| Summary: | Knot Resolver: Infinite stream of NS queries if it asked twice when the result is NXDOMAIN. | ||
|---|---|---|---|
| Product: | IPFire | Reporter: | Piers Wombwell <piersw> |
| Component: | --- | Assignee: | Assigned to nobody - feel free to grab it and work on it <nobody> |
| Status: | NEW --- | QA Contact: | |
| Severity: | Major Usability | ||
| Priority: | - Unknown - | ||
| Version: | 2 | ||
| Hardware: | x86_64 | ||
| OS: | All | ||
| Attachments: | knot resolver watchdog | ||
|
Description
Piers Wombwell
2026-07-31 00:16:05 UTC
My earlier assumption that this was specific to NXDOMAIN responses was incorrect. I run 20k different lookups overnight, and I've managed to reproduce the problem with the following short list. I'm running a watchdog that counts outbound DNS packets in 10-second windows and restarts Knot Resolver when it enters the runaway state to avoid the IPFire and BT hubs getting in a state. The IPFire runs at 100% CPU without it being restarted. Running the overnight failures manually, I can reliably reproduce failures with the following sites. Each domain has its own threshold, but the threshold is consistent for me. thebuzztube.com – just two lookups reliably trigger the problem (generating 1263 outbound DNS packets in 10s): for i in $(seq 1 2); do dig @192.168.0.1 thebuzztube.com A; done hdonline.vn – twenty lookups (alternating A/AAAA) trigger the problem, and I see 1152 outbound DNS packets in 10s: for i in $(seq 1 10); do dig @192.168.0.1 hdonline.vn A; dig @192.168.0.1 hdonline.vn AAAA; done ksjdfusdjdshfjhsdk.com – ten A lookups trigger the problem (1129 outbound DNS packets in 10s): for i in $(seq 1 10); do dig @192.168.0.1 ksjdfusdjdshfjhsdk.com A; done rojadirectatv.tv – twenty lookups (alternating A/AAAA) trigger the problem (2714 outbound DNS packets in 10s): for i in $(seq 1 10); do dig @192.168.0.1 rojadirectatv.tv A; dig @192.168.0.1 rojadirectatv.tv AAAA; done Created attachment 1740 [details]
knot resolver watchdog
(written by ChatGPT)
|