Skip to main content

dns resolver behavior

i had an occasion to have to look up windows client behavior when it came to dns. specifically, i wanted to know how the client behaves when the primary name server is offline. before i had to fire up packet trace and check for myself, i stumbled on a couple of useful articles that spell it out.

UPDATE: had a conversation with a talented linux dns guy and discovered a few more useful things to note.

dns client resolver behavior
dns client resolution timeouts
dns forwarders and conditional forwarders resolution timeouts

in summary, it works as follows:

  • dns query sent to preferred
  • if no response within 1 second, dns query sent to alternate
  • if no response within 1 second, dns query sent to preferred again
  • if no response within 2 seconds, dns query sent to preferred and alternate
  • if no response within 4 seconds, dns query sent to preferred and alternate again
  • if no response within 7 seconds, process times out

 

something to note for linux systems, these appear to be default values:

  • timeout:n
    sets the amount of time the resolver will wait for a response from a remote name server before retrying the query via a different name server.  Measured in seconds, the default is RES_TIMEOUT (currently 5, see <resolv.h>).  The value for this option is silently capped to 30.
  • attempts:n
    sets the number of times the resolver will send a query to its name servers before giving up and returning an error to the calling application.  The default is RES_DFLRETRY (currently 2, see <resolv.h>).  The value for this option is silently capped to 5.
  • rotate
    sets RES_ROTATE in _res.options, which causes round-robin selection of name servers from among those listed.  This has the effect of spreading the query load among all listed servers, rather than having all clients try the first listed server first every time.
  • search
    Resolver queries having fewer than ndots dots default is 1) in them will be attempted using each component of the search path in turn until a match is found.
  • ndots:n
    sets a threshold for the number of dots which must appear in a name given to res_query(3) (see resolver(3)) before an initial absolute query will be made.  The default for n is 1, meaning that if there are any dots in a name, the name will be tried first as an absolute name before any search list elements are appended to it.  The value for this option is silently capped to 15.

in summary, the timeout value indicates how long the client will wait until it tries the next server in the search list. the number of queries attempted per server is dependent on how ndots is configured. once the server list is exhausted, the attempts value indicates if the client should try the list again.

additional settings can be found here: http://man7.org/linux/man-pages/man5/resolver.5.html

Comments

Popular posts from this blog

how to retrieve your ip address with powershell...

update: this is how it’s performed in powershell v3 as demonstrated here.(get-netadapter | get-netipaddress | ? addressfamily -eq'IPv4').ipaddress update: this is by far the easiest.PS C:\temp> (gwmi Win32_NetworkAdapterConfiguration | ? { $_.IPAddress -ne $null }).ipaddress
192.168.1.101
are you laughing yet?  i know you probably find this topic amusing.  it's really interesting though.  whenever you get over it, i'll do this in the standard cmd.exe interpreter and then in powershell to show you what kind of coolness powershell does.done?  okay, good.  this is an interpretation of a demo that bob wells did at our smug meeting.  hope you like it.i should tell you, it's not as simple as the title would lead you to believe.  i like doing that little slight-of-hand thing since it gives the impression that i'm painting a very easy target on my back for your criticism (though it's probably true in other ways)!  the idea is that we want to retrieve just the ip ad…

understanding the “ad op master is inconsistent” alert

i use the term “understanding” loosely.  this is by far no definitive guide on this particular alert, just a few things i have picked up in my attempt to understand it.let’s look at the context of the alert:The Domain Controller's Op Master is inconsitent. See additional alerts for details.
first of all, it gives very little information.  the only particularly useful detail is that it indicates which server is having the issue.  other than that, just a spelling error as there are no additional critical alerts to look at for details.this rule, as you know, comes from a sealed mp.  therefore, we can’t modify anything in it except the overrides.  the couple i’ve tinkered with are:interval (sec) log success event to begin with, interval (sec) is just set way too high.  the default is 60 seconds.  why on earth would anyone want to know that your op master consistency may be off, every minute?  actually, i could think of a few reasons, but really, it’s overkill.  the way the script works…

sccm: content hash fails to match

back in 2008, I wrote up a little thing about how distribution manager fails to send a package to a distribution point. even though a lot of what I wrote that for was the failure of packages to get delivered to child sites, the result was pretty much the same. when the client tries to run the advertisement with an old package, the result was a failure because of content mismatch.I went through an ordeal recently capturing these exact kinds of failures and corrected quite a number of problems with these packages. the resulting blog post is my effort to capture how these problems were resolved. if nothing else, it's a basic checklist of things you can use.DETECTIONstatus messagestake a look at your status messages. this has to be the easiest way to determine where these problems exist. unfortunately, it requires that a client is already experiencing problems. there are client logs you can examine as well such as cas, but I wasn't even sure I was going to have enough material to …