This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Slow DNS queries with parallel requests and ipv6

Hi,

We observe slow dns answers from Sophos dns proxy since the introduction of parallel requests in glibc 2.9. When I take a network trace on the firewall with tcpdump, I can see that Sophos answers only to the first request (ipv4). 5 seconds later, the client sends 2 other requests (sequentially) and Sophos answers to the 2 requests. Here is a trace when I launch "telnet www.sophos.com 80" on a client with a recent glibc :

19:40:15.103081 IP 192.168.23.1.35888 > 192.168.23.254.53: 40569+ A? www.sophos.com. (32)
19:40:15.103131 IP 192.168.23.1.35888 > 192.168.23.254.53: 62436+ AAAA? www.sophos.com. (32)
19:40:15.104087 IP 192.168.23.254.53 > 192.168.23.1.35888: 40569 3/8/8 CNAME www.sophos.com.edgekey.net., CNAME e6203.b.akamaiedge.net., A 172.229.195.18 (393)
19:40:20.107695 IP 192.168.23.1.35888 > 192.168.23.254.53: 40569+ A? www.sophos.com. (32)
19:40:20.122838 IP 192.168.23.254.53 > 192.168.23.1.35888: 40569 3/8/8 CNAME www.sophos.com.edgekey.net., CNAME e6203.b.akamaiedge.net., A 2.21.3.18 (393)
19:40:20.126727 IP 192.168.23.1.35888 > 192.168.23.254.53: 62436+ AAAA? www.sophos.com. (32)
19:40:20.127196 IP 192.168.23.254.53 > 192.168.23.1.35888: 62436 2/1/0 CNAME www.sophos.com.edgekey.net., CNAME e6203.b.akamaiedge.net. (163)

I found a workaround by adding these line in /etc/resolv.conf on the client :

options single-request

options single-request-reopen

.

But I would like to find a generic solution to apply on the firewall (I have the same problem on multiple firewalls with different customers).

I wonder why I'm the only one to speak about this problem (I didn't find any thread speaking about this problem).

Thanks,
Nicolas

This thread was automatically locked due to age.

Parents

0 UrsWeiss over 11 years ago

Ha ha, funny, the mail you linked to is from Ulrich and he is working for Astaro since many many years! Already had contact with him myself some time ago. He's a great software engineer ;-)
Cancel
Vote Up 0 Vote Down

Cancel
0 sarabanjina over 11 years ago in reply to UrsWeiss
Hi,

Based on the previous message I posted, I made a quick test on my UTM : I disabled completely connection tracking on port 53 with these commands :
iptables -t raw -I PREROUTING -p udp --destination-port=53 -j LOCAL_TRAFFIC
iptables -t raw -I PREROUTING -p udp --source-port=53 -j LOCAL_TRAFFIC
iptables -t raw -I OUTPUT -p udp --destination-port=53 -j LOCAL_TRAFFIC
iptables -t raw -I OUTPUT -p udp --source-port=53 -j LOCAL_TRAFFIC

And now everything is working fine (every time):
14:05:23.402808 IP 192.168.23.1.57865 > 192.168.23.254.53: 9401+ A? www.sophos.com. (32)
14:05:23.402875 IP 192.168.23.1.57865 > 192.168.23.254.53: 37400+ AAAA? www.sophos.com. (32)
14:05:23.403729 IP 192.168.23.254.53 > 192.168.23.1.57865: 9401 3/8/8 CNAME www.sophos.com.edgekey.net., CNAME e6203.b.akamaiedge.net., A 23.34.179.18 (393)
14:05:23.403777 IP 192.168.23.254.53 > 192.168.23.1.57865: 37400 2/1/0 CNAME www.sophos.com.edgekey.net., CNAME e6203.b.akamaiedge.net. (163)

I'm almost sure the problem is not related to dns proxy, but on some relation between iptables, connection tracking and nfqueue.

Regards,
Nicolas
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 sarabanjina over 11 years ago in reply to UrsWeiss
Hi,

Based on the previous message I posted, I made a quick test on my UTM : I disabled completely connection tracking on port 53 with these commands :
iptables -t raw -I PREROUTING -p udp --destination-port=53 -j LOCAL_TRAFFIC
iptables -t raw -I PREROUTING -p udp --source-port=53 -j LOCAL_TRAFFIC
iptables -t raw -I OUTPUT -p udp --destination-port=53 -j LOCAL_TRAFFIC
iptables -t raw -I OUTPUT -p udp --source-port=53 -j LOCAL_TRAFFIC

And now everything is working fine (every time):
14:05:23.402808 IP 192.168.23.1.57865 > 192.168.23.254.53: 9401+ A? www.sophos.com. (32)
14:05:23.402875 IP 192.168.23.1.57865 > 192.168.23.254.53: 37400+ AAAA? www.sophos.com. (32)
14:05:23.403729 IP 192.168.23.254.53 > 192.168.23.1.57865: 9401 3/8/8 CNAME www.sophos.com.edgekey.net., CNAME e6203.b.akamaiedge.net., A 23.34.179.18 (393)
14:05:23.403777 IP 192.168.23.254.53 > 192.168.23.1.57865: 37400 2/1/0 CNAME www.sophos.com.edgekey.net., CNAME e6203.b.akamaiedge.net. (163)

I'm almost sure the problem is not related to dns proxy, but on some relation between iptables, connection tracking and nfqueue.

Regards,
Nicolas
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data

Slow DNS queries with parallel requests and ipv6

Submitted a Tech Support Case lately from the Support Portal?