[Venis33]

Primetio sam da su DNS upiti putem TCP efektivno nedostupni na Telekomovom serveru odisej.telekom.rs (195.178.32.2), odnosno RNIDS TLD NS b.nic.rs koji je "u rotaciji" za rs. TLD. Ack na korisnički paket od servera stigne odmah, ali PUSH sa podacima, odnosno DNS odgovorom gotovo nikako. To upućuje na probleme sa samim DNS servisom poput punjenja queue, zaglavljeni syscall zbog nekog čekanja i slično.

Code:

luka@luka3630:~$ for nic in $(dig rs. NS +short); do echo "DNS: $nic | qtype: SOA"; dig rs. SOA @$nic +short +tcp; done DNS: f.nic.rs. | qtype: SOA a.nic.rs. hostmaster.nic.rs. 2026040843 3600 900 2419200 3600 DNS: c.nic.rs. | qtype: SOA a.nic.rs. hostmaster.nic.rs. 2026040843 3600 900 2419200 3600 DNS: b.nic.rs. | qtype: SOA ;; communications error to 195.178.32.2#53: timed out ;; communications error to 195.178.32.2#53: timed out ;; communications error to 195.178.32.2#53: timed out ;; Connection to 2a00:e90:0:3::3#53(2a00:e90:0:3::3) for rs. failed: network unreachable. ;; no servers could be reached DNS: h.nic.rs. | qtype: SOA a.nic.rs. hostmaster.nic.rs. 2026040843 3600 900 2419200 3600 DNS: a.nic.rs. | qtype: SOA a.nic.rs. hostmaster.nic.rs. 2026040843 3600 900 2419200 3600 DNS: l.nic.rs. | qtype: SOA a.nic.rs. hostmaster.nic.rs. 2026040843 3600 900 2419200 3600

Kada se drastično poveća timeout, ipak na kraju i može da stigne odgovor, ali jako sporo, od 30 sekundi preko 50 sekundi do toga da čak ni 75s za timeout nije dovoljno.

luka@luka3630:~/.ssh$ sudo -u nobody dig rs. SOA @b.nic.rs +tcp +timeout=75

; <<>> DiG 9.20.18-1~deb13u1-Debian <<>> rs. SOA @b.nic.rs +tcp +timeout=75
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43208
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 208905b4a1abf2950100000069d89af0c0daef4f6b3b3a15 (good)
;; QUESTION SECTION:
;rs.                IN    SOA

;; ANSWER SECTION:
rs.            3600    IN    SOA    a.nic.rs. hostmaster.nic.rs. 2026041019 3600 900 2419200 3600

;; Query time: 50444 msec
;; SERVER: 195.178.32.2#53(b.nic.rs) (TCP)
;; WHEN: Fri Apr 10 08:38:40 CEST 2026
;; MSG SIZE  rcvd: 112

luka@luka3630:~/.ssh$ sudo -u nobody dig rs. SOA @b.nic.rs +tcp +timeout=75

; <<>> DiG 9.20.18-1~deb13u1-Debian <<>> rs. SOA @b.nic.rs +tcp +timeout=75
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29929
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 223a983be43a93650100000069d89bc7c0c5bb886e47568f (good)
;; QUESTION SECTION:
;rs.                IN    SOA

;; ANSWER SECTION:
rs.            3600    IN    SOA    a.nic.rs. hostmaster.nic.rs. 2026041019 3600 900 2419200 3600

;; Query time: 32412 msec
;; SERVER: 195.178.32.2#53(b.nic.rs) (TCP)
;; WHEN: Fri Apr 10 08:42:15 CEST 2026
;; MSG SIZE  rcvd: 112

TCP nedostupnost svakako krši EDNS usklađenost (videti i "DNS flag day"). Takođe, odisej.telekom.rs se dodatno koristi kao NS za zonu mup.gov.rs, tako da bi u slučaju većih RRova tamo koji dovode do truncovanog UDP odgovora i preusmerenja na TCP upit pukao.

[Venis33]

Ovo sam primetio pre nekoliko dana. U međuvremenu sam kontaktirao RNIDS, za sada još nisam dobio odgovor ali jutros sam proverio i vidim da DNS upiti putem TCP rade u redu:

luka@luka3630:~$ dig rs. SOA @b.nic.rs +tcp

; <<>> DiG 9.20.18-1~deb13u1-Debian <<>> rs. SOA @b.nic.rs +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44390
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: aecb265ee8524a3f0100000069d9fa7ca3dfc04ff9c5d313 (good)
;; QUESTION SECTION:
;rs. IN SOA

;; ANSWER SECTION:
rs. 3600 IN SOA a.nic.rs. hostmaster.nic.rs. 2026041121 3600 900 2419200 3600

;; Query time: 4 msec
;; SERVER: 195.178.32.2#53(b.nic.rs) (TCP)
;; WHEN: Sat Apr 11 09:38:36 CEST 2026
;; MSG SIZE  rcvd: 112

[Venis33]

Od danas ponovo problemi, nekada čak i probije ovaj timeout od 75s...

luka@luka3630:/usr/share/nmap/scripts$ dig rs. SOA @b.nic.rs +tcp +timeout=75 +noall +stats +qr
;; QUERY SIZE: 43

;; Query time: 17000 msec
;; SERVER: 195.178.32.2#53(b.nic.rs) (TCP)
;; WHEN: Tue Apr 14 21:03:58 CEST 2026
;; MSG SIZE  rcvd: 112