Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256996

Re: apt temporary failure resolving deb.debian.org

From Tim Woodall <debianuser@woodall.me.uk>
Newsgroups linux.debian.user
Subject Re: apt temporary failure resolving deb.debian.org
Date 2023-04-10 06:30 +0200
Message-ID <GiRkd-10xt-1@gated-at.bofh.it> (permalink)
References <GiF9n-SNn-7@gated-at.bofh.it> <GiIqB-UKg-9@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Sun, 9 Apr 2023, Andy Smith wrote:

> Hi Badli,
>
> On Sun, Apr 09, 2023 at 07:59:32AM +0000, Badli Al Rashid wrote:
>> I got a temporary failure resolving deb.debian.org and
>> www.debian.org since last week thursday. I can resolve other sites
>> like www.kernel.org and others.
>>
Broke last monday for me.

>> When I switch to other DNS servers I can resolve www.debian.org.
>
> Any clue in the logs of your bind9 resolver?
>
> If you are able to install "delv", what does that say?
>
> $ delv -t cname deb.debian.org
> ; fully validated
> deb.debian.org.         3567    IN      CNAME   debian.map.fastlydns.net.
> deb.debian.org.         3567    IN      RRSIG   CNAME 8 3 3600 20230512040858 20230402034640 32728 debian.org. rFqk+TkAJPOXTbQl8irQJyMGjsL8yXMxFgxglzGC+7GaydpbQGEYaiOE FLHKy4dPshKq0pq5O8l+hw/gG3dgWg+fYkskltkGJyk8VNBnbgTM3Szm M2QjRR7x7hKitr61YrUkVCpZCroiKtZfat/0l42EWV24FewvatX9mBge VYzlUSrOchLHC7TjBOpxyA7Ta6ll4YIDDgMSZi4HxMMhjPdzGs2H/o8D CrKUmSE9VBhRoclczsBbMENUftKR0XOl
>
> It does seem like your ;local resolver is at fault when it comes to
> DNSSEC.
>
> Cheers,
> Andy
>
>

I suspect some weird pmtu issue or something like that

root@bind17:/etc/bind# delv -t cname www.microsoft.com  +rtrace
;; fetch: www.microsoft.com/CNAME
;; fetch: com/DS
;; fetch: ./DNSKEY
;; fetch: microsoft.com/DS
;; fetch: com/DNSKEY
; unsigned answer
www.microsoft.com.      2858    IN      CNAME
www.microsoft.com-c-3.edgekey.net.
root@bind17:/etc/bind# delv -t cname deb.debian.org +rtrace
;; fetch: deb.debian.org/CNAME
;; fetch: debian.org/DNSKEY
;; resolution failed: timed out
root@bind17:/etc/bind#

And here's the really weird bit: that was with bind using google as
forwarders but...

root@bind17:/etc/bind# delv -6 -t cname deb.debian.org +rtrace @2001:4860:4860::8888
;; fetch: deb.debian.org/CNAME
;; fetch: debian.org/DNSKEY
;; fetch: debian.org/DS
;; fetch: org/DNSKEY
;; fetch: org/DS
;; fetch: ./DNSKEY
; fully validated
deb.debian.org.         3284    IN      CNAME
debian.map.fastlydns.net.
deb.debian.org.         3284    IN      RRSIG   CNAME 8 3 3600
20230512040858 20230402034640 32728 debian.org.
rFqk+TkAJPOXTbQl8irQJyMGjsL8yXMxFgxglzGC+7GaydpbQGEYaiOE
FLHKy4dPshKq0pq5O8l+hw/gG3dgWg+fYkskltkGJyk8VNBnbgTM3Szm
M2QjRR7x7hKitr61YrUkVCpZCroiKtZfat/0l42EWV24FewvatX9mBge
VYzlUSrOchLHC7TjBOpxyA7Ta6ll4YIDDgMSZi4HxMMhjPdzGs2H/o8D
CrKUmSE9VBhRoclczsBbMENUftKR0XOl
root@bind17:/etc/bind#


firewall17:~# tcpdump -n -i isp port 53
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on isp, link-type EN10MB (Ethernet), snapshot length 262144 bytes
03:24:02.676837 IP6 ****:****:****:**00::1.50280 > 2001:4860:4860::8888.53: 27939+% [1au] DNSKEY? debian.org. (51)
03:24:02.686347 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.50280: 27939| 0/0/1 (39)
03:24:02.687485 IP6 ****:****:****:**00::1.59395 > 2001:4860:4860::8888.53: Flags [S], seq 2532653124, win 64660, options [mss 1220,sackOK,TS val 1661813206 ecr 0,nop,wscale 5], length 0
03:24:02.697849 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.59395: Flags [S.], seq 2779959628, ack 2532653125, win 65535, options [mss 1440,sackOK,TS val 1178061358 ecr 1661813206,nop,wscale 8], length 0
03:24:02.698472 IP6 ****:****:****:**00::1.59395 > 2001:4860:4860::8888.53: Flags [.], ack 1, win 2021, options [nop,nop,TS val 1661813217 ecr 1178061358], length 0
03:24:02.698840 IP6 ****:****:****:**00::1.59395 > 2001:4860:4860::8888.53: Flags [P.], seq 1:54, ack 1, win 2021, options [nop,nop,TS val 1661813217 ecr 1178061358], length 53 16359+% [1au] DNSKEY? debian.org. (51)
03:24:02.708023 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.59395: Flags [.], ack 54, win 256, options [nop,nop,TS val 1178061368 ecr 1661813217], length 0
03:24:04.707378 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.59395: Flags [F.], seq 1636, ack 54, win 256, options [nop,nop,TS val 1178063367 ecr 1661813217], length 0
03:24:04.708333 IP6 ****:****:****:**00::1.59395 > 2001:4860:4860::8888.53: Flags [.], ack 1, win 2021, options [nop,nop,TS val 1661815227 ecr 1178061368,nop,nop,sack 1 {1636:1637}], length 0
03:24:07.698316 IP6 ****:****:****:**00::1.59395 > 2001:4860:4860::8888.53: Flags [F.], seq 54, ack 1, win 2021, options [nop,nop,TS val 1661818217 ecr 1178061368,nop,nop,sack 1 {1636:1637}], length 0
03:24:07.708269 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.59395: Flags [.], ack 55, win 256, options [nop,nop,TS val 1178066368 ecr 1661818217], length 0

