Subject: [DNSOP] m.root-servers.net DNSSEC TCP failures

From: "George Barwood" <[email-masked]>
Date: Wed, 17 Mar 2010 11:28:23 -0000

It seems that 

m.root-servers.net 

is now serving DNSSEC, but does not have TCP, so the following queries all fail

dig any . @m.root-servers.net
dig rrsig . @m.root-serves.net
dig any . @m.root-servers.net +dnssec +bufsize=1400

None of these are normal queries, but seems a bit doubtful even so.

George

---

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 17 Mar 2010 12:39:30 +0100

m.root-servers.net 

    is now serving DNSSEC, but does not have TCP, so the following
    queries all fail

They works for me but not behind the linksys router of the meeting I'm
currently in.

	jaap

---

From: Olafur Gudmundsson <[email-masked]>
Date: Wed, 17 Mar 2010 08:00:55 -0400

Here is what I get:
<stora:~ 7:55 8 0>dig any . @m.root-servers.net.
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.6.1-P1 <<>> any . @m.root-servers.net.

Thus I think the any-cast instance you are using is the broken one,
I'm talking to the one on the west coast of the US. (SFO ?).

traceroute to m.root-servers.net (202.12.27.33), 64 hops max, 40 byte 
packets
  ..
  3  ge-0-0-2.cr2.sfo1.speakeasy.net (69.17.87.18)  98.303 ms  96.415 ms 
  97.783 ms
  4  rtr0.sfo.m.root-servers.org (198.32.176.179)  100.297 ms  100.138 
ms  97.285 ms
  5  M.ROOT-SERVERS.NET (202.12.27.33)  99.553 ms  100.397 ms  99.036 ms

	Olafur

On 17/03/2010 7:28 AM, George Barwood wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>
>
>

---

From: Gilles Massen <[email-masked]>
Date: Wed, 17 Mar 2010 13:16:05 +0100

It's a bit weird from here:

TCP queries to m's IPv4 adress are working fine:

dns-test:~ # dig @202.12.27.33 . any
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.7.0-P1 <<>> @202.12.27.33 . any
; (1 server found)
;; global options: +cmd
;; Got answer:

And:

dig @202.12.27.33 hostname.bind ch txt +short +tcp
"M-NRT-JPIX-3"

With IPv6 it's pretty strange:

dns-test:~ # dig @2001:dc3::35 . any
;; Truncated, retrying in TCP mode.
<timeout>

BUT:

dns-test:~ # dig @2001:dc3::35 . ns +tcp

; <<>> DiG 9.7.0-P1 <<>> @2001:dc3::35 . ns +tcp
; (1 server found)
;; global options: +cmd
;; Got answer:
[...]
;; Query time: 34 msec
;; SERVER: 2001:dc3::35#53(2001:dc3::35)
;; WHEN: Wed Mar 17 13:10:59 2010
;; MSG SIZE  rcvd: 632

dns-test:~ # dig @2001:dc3::35 hostname.bind ch txt +short +tcp
"M-CDG-2"

Actually any query to M with IPv6 and TCP seems to work but ANY.

But dig @2001:dc3::35 . any +bufsize=2048 doesn't work either. Maybe the
IPv6 instance is having MTU/DF issues?

Gilles

-- 
Fondation RESTENA - DNS-LU
6, rue Coudenhove-Kalergi
L-1359 Luxembourg
tel: (+352) 424409
fax: (+352) 422473

---

From: Nicholas Weaver <[email-masked]>
Date: Wed, 17 Mar 2010 05:21:55 -0700

A little more, from Comcast SF bay area:  

Its responding to large EDNS MTUs just fine for me:

dig +dnssec any . @m.root-servers.net
works (4096B MTU)

but with a 512B MTU (no EDNS) it doesn't because there is no working TCP:
dig any . @m.root-servers.net
;; Truncated, retrying in TCP mode.
;; Connection to 2001:dc3::35#53(2001:dc3::35) for . failed: host unreachable.
;; communications error to 202.12.27.33#53: connection reset

And its not an IPv6 error, nor specific to the ANY query for the instance I'm connecting to, because:

 dig +tcp NS . @202.12.27.33 
;; communications error to 202.12.27.33#53: connection reset

Traceroute for me (comcast, SF bay area):

 8  pos-0-0-0-0-pe01.11greatoaks.ca.ibone.comcast.net (68.86.86.54)  18.236 ms  19.293 ms  18.971 ms
 9  xe-9-3-0-0.sjc10.ip4.tinet.net (213.200.80.165)  18.936 ms  17.631 ms  18.901 ms
10  xe-0-0-0.par20.ip4.tinet.net (89.149.187.165)  188.885 ms  170.598 ms
    xe-1-0-0.par20.ip4.tinet.net (89.149.187.169)  187.812 ms
11  213.200.76.38 (213.200.76.38)  174.631 ms  171.042 ms  170.649 ms
12  * 213.200.76.38 (213.200.76.38)  171.488 ms !X *
13  * 213.200.76.38 (213.200.76.38)  174.952 ms !X *
14  213.200.76.38 (213.200.76.38)  172.172 ms !X
 *  175.036 ms !X

My net has no filtering that I know of on DNS, either UDP or TCP:
http://n1.netalyzr.icsi.berkeley.edu/restore/id=43ca253f-32397-7e23ee37-14c3-4026-9f6b/rd

---

From: Jim Reid <[email-masked]>
Date: Wed, 17 Mar 2010 12:23:13 +0000

On 17 Mar 2010, at 11:28, George Barwood wrote:

> It seems that  m.root-servers.net is now serving DNSSEC, but does  
> not have TCP, so the following queries all fail

Well these queries work just fine for me. Perhaps your problems are  
caused by local misconfiguration such as a broken CPE/middleware box  
or DNS proxy?

