-1

I'm using tcpdump (for the first time) to try to debug a DNS issue:

tcpdump -n udp port 53

It gives me this output:

10:38:30.431467 IP a.b.c.d.56973 > 8.8.8.8.domain: 49179+ A? ocsp.sectigo.com. (34)
10:38:30.431476 IP a.b.c.d.56973 > 8.8.8.8.domain: 38519+ AAAA? ocsp.sectigo.com. (34)
10:40:52.556219 IP a.b.c.d.54185 > 8.8.4.4.domain: 12873+ A? ocsp.sectigo.com. (34)
10:40:52.556233 IP a.b.c.d.54185 > 8.8.4.4.domain: 60917+ AAAA? ocsp.sectigo.com. (34)

How can I view the responses, or the time that they took?

Improve this question

1 Answer 1

Reset to default
3

AFAIK Normally you should see incoming packets FROM port 53 of the name server in response to your DNS query. That fact that you don't, is telling and may be the root of your problem. Either the outgoing queries are blocked/discarded and never even make it to your DNS servers, or the responses don't make it back to you.

For me dig serverfault.com @8.8.8.8 generates a trace looking like this below:

12:06:42.664808 IP 10.9.8.107.46372 > 8.8.8.8.domain: 35406+ [1au] A? serverfault.com. (44)
12:06:42.666144 IP 8.8.8.8.domain > 10.9.8.107.46372: 35406 4/0/1 A 151.101.65.69, A 151.101.129.69, A 151.101.193.69, A 151.101.1.69 (108)
Improve this answer
1
  • Interesting, yes, indeed I never get a response. I've looked into it and I have a firewall set up in my hosting provider's server dashboard, which was allowing any established TCP connection, but not UDP ones. Added an exception for UDP 32768-65535 from 8.8.8.8/32 and 1.1.1.1/32 and it all works now - thank you so much!
    – Codemonkey
    Nov 19, 2020 at 13:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .