TCP Query Problem

[InterNetworX | Hostmaster]

Hello,

we're running PowerDNS since a long time. Usaly TCP queries are working,
only from time to time we need to restart PowerDNS if it stops.

But today, we did not changed anything, no more TCP queries are
possible. If we restart, only one query is possible, then it stops working.

$ /etc/init.d/pdns restart
Restarting PowerDNS authoritative nameserver: stopping and waiting..done
Starting PowerDNS authoritative nameserver: started

$ dig NS domain.fr @ns.abc.de +short +tcp
ns.abc.de.
ns2.abc.de.
ns3.abc.de.

$ dig NS domain.fr @ns.abc.de +short +tcp

; <<>> DiG 9.4.3-P1 <<>> NS domain.fr @ns.abc.de +short +tcp
;; global options:  printcmd
;; connection timed out; no servers could be reached

$ pdns_server --version
Version: 2.9.22, compiled on Mar 10 2009, 12:13:17 with gcc version 4.3.2

In pdns.conf we hade the configuration:

disable-tcp=no

Now I tried to set:

max-tcp-connections=300

But nothing changed.

The stats shows:

tcp-answers 1 Number of answers sent out over TCP
tcp-queries 1 Number of TCP queries received

I already found some other people with the same problem but no solution.
Any idea?

Thanks

Mario

_______________________________________________
Pdns-users mailing list
Pdns-users@...
http://mailman.powerdns.com/mailman/listinfo/pdns-users

[bert hubert-2]

On Thu, Jul 16, 2009 at 10:48 AM,
InterNetworX|Hostmaster<hostmaster@...> wrote:
> Hello,
>
> we're running PowerDNS since a long time. Usaly TCP queries are working,
> only from time to time we need to restart PowerDNS if it stops.

Hello "InterNetwoX|Hostmaster",

Thank you for your report.

Can you run PowerDNS with 'query-logging=yes' and copy the backend
query it reports?

Can you then run that query in your backend and see what it returns?

Which backend do you use?

Thanks!
_______________________________________________
Pdns-users mailing list
Pdns-users@...
http://mailman.powerdns.com/mailman/listinfo/pdns-users

[Florian Weimer-2]

* InterNetworX:

> I already found some other people with the same problem but no solution.
> Any idea?

What does "netstat -an | grep :53" show?

Do you see anomalous TCP traffic to the affected servers?

--
Florian Weimer                <fweimer@...>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]
_______________________________________________
Pdns-users mailing list
Pdns-users@...
http://mailman.powerdns.com/mailman/listinfo/pdns-users

[InterNetworX | Hostmaster]

Hi,

I have 769 lines with status SYN_RECV.

I don't see more traffic on our switch interface.

Mario
--

InterNetworX Ltd. & Co. KG
Tempelhofer Damm 140
12099 Berlin
Germany

Phone [phone]
Fax [phone]

support@...
www.inwx.de

Registergericht: Amtsgericht Berlin-Charlottenburg, HRA 36889 B
Gesellschafter: Mario Peschel
USt-IdNr.: DE814537105

Florian Weimer schrieb:
> * InterNetworX:
>
>> I already found some other people with the same problem but no solution.
>> Any idea?
>
> What does "netstat -an | grep :53" show?
>
> Do you see anomalous TCP traffic to the affected servers?
>
_______________________________________________
Pdns-users mailing list
Pdns-users@...
http://mailman.powerdns.com/mailman/listinfo/pdns-users

[InterNetworX | Hostmaster]

Hi again,

it looks like that this helps:

echo 1 >/proc/sys/net/ipv4/tcp_syncookies

Thanks for the netstat hint.

Mario
--

InterNetworX Ltd. & Co. KG
Tempelhofer Damm 140
12099 Berlin
Germany

Phone [phone]
Fax [phone]

support@...
www.inwx.de

Registergericht: Amtsgericht Berlin-Charlottenburg, HRA 36889 B
Gesellschafter: Mario Peschel
USt-IdNr.: DE814537105

Florian Weimer schrieb:
> * InterNetworX:
>
>> I already found some other people with the same problem but no solution.
>> Any idea?
>
> What does "netstat -an | grep :53" show?
>
> Do you see anomalous TCP traffic to the affected servers?
>
_______________________________________________
Pdns-users mailing list
Pdns-users@...
http://mailman.powerdns.com/mailman/listinfo/pdns-users

[Florian Weimer-2]

* InterNetworX:

> it looks like that this helps:
>
> echo 1 >/proc/sys/net/ipv4/tcp_syncookies
>
> Thanks for the netstat hint.

Not really, it's consistent with PowerDNS only accept()ing a single
connection.

The next step probably is looking at "strace -f -p SERVER-PID" output
(or what your local truss/strace equivalent is called), although the
interesting messages will probably be lost in the noise caused by
processing UDP queries.

--
Florian Weimer                <fweimer@...>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]
_______________________________________________
Pdns-users mailing list
Pdns-users@...
http://mailman.powerdns.com/mailman/listinfo/pdns-users