---

From: Nicholas Weaver <[email-masked]>
Date: Wed, 17 Mar 2010 05:31:15 -0700

On Mar 17, 2010, at 5:23 AM, Jim Reid wrote:

>> It seems that  m.root-servers.net is now serving DNSSEC, but does not have TCP, so the following queries all fail
> 
> Well these queries work just fine for me. Perhaps your problems are caused by local misconfiguration such as a broken CPE/middleware box or DNS proxy?

I think its that its agressively multihomed, and ONE of the instances is not working with TCP.

My home net happily lets through anything on port 53, TCP or UDP, and I'm seeing the same symptoms, but a little more data:

I think there may be something more wrong with that instance thats causing the TCP failures, so it might be something more general:

--- m.root-servers.net ping statistics ---
16 packets transmitted, 5 packets received, 68.8% packet loss
round-trip min/avg/max/stddev = 223.651/1423.662/2222.722/747.819 ms

--- l.root-servers.net ping statistics ---
7 packets transmitted, 7 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 85.971/87.705/89.645/1.164 ms

---

From: "George Barwood" <[email-masked]>
Date: Wed, 17 Mar 2010 13:18:30 -0000

----- Original Message ----- 
From: "Jim Reid" <[email-masked]>
To: "George Barwood" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, March 17, 2010 12:23 PM
Subject: Re: [DNSOP] m.root-servers.net DNSSEC TCP failures

> caused by local misconfiguration such as a broken CPE/middleware box  

I don't think it is very local, as all the other root servers work fine.
I reproduced the problem at 3 different sites, all within the UK.

The error message from dig is

;; communications error to 202.12.27.33#53: network unreachable

and this comes up immediately.

Ping shows high packet loss ( > 50% ) , and an average round trip time of 600 msec.

But DNS/UDP works fine, with a response time of 30 msec.

I guess there are some network problems with TCP.

---

From: [email-masked]
Date: Wed, 17 Mar 2010 15:01:33 +0100 (CET)

> I think there may be something more wrong with that instance thats causing the TCP failures, so it might be something more general:

I definitely see problems with m.root-servers.net and TCP from here
(Oslo, Norway):

% dig any . @202.12.27.33
;; Truncated, retrying in TCP mode.
;; communications error to 202.12.27.33#53: connection reset

% dig +tcp NS . @202.12.27.33
;; communications error to 202.12.27.33#53: connection reset

% dig any . @2001:dc3::35
;; Truncated, retrying in TCP mode -> works, 1895 byte answer

% dig +tcp NS . @2001:dc3::35
works, 632 byte answer

So it looks like the IPv4 instance refuses TCP, while the IPv6 instance
handles it okay. No filters in the way at my end. The m.root-servers.net
instance looks like it is in Paris or thereabouts - but there is quite
a bit of difference between the instances: IPv4 (highly variable ping,
RTT 700 ms or more) and IPv6 (ping steady at RTT 44-45 ms).

% traceroute 202.12.27.33
traceroute to 202.12.27.33 (202.12.27.33), 64 hops max, 40 byte packets
 1  ge0-3-1-99.ar1.hmg9.no.cachbone.net (193.75.110.65)  0.412 ms  0.508 ms  0.782 ms
 2  ge2-0-2.cr1.xa19.no.catchbone.net (193.75.1.217)  0.626 ms  0.635 ms  0.626 ms
 3  te5-1-0.br1.xa19.no.catchbone.net (193.75.1.74)  0.464 ms  0.326 ms  0.287 ms
 4  TenGigabitEthernet8-3.ar1.OSL2.gblx.net (64.211.83.13)  0.469 ms  0.476 ms  0.469 ms
 5  pos2-0-0-10G.ar1.ARN3.gblx.net (67.17.106.86)  7.328 ms  7.344 ms  7.334 ms
 6  tiscali-1.ar1.ARN3.gblx.net (64.208.110.130)  7.340 ms  7.342 ms  7.334 ms
 7  xe-4-1-0.par20.ip4.tinet.net (89.149.184.18)  33.077 ms
    xe-0-2-0.par20.ip4.tinet.net (89.149.187.193)  33.081 ms
    xe-4-1-0.par20.ip4.tinet.net (89.149.184.18)  33.072 ms
 8  213.200.76.38 (213.200.76.38)  53.975 ms  42.443 ms  42.284 ms
 9  * M.ROOT-SERVERS.NET (202.12.27.33)  180.041 ms  995.786 ms

