Subject: [DNSOP] Strange EDNS Header Flags in DNS packet

From: "Jianjun Ning" <[email-masked]>
Date: Tue, 17 Dec 2013 16:21:35 +0800

All,
When I run the command 'dig www.google.com.hk +bufsize=768',I got this message,
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22832
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; MBZ: 0005 , udp: 512
;; QUESTION SECTION:
;www.google.com.hk.             IN      A

The value of field MBZ is 0x0005!!
According to the RFC,there is no value assigned to the field now.I think it should be zero now.
What has caused this phenomenon?

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 17 Dec 2013 09:47:36 +0100

On Tue, Dec 17, 2013 at 04:21:35PM +0800,
 Jianjun Ning <[email-masked]> wrote 

> The value of field MBZ is 0x0005!!

The Google authoritative name servers do not seem to return a EDNS
section in their answers. Therefore, this section has probably been
added by your resolver, or by a middleman (something which is quite
common in China).

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Tue, 17 Dec 2013 11:08:21 +0100

On 12/17/13 09:21, Jianjun Ning wrote:
> All,
> When I run the command 'dig www.google.com.hk +bufsize=768',I got this

> ; EDNS: version: 0, flags:; MBZ: 0005 , udp: 512

Does it increase after consecutive queries?

It reminds me of this:

https://www.sidnlabs.nl/laatste-berichten/nieuwsdetail/article/dnssec-problemen-in-thuis-routers/

(in Dutch)

--
Marco

---

From: Nicholas Weaver <[email-masked]>
Date: Tue, 17 Dec 2013 05:11:42 -0800

> added by your resolver, or by a middleman (something which is quite

The great firewall packet injector is easy to detect.  Because it only responds to queries, target your dig (using @) to an IP that isn't hosting a DNS server.

So, eg,

dig +norecurse +bufsize=768 www.google.com.hk @192.150.187.1

(Sends to ICSI, but not our DNS server, so you know the route goes to the west coast of the US)

--
Nicholas Weaver                  it is a tale, told by an idiot,
[email-masked]                full of sound and fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc