What is dnstracer
dnstracer determines where a given Domain Name Server (DNS) gets its information from, and follows the chain of DNS servers back to the servers which know the data.
Examples
Simple example for www.mavetju.org
[~] edwin@k7>dnstracer www.mavetju.org
Tracing to www.mavetju.org via 127.0.0.1, timeout 15 seconds
127.0.0.1 (127.0.0.1)
|\___ B.ROOT-SERVERS.NET [.] (128.9.0.107)
| |\___ M.GTLD-SERVERS.NET [org] (202.153.114.101)
| | |\___ NS2.SECONDARY.COM [mavetju.org] (198.133.199.4) Got authoritative answer
| | \___ NS1.SECONDARY.COM [mavetju.org] (198.133.199.3) Got authoritative answer
| |\___ E.GTLD-SERVERS.NET [org] (192.12.94.30)
| | |\___ NS2.SECONDARY.COM [mavetju.org] (198.133.199.4) (cached)
| | \___ NS1.SECONDARY.COM [mavetju.org] (198.133.199.3) (cached)
| |\___ K.GTLD-SERVERS.NET [org] (213.177.194.5)
| | |\___ NS2.SECONDARY.COM [mavetju.org] (198.133.199.4) (cached)
| | \___ NS1.SECONDARY.COM [mavetju.org] (198.133.199.3) (cached)
[...]
| \___ A.GTLD-SERVERS.NET [org] (192.5.6.30)
| |\___ NS2.SECONDARY.COM [mavetju.org] (198.133.199.4) (cached)
| \___ NS1.SECONDARY.COM [mavetju.org] (198.133.199.3) (cached)
|\___ F.ROOT-SERVERS.NET [.] (192.5.5.241)
| |\___ M.GTLD-SERVERS.NET [org] (202.153.114.101) (cached)
| |\___ E.GTLD-SERVERS.NET [org] (192.12.94.30) (cached)
| |\___ K.GTLD-SERVERS.NET [org] (213.177.194.5) (cached)
| |\___ J.GTLD-SERVERS.NET [org] (210.132.100.101) (cached)
| |\___ F.GTLD-SERVERS.NET [org] (192.35.51.30) (cached)
[...]
| \___ A.GTLD-SERVERS.NET [org] (192.5.6.30) (cached)
|\___ G.ROOT-SERVERS.NET [.] (192.112.36.4)
| |\___ M.GTLD-SERVERS.NET [org] (202.153.114.101) (cached)
[...]
This trace is done after a clean start of the DNS server. That means that there is no data available, except the zones the server is authoritive for and the root-servers.
This DNS server doesn't know anything about mavetju.org, so it forwards returns pointers to the root-servers. The root-servers forward us to the global-top-level-domain-servers, the ones which handle for example .com, .org, .net and the country domains.
The zone for mavetju.org is hosted by Secondary.com, and that is the one which is giving us answers. The answers are cached so we don't ask unnecessary requests.
Using a different server to start with
To prevent too much information (the example above would have generated 480 lines output), we can specify a server to start with:
[~] edwin@k7>dnstracer -o -s m.gtld-servers.net www.mavetju.org |
The option -s specifies the server. The name of the server can be replaced by an IP address or with a dot (.) to indicate it should use A.ROOT-SERVERS.NET. The option -o displays an overview of the received answers at the end of the run.
PTR records
PTR records have to be specified the same as `normal' PTR records: either with the .in-addr.arpa or the ip6.int suffix.
[~] edwin@k7>dnstracer -q ptr 1.0.0.127.in-addr.arpa |
SOA records
Are used normally, but they give a somewhat longer output with the serial number, the mname and rname fields.
[~] edwin@k7>dnstracer -q soa -o mavetju.org |
Timeouts and broken servers
[~] edwin@k7>dnstracer -q cname -s M.GTLD-SERVERS.NET fataldimensions.nl.eu.org |
The DNS server ns.eu.org is according to RELAY-1.FTEL.CO.UK authoritive for nl.eu.org, but the server doesn't return any answer records. It does however return authority records in which it has itself in it.
The *'s in the output means that there wasn't an answer on the request. By default there is three retries.
Multiple additional records, or absence of them
If there are no additional records for a DNS server, the IP address is being retrieved via a standard gethostbyname().
If there are multiple additional records for a DNS server they are both tested. For example with munnari.OZ.au:
[~] edwin@k7>dnstracer www.telstra.com.au |
Authoritative and non-authoritative answers
Authoritative answers are answers coming from the server which is authoritative for the zone. If the answer is cached by other servers (which is the nature of the DNS system), then the answer is still valid but non-authoritative.
See also that yalumba.connect.com.au doesn't return an authoritative answer, but it knows the answer. The authoritative answer came from one of the servers below it.
[~] edwin@k7>dnstracer www.telstra.com.au Tracing to www.telstra.com.au via 127.0.0.1, timeout 15 seconds 127.0.0.1 (127.0.0.1) |\___ NS.UU.NET [au] (137.39.1.3) | |\___ yalumba.connect.com.au [com.au] (203.8.183.1) Got answer | | |\___ muwaya.ucs.unimelb.EDU.au [telstra.com.au] (128.250.20.2) Got authoritative answer | | |\___ munnari.OZ.au [telstra.com.au] (128.250.1.21) Got authoritative answer [...]
Back to the General Tools menu
http://www.mavetju.org
Comments
Post a Comment
silahkan tinggalkan komentar yang sopan.
terima kasih