% traceroute6 2001:dc3::35
traceroute6 to 2001:dc3::35 (2001:dc3::35) from 2001:8c0:8500:1::2, 64 hops max, 12 byte packets
 1  ge0-3-1-99.ar1.hmg9.no.catchbone.net  81.250 ms  0.517 ms  0.502 ms
 2  ge2-0-2.cr1.xa19.no.catchbone.net  0.477 ms  0.526 ms  0.475 ms
 3  te7-1-0.cr1.fn3.no.catchbone.net  0.647 ms  0.661 ms  0.634 ms
 4  te5-3-0.br1.fn3.no.catchbone.net  4.686 ms  0.674 ms  0.631 ms
 5  ix-6-0-0.core2.OS1-Oslo.ipv6.as6453.net  0.943 ms  0.819 ms  0.789 ms
 6  POS5-0-0.core1.AD1-Amsterdam.ipv6.as6453.net  26.062 ms  25.932 ms  25.914 ms
 7  if-1-0-0.1663.core1.FV0-Frankfurt.ipv6.as6453.net  34.651 ms  34.520 ms  34.488 ms
 8  POS10-0-0.core1.PV1-Paris.ipv6.as6453.net  43.541 ms  43.726 ms  43.699 ms
 9  wide-m-root-server-2.sfinx.tm.fr  43.536 ms  141.217 ms  43.734 ms
10  M.ROOT-SERVERS.NET  44.020 ms  44.348 ms  44.338 ms

Steinar Haug, Nethelp consulting, [email-masked]

---

From: [email-masked]
Date: Wed, 17 Mar 2010 15:07:30 +0100 (CET)

> RTT 700 ms or more) and IPv6 (ping steady at RTT 44-45 ms).

Should of course have checked hostname.bind, which reveals:

% dig @202.12.27.33 hostname.bind ch txt +short
"M-CDG-3"
% dig @2001:dc3::35 hostname.bind ch txt +short
"M-CDG-4"

So it seems my guess of Paris or thereabouts wasn't too far off. And
M-CDG-3 seems to have problems with TCP.

---

From: Tony Finch <[email-masked]>
Date: Wed, 17 Mar 2010 14:08:32 +0000

> I reproduced the problem at 3 different sites, all within the UK.

Works for me from cam.ac.uk. I'm hitting the M instance in Tokyo (!) over
IPv4 and in Paris over IPv6.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.

---

From: Chris Thompson <[email-masked]>
Date: 17 Mar 2010 14:19:16 +0000

>M-CDG-3 seems to have problems with TCP.

That would explain why I don't see the effect at all. I am getting
M-NRT-JPIX-3 for IPv4 and M-CDG-4 for IPv6 (over either UDP or TCP).

-- 
Chris Thompson               University of Cambridge Computing Service,
Email: [email-masked]    New Museums Site, Cambridge CB2 3QH,
Phone: +44 1223 334715       United Kingdom.

---

From: Gilles Massen <[email-masked]>
Date: Wed, 17 Mar 2010 15:59:31 +0100

>> M-CDG-3 seems to have problems with TCP.

Well, I'm getting IPv6 replies from M-CDG-2 which should be in Paris as
well. I have perfect ping responses (30ms, no packet loss). And TCP
works except for the ANY query... so that doesn't quite look like a
stressed network.

> M-NRT-JPIX-3 for IPv4 and M-CDG-4 for IPv6 (over either UDP or TCP).

I would love to know why your get M-CDG-4 and I get M-CDG-2... I'd guess
that your packets should take the janet-geant-sfinx route?

Gilles

---

From: Mark Andrews <[email-masked]>
Date: Thu, 18 Mar 2010 07:51:10 +1100

> that your packets should take the janet-geant-sfinx route?

I get garbage out of M-SFO-1 for ANY queries. Non-meta types apprear to be
ok.  NS/RRSIG/TXT/A for the root are all ok.

drugs:bind9-re-sign 07:47 {3767} % dig @2001:dc3::35 hostname.bind ch txt +short
"M-SFO-1"
drugs:bind9-re-sign 07:47 {3768} % 

