Subject: [DNSOP] A6 queries

From: Roy Arends <[email-masked]>
Date: Wed, 28 Mar 2007 08:47:08 +0200

During the last meeting, Kurtis Lindquist asked an interesting  
question. He asked if anyone had a good explanation for the amount of  
requests for the now experimental type A6 Resource Record. This exact  
question was asked by David Malone during the OARC meeting (july  
2005) as well.

We (Nominet UK) are seeing those requests as well, and though they  
seem to come from a distributed set of IP addresses, most of these  
addresses run well-known resolvers that are known not to initiate  
those requests, hence they're proxied on behalve of stub resolvers.

Since this remains unanswered time and time again, and these requests  
for A6 types do not seem to diminish, I'm hoping that those that have  
access to traffic to a busy resolver are willing to spend some cycli  
on this.

If anyone is interested in doing this, or has a reasonable  
explanation for these A6 queries, please let me know.

Roy

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Ben Laurie <[email-masked]>
Date: Wed, 28 Mar 2007 08:20:13 +0100

Roy Arends wrote:
> During the last meeting, Kurtis Lindquist asked an interesting question.
> He asked if anyone had a good explanation for the amount of requests for
> the now experimental type A6 Resource Record. This exact question was
> asked by David Malone during the OARC meeting (july 2005) as well.
> 
> We (Nominet UK) are seeing those requests as well, and though they seem
> to come from a distributed set of IP addresses, most of these addresses
> run well-known resolvers that are known not to initiate those requests,
> hence they're proxied on behalve of stub resolvers.

Or typed on the command line.

> access to traffic to a busy resolver are willing to spend some cycli on
> this.
> 
> If anyone is interested in doing this, or has a reasonable explanation
> for these A6 queries, please let me know.
> 
> Roy
> 

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Ben Laurie <[email-masked]>
Date: Wed, 28 Mar 2007 08:20:13 +0100

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Wed, 28 Mar 2007 16:55:08 +0900

At Wed, 28 Mar 2007 08:47:08 +0200,

> question was asked by David Malone during the OARC meeting (july  

(snip)

> explanation for these A6 queries, please let me know.

BIND 9.2 keeps its full support for A6 and is still in use pretty
widely, so I guess that's the most likely source of such queries.
(BIND 9.2 was already in a maintenance state when A6 was effectively
deprecated by the compromise word of "experimental, and the A6 support
has stayed in its maintenance releases.)

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Wed, 28 Mar 2007 16:55:08 +0900

(snip)

					JINMEI, Tatuya

---

From: Roy Arends <[email-masked]>
Date: Wed, 28 Mar 2007 10:00:28 +0200

> has stayed in its maintenance releases.)

I agree. BIND 9.2 does this, and so does BIND 8.3, and these seem to  
be the bulk. But there are some instances that emit A6 outside of the  
8.3/9.2 set.

Roy

---

From: Roy Arends <[email-masked]>
Date: Wed, 28 Mar 2007 10:00:28 +0200

Roy

---

From: John Kristoff <[email-masked]>
Date: Wed, 28 Mar 2007 08:54:09 -0500

On Wed, 28 Mar 2007 08:47:08 +0200

> explanation for these A6 queries, please let me know.

I have some access to some resolvers that have these.  From what I
can see in a cursory look, it is another recursor, probably BIND?
asking for A6 records, mostly, if not always, of other name servers.
I've seen this from Solaris and Mac OS X boxes so I don't think it's
an OS specific thing.

John

---

From: John Kristoff <[email-masked]>
Date: Wed, 28 Mar 2007 08:54:09 -0500

John

---

From: John Kristoff <[email-masked]>
Date: Wed, 28 Mar 2007 09:10:10 -0500

On Wed, 28 Mar 2007 08:54:09 -0500

> can see in a cursory look, it is another recursor, probably BIND?

er, "another resolver" I meant.

John

---

From: John Kristoff <[email-masked]>
Date: Wed, 28 Mar 2007 09:10:10 -0500

John

---

From: Thierry Moreau <[email-masked]>
Date: Wed, 28 Mar 2007 09:32:32 -0500

Roy Arends wrote:

> question was asked by David Malone during the OARC meeting (july  2005) 
> as well.
> 

My 0.02 cents contribution: while spying on my residential LAN to get a
sense of Internet usage by my teenagers with Etherreal (these kids are
aware of my spying), I noticed A6 queries from the Suse Linux 10.1
workstation. No IPv6 stuff on this LAN or in the ISP service 
documentation. I couldn't easily figure out how to configure either the
stub resolver, or the default application use of it, in this Linux box. 
No time to investigate any further.

That's it.

Best regards.

-- 

- Thierry Moreau

---

From: Thierry Moreau <[email-masked]>
Date: Wed, 28 Mar 2007 09:32:32 -0500

That's it.

Best regards.

-- 

- Thierry Moreau

---

From: Simon Leinen <[email-masked]>
Date: Wed, 28 Mar 2007 16:59:51 +0200

Roy Arends writes:
> But there are some instances that emit A6 outside of the 8.3/9.2
> set.

Not what I see.  I looked at the most active sources of A6 queries in
a trace of 100'000 UDP DNS requests to a TLD server here.  For many of
the queriers, I was unable to determine the software versions, but
those that did tell me a BIND version, all except two claimed to be
9.2 or 8.3 versions.  The two exceptions claim to run 8.2.2-P1 - those
are somewhat strange, because I didn't think 8.2.2 had A6 support.

$ tshark -n -r ~/dns/dns-query-trace.pcap | awk '/query A6 / { print $3 }' > ~/dns/a6-query-sources.txt
$ for x in `sort -n ~/dns/a6-query-sources.txt | uniq -c | sort -n | tail -50 | awk '{ print $2 }'`; do dig +short @$x chaos txt version.bind.; done
"9.2.2"
;; connection timed out; no servers could be reached
"9.2.4"
"surely you must be joking"
"9.2.2"
"9.2.6-P2"
"Public DNS server v28.3.2. Keep your hands off!"
"9.2.5"
"9.2.3"
"not available"
;; connection timed out; no servers could be reached
"ZZZ"
"9.2.6"
"DNS server"
;; connection timed out; no servers could be reached
"8.2.2-P1"
"8.3.3-REL-NOESW"
"9.2.8"
;; connection timed out; no servers could be reached
"9.2.4"
"ip-plus"
"9.2.2"
"DNS Server"
"9.2.3"
"8.2.2-P1"
;; connection timed out; no servers could be reached
"Nice try..."
;; connection timed out; no servers could be reached
"9.2.1"
"9.2.4"
"9.2.6-P1"
"9.2.6"
"9.2.8"
"9.2.4"
;; connection timed out; no servers could be reached
"ip-plus"
;; connection timed out; no servers could be reached
"8.3.3-REL"
"None of your business"
;; connection timed out; no servers could be reached
"DNS"
;; connection timed out; no servers could be reached
"9.2.8"
"None of your business!"
"9.2.3"
-- 
Simon.

---

From: Simon Leinen <[email-masked]>
Date: Wed, 28 Mar 2007 16:59:51 +0200