Module 8 DNS Tools & Diagnostics

Objectives Understand dig and nslookup Understand BIND toolset Understand BIND logs Understand wire level messages

DNS Tools & Diagnostics Dig always available with BIND (*nix) and windows Nslookup available on windows and *nix Dig on windows – unpack zip, copy only dig.exe, libbind9.dll, libdns.dll, libisc.dll, libisccfg.dll, liblwres.dll to portable media SamSpade.org provides windows GUI utility with dig. Freeware.

DIG Command line tool – tons of options Powerful – gives precise DNS RRs Typically only available with BIND Casual use on Windows Unpack Windows zip file Copy to portable media dig.exe, libbind9.dll, libdns.dll, libisc.dll, libisccfg.dll, liblwres.dll Now an install option

Dig Command Format Tons of options to govern formatting and behavior -x required for reverse = optionally defines the name or IP of name server to send the query – default is locally defined DNS (typically recursive) target-name = name required type = RR type (default is A) Additional pseudo types any and axfr dig [opts] target-name type

Dig Commands dig Returns A RR of using local DNS Returns A RR of using using ns1.example.com authoritative name server for domain dig any Returns any RRs with label of using local DNS dig –x Returns reverse lookup for using local DNS

DIG command

DIG Response ; > DiG P1 > ns1.example.com ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd ra aa; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2 ;; QUESTION SECTION: ; IN A ;; ANSWER SECTION: 5 IN A IN A ;; AUTHORITY SECTION: example.com IN NS ns1.example.com. example.com IN NS ns2.example.com. ;; ADDITIONAL SECTION: ns1.example.com IN A ns2.example.com IN A ;; SERVER: #53( )

DIG Response May contain up to 5 sections Header – flags, status, id QUESTION SECTION The query ANSWER SECTION Present only if successful AUTHORITY SECTION One or more name servers ADDITIONAL SECTION Typically A/AAAA RRs of name servers

DNS Flag Values QR – Query response received. Indicates direction of query AA - Authoritative Answer. Set if the response was received from a zone master or slave. TC - TrunCation - length greater than permitted, set on all truncated messages except the last one. RD - Recursion Desired - set in a query and copied into the response if recursion supported. RA - Recursion Available - valid in a response and if set denotes recursive query support is available. AD - Authenticated Data. DNSSEC only. Indicates that the data was reliably authenticated. CD - Checking Disabled. DNSSEC only. Disables checking at the receiving server.

DNS Status Values 0 = NOERR. No error. 1 = FORMERR. Format error - the server was unable to interpret the query. 2 = SERVFAIL – name server problem or lack of information. Often also returned with the same meaning as REFUSED. 3= NXDOMAIN Name does not exist - meaningful only from an authoritative name server. 4 = NOTIMPL Not Implemented. 5 = REFUSED - typically for policy reasons, for example, a zone transfer request.

DIG Result No errors (NOERROR) Flags query response, recursion desired, recursion available, authoritative Answer = 2 A RRs for the web server Authority = 2 name servers Additional = 2 A RRs of name servers

DIG commands

DIG Response ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 14 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ; IN A ;; AUTHORITY SECTION: com IN NS A.GTLD-SERVERS.NET. com IN NS M.GTLD-SERVERS.NET. ;; ADDITIONAL SECTION: A.GTLD-SERVERS.NET IN A A.GTLD-SERVERS.NET IN AAAA 2001:503:a83e::2: ;; Query time: 38 msec ;; SERVER: #53( )

DIG Response No error = NOERROR Status = query response, recursion desired No answer section Authority = multiple Additional = multiple A RRs This is a referral

NSLOOKUP Available on windows and with BIND (*nix) Command line and interactive mode Default pretty print output Useful quick check depends on mindset Detailed data or overview Use –d2 option for RRs nslookup [opts] target [dns]

NSLOOKUP Commands nslookup -type=MX example.com Gets mail server records for example.com using locally defined name server nslookup Gets reverse mapped name for nslookup ns1.example.com Gets A RR for using name server ns1.example.com nslookup Enter interactive mode – exit to terminate

NSLOOKUP # nslookup Server: ns1.example.net Address: Name: Address: # nslookup ns1.example.com Server: ns1.example.com Address: Name: Address:

Additional Tools - BIND named-checkzone, named-checkconf – validation utilities Rndc, rndc-confgen – remote control of name server (optionally secure) nsupdate - Dynamic Update (DDNS) of DNS RRs dnssec-keygen, dnssec-signzone – secure DNS cryptographic tools

DNS Logging BIND defaults to syslog (*nix) BIND Controlled by logging clause Windows DNS Event log via DNS console or Event log (DNS) Debug log default systemroot\System32\Dns\Dns.log (text file) DNS console Properties- >logging

BIND Log Analysis stream log carefully (category) single or multiple logs watch log size! (use version/size) iterate based on experience post processing tools know what a normal log looks like

BIND Log Analysis lame-servers: unexpected RCODE (REFUSED) resolving 'mail10fr2.emthtpmy1.net/A/IN': #53 update-security: client #49160: update 'mediazoneplus.com/IN' denied security: client #35411: query (cache) 'doc.gov/ANY/IN' denied lame-servers: unexpected RCODE (SERVFAIL) resolving 'cns.electro-com.ru/A/IN': #53 lame-servers: host unreachable resolving 'mumns5.mtnl.net.in/A/IN': #53 security: client #9980: query (cache) 'google.com/A/IN' denied lame-servers: connection refused resolving 'pdns5.ultradns.info/A/IN': 2001:500:1a::1#53 security: client #45985: query (cache) 'com/ANY/IN' denied lame-servers: connection refused resolving ' in-addr.arpa/PTR/IN': 2001:470:300::2#53

DNS Diagnostics (Wire Level) wireshark is the easiest way load wireshark-charlotte-com.txt dns filter partial expansion and/or load dns-charlotte-com.pcap dns traffic only filter both use the domain charlottecrystalinteriordesign.com

DNS - Diagnostics (Wire) Internet Protocol, Src: ( ), Dst: ( ) User Datagram Protocol, Src Port: (16533), Dst Port: domain (53) Domain Name System (query) [Response In: 4] Transaction ID: 0xef45 Flags: 0x0000 (Standard query) Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries type A, class IN Name: Type: A (Host address) Class: IN (0x0001) Additional records : type OPT

DNS – Diagnostics (Wire) eb a b6 f2 0b 2b &Dh.rpZ...+..E f 59 c c0 a d2 17._Y A b 9d 6e ef e c f c 69 6e ottecrystalinter f e f 6d iordesign.com )

Quick Quiz What is the default RR type for dig? What is the default RR type for nslookup? Name any BIND utility? Can you run dig on windows? Dig command for mx RR for google.com? Nslookup command for mx RR for google.com? dig command for reverse lookup?