tcpdump -s 0 -n -i gif0 -X host m.root-servers.net
tcpdump: WARNING: gif0: no IPv4 address assigned
tcpdump: listening on gif0
07:45:55.528778 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: S 1431041212:1431041212(0) win 65535 <mss 1440,nop,wscale 1,nop,nop,timestamp 2389400257 0,sackOK,eol> [flowlabel 0xf44d4]
0x0000   600f 44d4 002c 063f 2001 0470 1f00 0820        `.D..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4bc        .......5.~.5UK..
0x0030   0000 0000 b002 ffff 72d8 0000 0204 05a0        ........r.......
0x0040   0103 0301 0101 080a 8e6b 5ac1 0000 0000        .........kZ.....
0x0050   0402 0000                                      ....
07:45:55.697734 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63358: S 6066318:6066318(0) ack 1431041213 win 32768 <mss 1440,nop,wscale 0,nop,nop,timestamp 0 2389400257,sackOK,nop,nop>
0x0000   6000 0000 002c 063c 2001 0dc3 0000 0000        `....,.<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77e 005c 908e        .."......5.~.\..
0x0030   554b f4bd b012 8000 60dc 0000 0204 05a0        UK......`.......
0x0040   0103 0300 0101 080a 0000 0000 8e6b 5ac1        .............kZ.
0x0050   0402 0101                                      ....
07:45:55.698847 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389400428 0> [flowlabel 0xf44d4]
0x0000   600f 44d4 0020 063f 2001 0470 1f00 0820        `.D....?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4bd        .......5.~.5UK..
0x0030   005c 908f 8010 804c a09c 0000 0101 080a        .\.....L........
0x0040   8e6b 5b6c 0000 0000                            .k[l....
07:45:55.700266 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: P 1:20(19) ack 1 win 32844 <nop,nop,timestamp 2389400429 0> 25355+ ANY? . (17) [flowlabel 0xf44d4]
0x0000   600f 44d4 0033 063f 2001 0470 1f00 0820        `.D..3.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4bd        .......5.~.5UK..
0x0030   005c 908f 8018 804c 3c62 0000 0101 080a        .\.....L<b......
0x0040   8e6b 5b6d 0000 0000 0011 630b 0100 0001        .k[m......c.....
0x0050   0000 0000 0000 0000 ff00 01                    ...........
07:45:55.872933 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63358: P 1429:1898(469) ack 20 win 33120 <nop,nop,timestamp 0 0> 20894 op7 [b2&3=0x3a8b] [61225a] [54612q] [21615n] [63742au] Type256 (Class 256)? C_^[d^NM-^XM-xM-^EM-BM-*-sM-IKM-+}M-^QM-%&/#M-aBRM-J.M-)M-^CjvqM-uB}^_^AM-WqM-8M-}SM-^@M-^B}^OM-^4!cM-@^\^@^A^@^A^@6M-nM-^@^@^DM-F)^@^DM-D^?^@^A^@^A^@6M-nM-^@^@^DM-@M-dOM-IM-DM-Y^@^A^@^A^@6M-nM-^@^@^DM-@!^D^LM-DM-,^@^A^@^A^@6M-nM-^@^@^DM-^@^H^JZM-DM-^]^@^A^@^A^@6M-nM-^@^@^DM-@M-KM-f^JM-E^S^@^A^@^A^@6M-nM-^@^@^DM-@^E^EM-qM-DM-^N. Type32831 (Class 565)? M-nM-^@^@^DM-@p$^DM-DM-h^@^A^@^A^@6M-nM-^@^@^DM-^@?^B5M-DM-;^@^A^@^A^@6M-nM-^@^@^DM-@$M-^T^QM-E1^@^A^@^A^@6M-nM-^@^@^DM-@:.^^M-DM-J^@^A^@^A^@6M-nM-^@^@^DM-A^@^NM-^AM-E"^@^A^@^A^@6M-nM-^@^@^DM-G^GS*M-DM-w^@^A^@^A^@6M-nM-^@^@^DM-J^L^[!M-@^\^@^\^@^A^@6M-nM-^@^@^P ^A^E^CM-:>^@^@^@^@^@^@^@^B^@0M-E^S^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@/^@^@^@^@^@^@^@^@^@^OM-DM-h^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@^A^@^@^@^@^@. AAAA? [|domain] [flo
 wlabel 0x19e4c]
0x0000   6001 9e4c 01f5 063c 2001 0dc3 0000 0000        `..L...<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77e 005c 9623        .."......5.~.\.#
0x0030   554b f4d0 8018 8160 6e0d 0000 0101 080a        UK.....`n.......
0x0040   0000 0000 0000 0000 1c29 519e 3a8b d554        .........)Q.:..T
0x0050   ef29 546f f8fe 9443 5f1b 640e 98f8 85c2        .)To...C_.d.....
0x0060   aa2d 73c9 4bab 7d91 a526 2f23 e142 52ca        .-s.K.}..&/#.BR.
0x0070   2ea9 836a 7671 f542 7d1f 01d7 71b8 fd53        ...jvq.B}...q..S
0x0080   80de 427d 0fde 3421 63c0 1c00 0100 0100        ..B}..4!c.......
0x0090   36ee 8000 04c6 2900 04c4 7f00 0100 0100        6.....).........
0x00a0   36ee 8000 04c0 e44f c9c4 d900 0100 0100        6......O........
0x00b0   36ee 8000 04c0 2104 0cc4 ac00 0100 0100        6.....!.........
0x00c0   36ee 8000 0480 080a 5ac4 9d00 0100 0100        6.......Z.......
0x00d0   36ee 8000 04c0 cbe6 0ac5 1300 0100 0100        6...............
0x00e0   36ee 8000 04c0 0505 f1c4 8e00 0100 0100        6...............
