Re: Any GNU/Linux Gurus. Need Help
Marc Haber <[email protected]>
| Newsgroups | comp.os.linux.misc |
|---|---|
| Organization | private site, see http://www.zugschlus.de/ for details |
| Message-ID | <[email protected]> |
Richard Kettlewell <[email protected]> wrote: >Leroy H <[email protected]> writes: >> The same message occurs many times: >> >> IP 192.168.0.2 > c.in-addr-servers.arpa: ICMP 192.168.0.2 udp port >> xxxxx unreachable >> >> 192.168.0.2 is the address of my machine on the LAN. >> >> Unfortunately, I am not at all versed in network programming but the >> response "192.168.0.2 > c.in-addr-servers.arpa" seems to indicate that >> my machine is telling the nameserver that the (local?) UDP port is >> unreachable. > >Yes. 192.168.0.2 is rejecting the replies to the DNS queries it issued. > >It’s consistent with a misconfigured local firewall. It's regular behavior of Linux xtables. I don't know whether this behavior also happens with the later nftables backend, but it has something to do with the UDP state machine that is implemented with the ESTABLISHED, RELATED packet classifications. I am far from being sure, but I most often see this on high-latency links like cell data when the answer comes like 20 seconds after the query (when the connection tracking entry might already timed out). Another hypothesis is that the local resolver queries multiple servers, takes the quickest answer and then rejects the remaining answers. But I think that might be unreasonable, why would the software actively reject the answer instead of silently dropping it on the floor. I never investigated that in depth. Greetings Marc P.S.: Oh, yes, and please, alwas run tcpdump with -np. -- ---------------------------------------------------------------------------- Marc Haber | " Questions are the | Mailadresse im Header Rhein-Neckar, DE | Beginning of Wisdom " | Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 6224 1600402