[comp.protocols.tcp-ip.domains] NIC net 10 address pollution

craig@NNSC.NSF.NET (Craig Partridge) (04/09/90)

Hi folks:

    We're still picking up the NIC's net 10 address from someone out
there -- looks like it may be a root server.  Could folks check their
caches and flush the old address? (Shades of C.ISI.EDU).

Thanks!

Craig

del@thrush.mlb.semi.harris.com (Don Lewis) (04/10/90)

In article <9004091446.AA09255@ucbvax.Berkeley.EDU> craig@NNSC.NSF.NET (Craig Partridge) writes:
>
>Hi folks:
>
>    We're still picking up the NIC's net 10 address from someone out
>there -- looks like it may be a root server.  Could folks check their
>caches and flush the old address? (Shades of C.ISI.EDU).
>
>Thanks!
>
>Craig

I just checked what our name server thought the root name servers
are and not only was the NIC's 10 address there, there were also
.arpa's!  I sure wish that BIND had an option to log who pollutes
its cache.
--
Don "Truck" Lewis                      Harris Semiconductor
Internet:  del@mlb.semi.harris.com     PO Box 883   MS 62A-028
UUCP:      rutgers!soleil!thrush!del   Melbourne, FL  32901              
Phone:     (407) 729-5205

pma@CND.HP.COM (04/10/90)

> I just checked what our name server thought the root name servers
> are and not only was the NIC's 10 address there, there were also
> .arpa's!  I sure wish that BIND had an option to log who pollutes
> its cache.

Here is a code segment for ns_resp.c that I had used a while ago
to track down this problem for us.  The problem was the result of
a parent saying that server X was authoritative for domain Y when,
in fact, server X was not authoritative.  When server X was questioned
about domain Y, it sometimes responded with NS records for the root
(depending on whether it didn't find any other NS records on its
walk up the tree.)

A way to solve the problem without a code change is to make sure that
the servers that are registered for a domain really are authoritative
for that domain.  I wrote a program to check all our subdomain delegations
so we are better at managing our own domain.

paul
==========
*** /tmp/,RCSt1a00312	Tue Apr 10 09:21:15 1990
--- /tmp/,RCSt2a00312	Tue Apr 10 09:21:20 1990
***************
*** 1038,1044
  			fprintf(ddt,"update failed (DATAEXISTS)\n");
  #endif
  		(void) free((char *)dp);
! 	} else if (type == T_NS && savens != NULL)
  		*savens = dp;
  	return (cp - rrp);
  }

--- 1038,1062 -----
  			fprintf(ddt,"update failed (DATAEXISTS)\n");
  #endif
  		(void) free((char *)dp);
! 	} else if (type == T_NS && savens != NULL){
! #ifdef TRACEROOT
! 		char qname[MAXDNAME];
! 		int qn;
! 		/*
! 		** Trace where roots NS records come from
! 		*/
! 		qname[0] = '\0';
! 		qn = dn_expand(msg, msg + msglen, msg + sizeof(HEADER), qname,
! 							sizeof(qname));
! 		if (qn < 0) 
! 			{ qname[0] = '?'; qname[1] = '\0';}
! 		else if (qname[0] == '\0')
! 			{ qname[0] = '.'; qname[1] = '\0';}
!         	if ((dname[0] == '\0') && (zone == 0)) 
!                	      syslog(LOG_ERR, 
! 		           "For question \"%s\", added root NS record for %s from %s\n",
!                                    qname, data, inet_ntoa(from_addr.sin_addr));
! #endif
  		*savens = dp;
  	}
  	return (cp - rrp);
***************
*** 1040,1045
  		(void) free((char *)dp);
  	} else if (type == T_NS && savens != NULL)
  		*savens = dp;
  	return (cp - rrp);
  }
  

--- 1058,1064 -----
                                     qname, data, inet_ntoa(from_addr.sin_addr));
  #endif
  		*savens = dp;
+ 	}
  	return (cp - rrp);
  }