0x00f0   36ee 8000 04c0 7024 04c4 e800 0100 0100        6.....p$........
0x0100   36ee 8000 0480 3f02 35c4 bb00 0100 0100        6.....?.5.......
0x0110   36ee 8000 04c0 2494 11c5 3100 0100 0100        6.....$...1.....
0x0120   36ee 8000 04c0 3a80 1ec4 ca00 0100 0100        6.....:.........
0x0130   36ee 8000 04c1 000e 81c5 2200 0100 0100        6.........".....
0x0140   36ee 8000 04c7 0753 2ac4 f700 0100 0100        6......S*.......
0x0150   36ee 8000 04ca 0c1b 21c0 1c00 1c00 0100        6.......!.......
0x0160   36ee 8000 1020 0105 03ba 3e00 0000 0000        6.........>.....
0x0170   0000 0200 30c5 1300 1c00 0100 36ee 8000        ....0.......6...
0x0180   1020 0105 0000 2f00 0000 0000 0000 0000        ....../.........
0x0190   0fc4 e800 1c00 0100 36ee 8000 1020 0105        ........6.......
0x01a0   0000 0100 0000 0000 0080 3f02 35c5 3100        ..........?.5.1.
0x01b0   1c00 0100 36ee 8000 1020 0105 030c 2700        ....6.........'.
0x01c0   0000 0000 0000 0200 30c4 ca00 1c00 0100        ........0.......
0x01d0   36ee 8000 1020 0107 fd00 0000 0000 0000        6...............
0x01e0   0000 0000 01c5 2200 1c00 0100 36ee 8000        ......".....6...
0x01f0   1020 0105 0000 0300 0000 0000 0000 0000        ................
0x0200   42c4 f700 1c00 0100 36ee 8000 1020 010d        B.......6.......
0x0210   c300 0000 0000 0000 0000 0000 35               ............5
07:45:55.873928 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389400601 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xf44d4]
0x0000   600f 44d4 002c 063f 2001 0470 1f00 0820        `.D..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4d0        .......5.~.5UK..
0x0030   005c 908f b010 804c 3af1 0000 0101 080a        .\.....L:.......
0x0040   8e6b 5c19 0000 0000 0101 050a 005c 9623        .k\..........\.#
0x0050   005c 97f8                                      .\..
07:46:05.575449 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: F 20:20(0) ack 1 win 32844 <nop,nop,timestamp 2389410259 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xf44d4]
0x0000   600f 44d4 002c 063f 2001 0470 1f00 0820        `.D..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4d0        .......5.~.5UK..
0x0030   005c 908f b011 804c 1536 0000 0101 080a        .\.....L.6......
0x0040   8e6b 81d3 0000 0000 0101 050a 005c 9623        .k...........\.#
0x0050   005c 97f8                                      .\..
07:46:05.577626 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: S 3318766951:3318766951(0) win 65535 <mss 1440,nop,wscale 1,nop,nop,timestamp 2389410261 0,sackOK,eol> [flowlabel 0xfc795]
0x0000   600f c795 002c 063f 2001 0470 1f00 0820        `....,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d67        .......5...5..]g
0x0030   0000 0000 b002 ffff 7293 0000 0204 05a0        ........r.......
0x0040   0103 0301 0101 080a 8e6b 81d5 0000 0000        .........k......
0x0050   0402 0000                                      ....
07:46:05.744238 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63358: . ack 21 win 33120 <nop,nop,timestamp 20 0> [flowlabel 0x19e4c]
0x0000   6001 9e4c 0020 063c 2001 0dc3 0000 0000        `..L...<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77e 005c 97f8        .."......5.~.\..
0x0030   554b f4d1 8010 8160 81cf 0000 0101 080a        UK.....`........
0x0040   0000 0014 0000 0000                            ........
07:46:05.748470 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63359: S 352509186:352509186(0) ack 3318766952 win 32768 <mss 1440,nop,wscale 0,nop,nop,timestamp 0 2389410261,sackOK,nop,nop>
0x0000   6000 0000 002c 063c 2001 0dc3 0000 0000        `....,.<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77f 1502 dd02        .."......5......
0x0030   c5d0 5d68 b012 8000 ff7c 0000 0204 05a0        ..]h.....|......
0x0040   0103 0300 0101 080a 0000 0000 8e6b 81d5        .............k..
0x0050   0402 0101                                      ....
07:46:05.749407 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389410433 0> [flowlabel 0xfc795]
0x0000   600f c795 0020 063f 2001 0470 1f00 0820        `......?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d68        .......5...5..]h