The result isn't getting back to me. Google shuts down the connection after 2 seconds.


And here's talking to google directly

firewall17:/etc/firewall# tcpdump -n -i isp port 53
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on isp, link-type EN10MB (Ethernet), snapshot length 262144 bytes
03:56:29.290782 IP6 ****:****:****:**00::1.48805 > 2001:4860:4860::8888.53: Flags [S], seq 3069515386, win 64660, options [mss 1220,sackOK,TS val 1663759806 ecr 0,nop,wscale 5], length 0
03:56:29.301791 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.48805: Flags [S.], seq 3127336889, ack 3069515387, win 65535, options [mss 1440,sackOK,TS val 3496932498 ecr 1663759806,nop,wscale 8], length 0
03:56:29.302332 IP6 ****:****:****:**00::1.48805 > 2001:4860:4860::8888.53: Flags [.], ack 1, win 2021, options [nop,nop,TS val 1663759818 ecr 3496932498], length 0
03:56:29.302809 IP6 ****:****:****:**00::1.48805 > 2001:4860:4860::8888.53: Flags [P.], seq 1:58, ack 1, win 2021, options [nop,nop,TS val 1663759818 ecr 3496932498], length 57 21502+ [1au] CNAME? deb.debian.org. (55)
03:56:29.311208 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.48805: Flags [.], ack 58, win 256, options [nop,nop,TS val 3496932508 ecr 1663759818], length 0
03:56:29.321544 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.48805: Flags [P.], seq 1:318, ack 58, win 256, options [nop,nop,TS val 3496932518 ecr 1663759818], length 317 21502$ 2/0/1 CNAME debian.map.fastlydns.net., RRSIG (315)
03:56:29.322083 IP6 ****:****:****:**00::1.48805 > 2001:4860:4860::8888.53: Flags [.], ack 318, win 2012, options [nop,nop,TS val 1663759838 ecr 3496932518], length 0
03:56:29.323547 IP6 ****:****:****:**00::1.48805 > 2001:4860:4860::8888.53: Flags [F.], seq 58, ack 318, win 2012, options [nop,nop,TS val 1663759839 ecr 3496932518], length 0
03:56:29.324299 IP6 ****:****:****:**00::1.37914 > 2001:4860:4860::8888.53: 43433+ [1au] DNSKEY? debian.org. (51)
03:56:29.331043 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.48805: Flags [F.], seq 318, ack 59, win 256, options [nop,nop,TS val 3496932528 ecr 1663759839], length 0
03:56:29.331613 IP6 ****:****:****:**00::1.48805 > 2001:4860:4860::8888.53: Flags [.], ack 319, win 2012, options [nop,nop,TS val 1663759847 ecr 3496932528], length 0
03:56:29.350983 IP6 ****:****:****:**00::1.37914 > 2001:4860:4860::8888.53: 18553+ [1au] DS? debian.org. (51)
03:56:29.371792 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.37914: 18553$ 2/0/1 DS, RRSIG (250)
03:56:29.374031 IP6 ****:****:****:**00::1.37914 > 2001:4860:4860::8888.53: 49374+ [1au] DNSKEY? org. (44)
03:56:29.383446 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.37914: 49374$ 4/0/1 DNSKEY, DNSKEY, DNSKEY, RRSIG (895)
03:56:29.385886 IP6 ****:****:****:**00::1.37914 > 2001:4860:4860::8888.53: 34706+ [1au] DS? org. (44)
03:56:29.395551 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.37914: 34706$ 2/0/1 DS, RRSIG (367)
03:56:29.397514 IP6 ****:****:****:**00::1.37914 > 2001:4860:4860::8888.53: 17976+ [1au] DNSKEY? . (40)
03:56:29.407502 IP6 2001:4860:4860::8888.53 > ****:****:****:**00::1.37914: 17976$ 4/0/1 DNSKEY, DNSKEY, DNSKEY, RRSIG (1139)
^C
19 packets captured
19 packets received by filter
0 packets dropped by kernel
firewall17:/etc/firewall#

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: apt temporary failure resolving deb.debian.org Andy Smith <andy@strugglers.net> - 2023-04-09 21:00 +0200
  Re: apt temporary failure resolving deb.debian.org Tim Woodall <debianuser@woodall.me.uk> - 2023-04-10 06:30 +0200
    Re: apt temporary failure resolving deb.debian.org Tim Woodall <debianuser@woodall.me.uk> - 2023-04-10 19:10 +0200
      Re: apt temporary failure resolving deb.debian.org Tim Woodall <debianuser@woodall.me.uk> - 2023-04-11 20:50 +0200

csiph-web