  slm Feb 6 '13 at 6:24
    
real box, mac os x, /etc/resolve.conf at gist.github.com/ralphcallaway/3331c8170660a28d4b35 –  Ralph Feb 6 '13 at 20:10

2 Answers 2

up vote 1 down vote accepted

It means that nslookup or dig received a reply with an ID of zero, rather than the ID it was expecting. As part of the protection against forged DNS replies, each DNS query contains an ID, usually chosen randomly. The DNS server copies the ID into the reply, allowing the client to match replies to queries and to prevent a forged DNS reply from being accepted.

This could be caused by a broken DNS server or broken DNS forwarding or rewriting scheme. It could also be caused by an attack of spoofed DNS replies, though that's unlikely.

share|improve this answer
    
Thanks david, any id why the id would be zero? The research I did initially suggested that the id mismatch error was often due to a timing mismatch with the responses, i.e. response for second query was received, before the first query response, which caused an id mismatch and hence it looked like a forgery. However, every example I saw the received id was a non-zero value. Any thoughts as to why that would be the case –  Ralph Feb 6 '13 at 20:13
    
I don't think it's a timing mismatch. It looks like a broken server that just doesn't set the ID or a broken proxy/forwarded that doesn't copy it. –  David Schwartz Feb 6 '13 at 21:07
    
Thanks david, that makes sense. Any chance there are tools out there that could troubleshoot/detect issues with dns proxies or forwarding. –  Ralph Feb 7 '13 at 22:25

Just out of curiosity I came across this solution in a number of threads on apple.stackexchange.com as well as SF.

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

Does running these commands fix your issue?

Resources

share|improve this answer
    
The issue has disappeared for the moment, will definitely give this a try if it occurs again and post the results. –  Ralph Feb 7 '13 at 22:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.