0x0030   1502 dd03 8010 804c 3f3c 0000 0101 080a        .......L?<......
0x0040   8e6b 8281 0000 0000                            .k......
07:46:05.750286 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: P 1:20(19) ack 1 win 32844 <nop,nop,timestamp 2389410434 0> 26282+ ANY? . (17) [flowlabel 0xfc795]
0x0000   600f c795 0033 063f 2001 0470 1f00 0820        `....3.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d68        .......5...5..]h
0x0030   1502 dd03 8018 804c d762 0000 0101 080a        .......L.b......
0x0040   8e6b 8282 0000 0000 0011 66aa 0100 0001        .k........f.....
0x0050   0000 0000 0000 0000 ff00 01                    ...........
07:46:05.923048 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63359: P 1429:1898(469) ack 20 win 33120 <nop,nop,timestamp 0 0> 20894 op7 [b2&3=0x3a8b] [61225a] [54612q] [21615n] [63742au] Type256 (Class 256)? C_^[d^NM-^XM-xM-^EM-BM-*-sM-IKM-+}M-^QM-%&/#M-aBRM-J.M-)M-^CjvqM-uB}^_^AM-WqM-8M-}SM-^@M-^B}^OM-^4!cM-@^\^@^A^@^A^@6M-nM-^@^@^DM-F)^@^DM-E^S^@^A^@^A^@6M-nM-^@^@^DM-@M-dOM-IM-DM-^]^@^A^@^A^@6M-nM-^@^@^DM-@!^D^LM-E"^@^A^@^A^@6M-nM-^@^@^DM-^@^H^JZM-D^?^@^A^@^A^@6M-nM-^@^@^DM-@M-KM-f^JM-DM-W^@^A^@^A^@6M-nM-^@^@^DM-@^E^EM-qM-E^D. Type32831 (Class 565)? M-nM-^@^@^DM-@p$^DM-DM-f^@^A^@^A^@6M-nM-^@^@^DM-^@?^B5M-DM-^N^@^A^@^A^@6M-nM-^@^@^DM-@$M-^T^QM-DM-;^@^A^@^A^@6M-nM-^@^@^DM-@:.^^M-DM-,^@^A^@^A^@6M-nM-^@^@^DM-A^@^NM-^AM-DM-u^@^A^@^A^@6M-nM-^@^@^DM-G^GS*M-E1^@^A^@^A^@6M-nM-^@^@^DM-J^L^[!M-@^\^@^\^@^A^@6M-nM-^@^@^P ^A^E^CM-:>^@^@^@^@^@^@^@^B^@0M-DM-W^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@/^@^@^@^@^@^@^@^@^@^OM-DM-f^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@^A^@^@^@^@^@. AAAA? [|domain] [flo
 wlabel 0x659d8]
0x0000   6006 59d8 01f5 063c 2001 0dc3 0000 0000        `.Y....<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77f 1502 e297        .."......5......
0x0030   c5d0 5d7b 8018 8160 c4c2 0000 0101 080a        ..]{...`........
0x0040   0000 0000 0000 0000 1c29 519e 3a8b d554        .........)Q.:..T
0x0050   ef29 546f f8fe 9443 5f1b 640e 98f8 85c2        .)To...C_.d.....
0x0060   aa2d 73c9 4bab 7d91 a526 2f23 e142 52ca        .-s.K.}..&/#.BR.
0x0070   2ea9 836a 7671 f542 7d1f 01d7 71b8 fd53        ...jvq.B}...q..S
0x0080   80de 427d 0fde 3421 63c0 1c00 0100 0100        ..B}..4!c.......
0x0090   36ee 8000 04c6 2900 04c5 1300 0100 0100        6.....).........
0x00a0   36ee 8000 04c0 e44f c9c4 9d00 0100 0100        6......O........
0x00b0   36ee 8000 04c0 2104 0cc5 2200 0100 0100        6.....!...".....
0x00c0   36ee 8000 0480 080a 5ac4 7f00 0100 0100        6.......Z.......
0x00d0   36ee 8000 04c0 cbe6 0ac4 d700 0100 0100        6...............
0x00e0   36ee 8000 04c0 0505 f1c5 0400 0100 0100        6...............
0x00f0   36ee 8000 04c0 7024 04c4 e600 0100 0100        6.....p$........
0x0100   36ee 8000 0480 3f02 35c4 8e00 0100 0100        6.....?.5.......
0x0110   36ee 8000 04c0 2494 11c4 bb00 0100 0100        6.....$.........
0x0120   36ee 8000 04c0 3a80 1ec4 ac00 0100 0100        6.....:.........
0x0130   36ee 8000 04c1 000e 81c4 f500 0100 0100        6...............
0x0140   36ee 8000 04c7 0753 2ac5 3100 0100 0100        6......S*.1.....
0x0150   36ee 8000 04ca 0c1b 21c0 1c00 1c00 0100        6.......!.......
0x0160   36ee 8000 1020 0105 03ba 3e00 0000 0000        6.........>.....
0x0170   0000 0200 30c4 d700 1c00 0100 36ee 8000        ....0.......6...
0x0180   1020 0105 0000 2f00 0000 0000 0000 0000        ....../.........
0x0190   0fc4 e600 1c00 0100 36ee 8000 1020 0105        ........6.......
0x01a0   0000 0100 0000 0000 0080 3f02 35c4 bb00        ..........?.5...
0x01b0   1c00 0100 36ee 8000 1020 0105 030c 2700        ....6.........'.
0x01c0   0000 0000 0000 0200 30c4 ac00 1c00 0100        ........0.......
0x01d0   36ee 8000 1020 0107 fd00 0000 0000 0000        6...............
0x01e0   0000 0000 01c4 f500 1c00 0100 36ee 8000        ............6...
0x01f0   1020 0105 0000 0300 0000 0000 0000 0000        ................
0x0200   42c5 3100 1c00 0100 36ee 8000 1020 010d        B.1.....6.......
0x0210   c300 0000 0000 0000 0000 0000 35               ............5
07:46:05.924405 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389410608 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xfc795]
