2

In my office LAN, queries to the DNS servers outside our LAN really often fail (timeout).

I suspect that it's some problem with our provider, but they have not responded to my complains.

Is there a tool that I could use to benchmark/measure the loss of outgoing DNS traffic. Either from the windows/linux workstation or from the OpenBSD 4 gateway?

6 Answers 6

5

I don't know of a tool that does this directly, but you could always just use tcpdump on the bsd gateway to sniff DNS requests and responses, and then compare requests to responses. The tcp dump would be something like:

tcpdump -i interface 'udp port 53' -o dumpfile

It is possible they would be tcp too, so you can capture both if you want. You can then analyze the dumpfile with wireshark by creating two filters, one for requests and one for responses. Then just count the number of requests vs responses, if reponses < requests, there may be an issue.

2
  • 2
    Use 'port 53' instead of 'udp port 53' to sniff both TCP & UDP.
    – Benoit
    Aug 28, 2009 at 14:22
  • Thanx, I will try that.
    – user3915
    Sep 2, 2009 at 13:40
3

You can try switching to another DNS provider like OpenDNS (which also offers other features for your office environment). If your DNS issue disappears then that's a good indicator of the problem. You might even prefer the alternative DNS provider in the process...

Otherwise, you can use things like ping to test your connectivity and timing to the DNS server, and traceroute.

Is this on all systems or a select number of systems that this is happening? Is DNS the only one that is having this issue or are other protocols?

1

If you have a monitoring system set up, create a service check to perform a DNS query and report back the latency. If you also have a graphing system, plot these latencies on a graph.

1
  • You can also use this information when discussing the issue with your service provider. Aug 29, 2009 at 1:47
1

If you have a DNS capture file (Kyle Brandt's suggestion is a good one) you can use Tshark to look for duplicates. For example, the following would read the capture file "dns-external.pcap" and generate a CSV file containing the IP source address, DNS query ID, and DNS query name(s):

tshark -n -r dns-external.pcap -T fields -E separator=, -E quote=d -e ip.src -e dns.id -e dns.qry.name > /tmp/dns.csv

You could then use Excel, OpenOffice, or sort < /tmp/dns.csv | uniq -d to look for duplicate requests.

You might also be able to spot anomalies using dnstop but I'm not sure if it has any features specific to duplicate / lost queries.

0

The only way to tell if DNS traffic is getting lost is to monitor traffic on both your gateway host as well as on a DNS server out on the internet.

Now you just run a program that does 10,000 requests and compare the responses you get back with the responses generated by that off-site name server. You'll want to do 10,000 requests for a specific domain (preferably 10,000 different requests so you don't get anything cached) and also 10,000 recursive lookups for 10,000 things that don't exist (evil ISPs like to filter and hijack NXDOMAIN responses.

0

Set up a network capture on the gateway host. Run a capture and filter it for DNS traffic. Look for outbound DNS queries and inbound DNS answers. Try to match each outbound query to an inbound answer. If you find any that don't have a "match" (outbound query and inbound answer) then those queries were lost. You can then use this info to convince the ISP that there's something going on between you and them.

1
  • You don't necessarily have to match requests and responses. Each request has an "ID" field that will be unique for a particular source IP and query for a reasonable span of time. If you see duplicate IDs it's an indication of a timeout. Aug 31, 2009 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .