[Cerowrt-devel] Problems with DNSsec on Comcast, with Cero 3.10.38-1/DNSmasq 4-26-2014
dave.taht at gmail.com
Mon Apr 28 14:37:42 EDT 2014
I have put a link up to two of jim's captures going to test-ipv6 via cero,
one with dnssec enabled, captured at the local laptop
definately a lot of missing responses when captured at this end. the local
laptop is using a local dnsmasq forwarder.
It is falling back to trying a recursive lookup on the default domain (
ipv6.test-ipv6.com.home.lan ) - which it does do a nxdomain for
On Mon, Apr 28, 2014 at 10:03 AM, Dave Taht <dave.taht at gmail.com> wrote:
> On Mon, Apr 28, 2014 at 9:55 AM, Jim Gettys <jg at freedesktop.org> wrote:
>> Comcast recently lit up IPv6 native dual stack in the Boston area.
>> The http://test-ipv6.com/ web site complains about DNS problems unless
>> dnssec is disabled; if it is, I get various timeouts.
> Test with IPv4 DNS record
>> ok (4.196s)
>> Test with IPv6 DNS record
>> ok (0.115s) using ipv6
>> Test with Dual Stack DNS record
>> timeout (11.882s)
> I don't know what this test does. try a local query over ipv6?
> Test for Dual Stack DNS and large packet
>> timeout (11.817s)
>> Test IPv4 without DNS
>> ok (0.214s) using ipv4
>> Test IPv6 without DNS
>> ok (0.204s) using ipv6
>> Test IPv6 large packet
>> ok (0.120s) using ipv6
>> Test if your ISP's DNS server uses IPv6
>> slow (8.752s)
>> Find IPv4 Service Provider
>> timeout (11.968s)
>> Find IPv6 Service Provider
>> ok (0.126s) using ipv6 ASN 7922
>> Test for buggy DNS
>> undefined (5.003s)
>> DNS server addresses look reasonable for Comcast.
>> DNS 1: 188.8.131.52
>> DNS 2: 184.108.40.206
> To try to isolate things a little bit, you can turn off fetching ipv4
> dns servers
> option peerdns '0'
> in the wan (ge00) stanza of /etc/config/network
> and let the wan6 stanza fetch them.
> A packet capture of it working vs not working would be good.
> tcpdump -i ge00 -w cap1.cap port 53
> Also capture on the local interface.
> DNS 1: 2001:558:feed::1
>> DNS 2: 2001:558:feed::2
>> Today, the problem seems consistent with turning dnssec on and off on the
>> router. If enabled, I have problems; if disabled, I get a clean bill of
>> health out of test-ipv6.com.
>> - Jim
>> Cerowrt-devel mailing list
>> Cerowrt-devel at lists.bufferbloat.net
> Dave Täht
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Cerowrt-devel