0x0000   600f c795 002c 063f 2001 0470 1f00 0820        `....,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d7b        .......5...5..]{
0x0030   1502 dd03 b010 804c 175a 0000 0101 080a        .......L.Z......
0x0040   8e6b 8330 0000 0000 0101 050a 1502 e297        .k.0............
0x0050   1502 e46c                                      ...l
07:46:15.616411 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: F 20:20(0) ack 1 win 32844 <nop,nop,timestamp 2389420262 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xfc795]
0x0000   600f c795 002c 063f 2001 0470 1f00 0820        `....,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d7b        .......5...5..]{
0x0030   1502 dd03 b011 804c f1a2 0000 0101 080a        .......L........
0x0040   8e6b a8e6 0000 0000 0101 050a 1502 e297        .k..............
0x0050   1502 e46c                                      ...l
07:46:15.618366 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: S 3733514252:3733514252(0) win 65535 <mss 1440,nop,wscale 1,nop,nop,timestamp 2389420264 0,sackOK,eol> [flowlabel 0xc5b85]
0x0000   600c 5b85 002c 063f 2001 0470 1f00 0820        `.[..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e80c        .......5...5....
0x0030   0000 0000 b002 ffff a821 0000 0204 05a0        .........!......
0x0040   0103 0301 0101 080a 8e6b a8e8 0000 0000        .........k......
0x0050   0402 0000                                      ....
07:46:15.788094 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63359: . ack 21 win 33120 <nop,nop,timestamp 20 0> [flowlabel 0x659d8]
0x0000   6006 59d8 0020 063c 2001 0dc3 0000 0000        `.Y....<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77f 1502 e46c        .."......5.....l
0x0030   c5d0 5d7c 8010 8160 4784 0000 0101 080a        ..]|...`G.......
0x0040   0000 0014 0000 0000                            ........
07:46:15.792142 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63360: S 735268754:735268754(0) ack 3733514253 win 32768 <mss 1440,nop,wscale 0,nop,nop,timestamp 0 2389420264,sackOK,nop,nop>
0x0000   6000 0000 002c 063c 2001 0dc3 0000 0000        `....,.<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f780 2bd3 4f92        .."......5..+.O.
0x0030   de88 e80d b012 8000 abaa 0000 0204 05a0        ................
0x0040   0103 0300 0101 080a 0000 0000 8e6b a8e8        .............k..
0x0050   0402 0101                                      ....
07:46:15.793178 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389420437 0> [flowlabel 0xc5b85]
0x0000   600c 5b85 0020 063f 2001 0470 1f00 0820        `.[....?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e80d        .......5...5....
0x0030   2bd3 4f93 8010 804c eb68 0000 0101 080a        +.O....L.h......
0x0040   8e6b a995 0000 0000                            .k......
07:46:15.794056 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: P 1:20(19) ack 1 win 32844 <nop,nop,timestamp 2389420438 0> 6208+ ANY? . (17) [flowlabel 0xc5b85]
0x0000   600c 5b85 0033 063f 2001 0470 1f00 0820        `.[..3.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e80d        .......5...5....
0x0030   2bd3 4f93 8018 804c d1f9 0000 0101 080a        +.O....L........
0x0040   8e6b a996 0000 0000 0011 1840 0100 0001        .k.........@....
0x0050   0000 0000 0000 0000 ff00 01                    ...........
07:46:15.971558 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63360: P 1429:1898(469) ack 20 win 33120 <nop,nop,timestamp 0 0> 20894 op7 [b2&3=0x3a8b] [61225a] [54612q] [21615n] [63742au] Type256 (Class 256)? C_^[d^NM-^XM-xM-^EM-BM-*-sM-IKM-+}M-^QM-%&/#M-aBRM-J.M-)M-^CjvqM-uB}^_^AM-WqM-8M-}SM-^@M-^B}^OM-^4!cM-@^\^@^A^@^A^@6M-nM-^@^@^DM-F)^@^DM-E^D^@^A^@^A^@6M-nM-^@^@^DM-@M-dOM-IM-DM-^N^@^A^@^A^@6M-nM-^@^@^DM-@!^D^LM-DM-f^@^A^@^A^@6M-nM-^@^@^DM-^@^H^JZM-DM-H^@^A^@^A^@6M-nM-^@^@^DM-@M-KM-f^JM-E1^@^A^@^A^@6M-nM-^@^@^DM-@^E^EM-qM-D^?. Type32831 (Class 565)? M-nM-^@^@^DM-@p$^DM-DM-u^@^A^@^A^@6M-nM-^@^@^DM-^@?^B5M-DM-9^@^A^@^A^@6M-nM-^@^@^DM-@$M-^T^QM-DM-*^@^A^@^A^@6M-nM-^@^@^DM-@:.^^M-E"^@^A^@^A^@6M-nM-^@^@^DM-A^@^NM-^AM-DM-W^@^A^@^A^@6M-nM-^@^@^DM-G^GS*M-E^S^@^A^@^A^@6M-nM-^@^@^DM-J^L^[!M-@^\^@^\^@^A^@6M-nM-^@^@^P ^A^E^CM-:>^@^@^@^@^@^@^@^B^@0M-E1^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@/^@^@^@^@^@^@^@^@^@^OM-DM-u^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@^A^@^@^@^@^@. AAAA? [|domain] [flowla
 bel 0x78f40]
0x0000   6007 8f40 01f5 063c 2001 0dc3 0000 0000        `..@...<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f780 2bd3 5527        .."......5..+.U'
0x0030   de88 e820 8018 8160 df02 0000 0101 080a        .......`........
0x0040   0000 0000 0000 0000 1c29 519e 3a8b d554        .........)Q.:..T
0x0050   ef29 546f f8fe 9443 5f1b 640e 98f8 85c2        .)To...C_.d.....
0x0060   aa2d 73c9 4bab 7d91 a526 2f23 e142 52ca        .-s.K.}..&/#.BR.
0x0070   2ea9 836a 7671 f542 7d1f 01d7 71b8 fd53        ...jvq.B}...q..S
0x0080   80de 427d 0fde 3421 63c0 1c00 0100 0100        ..B}..4!c.......
0x0090   36ee 8000 04c6 2900 04c5 0400 0100 0100        6.....).........
0x00a0   36ee 8000 04c0 e44f c9c4 8e00 0100 0100        6......O........
0x00b0   36ee 8000 04c0 2104 0cc4 e600 0100 0100        6.....!.........
0x00c0   36ee 8000 0480 080a 5ac4 c800 0100 0100        6.......Z.......
0x00d0   36ee 8000 04c0 cbe6 0ac5 3100 0100 0100        6.........1.....
0x00e0   36ee 8000 04c0 0505 f1c4 7f00 0100 0100        6...............
0x00f0   36ee 8000 04c0 7024 04c4 f500 0100 0100        6.....p$........
0x0100   36ee 8000 0480 3f02 35c4 b900 0100 0100        6.....?.5.......
0x0110   36ee 8000 04c0 2494 11c4 aa00 0100 0100        6.....$.........
0x0120   36ee 8000 04c0 3a80 1ec5 2200 0100 0100        6.....:...".....
0x0130   36ee 8000 04c1 000e 81c4 d700 0100 0100        6...............
0x0140   36ee 8000 04c7 0753 2ac5 1300 0100 0100        6......S*.......
0x0150   36ee 8000 04ca 0c1b 21c0 1c00 1c00 0100        6.......!.......
0x0160   36ee 8000 1020 0105 03ba 3e00 0000 0000        6.........>.....
0x0170   0000 0200 30c5 3100 1c00 0100 36ee 8000        ....0.1.....6...
0x0180   1020 0105 0000 2f00 0000 0000 0000 0000        ....../.........
0x0190   0fc4 f500 1c00 0100 36ee 8000 1020 0105        ........6.......
0x01a0   0000 0100 0000 0000 0080 3f02 35c4 aa00        ..........?.5...
0x01b0   1c00 0100 36ee 8000 1020 0105 030c 2700        ....6.........'.
0x01c0   0000 0000 0000 0200 30c5 2200 1c00 0100        ........0.".....
0x01d0   36ee 8000 1020 0107 fd00 0000 0000 0000        6...............
0x01e0   0000 0000 01c4 d700 1c00 0100 36ee 8000        ............6...
0x01f0   1020 0105 0000 0300 0000 0000 0000 0000        ................
0x0200   42c5 1300 1c00 0100 36ee 8000 1020 010d        B.......6.......
0x0210   c300 0000 0000 0000 0000 0000 35               ............5
07:46:15.972853 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389420617 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xc5b85]
0x0000   600c 5b85 002c 063f 2001 0470 1f00 0820        `.[..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e820        .......5...5....
0x0030   2bd3 4f93 b010 804c b0c0 0000 0101 080a        +.O....L........
0x0040   8e6b aa49 0000 0000 0101 050a 2bd3 5527        .k.I........+.U'
0x0050   2bd3 56fc                                      +.V.
07:46:25.667682 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: F 20:20(0) ack 1 win 32844 <nop,nop,timestamp 2389430265 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xc5b85]
0x0000   600c 5b85 002c 063f 2001 0470 1f00 0820        `.[..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e820        .......5...5....
0x0030   2bd3 4f93 b011 804c 8b0f 0000 0101 080a        +.O....L........
0x0040   8e6b cff9 0000 0000 0101 050a 2bd3 5527        .k..........+.U'
0x0050   2bd3 56fc                                      +.V.
07:46:25.835751 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63360: . ack 21 win 33120 <nop,nop,timestamp 20 0> [flowlabel 0x78f40]
0x0000   6007 8f40 0020 063c 2001 0dc3 0000 0000        `..@...<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f780 2bd3 56fc        .."......5..+.V.
0x0030   de88 e821 8010 8160 1ac5 0000 0101 080a        ...!...`........
0x0040   0000 0014 0000 0000                            ........
^C
27 packets received by filter
0 packets dropped by kernel

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]