From: Roy Arends <roy@dnss.ec>
Message-Id: <5436F9FD-6AD7-4A5E-B1C5-D71C05006F72@dnss.ec>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_75A56711-CDF6-4DC5-B2B4-231E557ED2AB"
Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3251\))
Date: Wed, 9 Nov 2016 13:11:46 +0000
In-Reply-To: <09AE92A3-FE49-47CC-A52F-6334DD64D810@powerdns.com>
To: Peter van Dijk <peter.van.dijk@powerdns.com>
References: <20161012193813.vkyhvumdjdsufyj2@mycre.ws>
 <09AE92A3-FE49-47CC-A52F-6334DD64D810@powerdns.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/ia4X7dKDNQReY_bCEfz9jVl1wgo>
Cc: dnsop@ietf.org
Subject: Re: [DNSOP] status opcode?
Precedence: list


--Apple-Mail=_75A56711-CDF6-4DC5-B2B4-231E557ED2AB
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


> On 9 Nov 2016, at 12:01, Peter van Dijk <peter.van.dijk@powerdns.com> =
wrote:
>=20
> Hello Robert,
>=20
> On 12 Oct 2016, at 21:38, Robert Edmonds wrote:
>=20
>> What are status queries? Were they ever defined? Are they obsolete?
>=20
> I have been unable to find a definition, and I tried quite hard =
earlier this year when a customer complained we were not handling them! =
Some VOIP equipment that shall remain unnamed needed to do ENUM queries, =
but only after a successful =E2=80=98health check=E2=80=99.
>=20
> The health check looked like this (sorry, don=E2=80=99t have the pcap =
handy, just this summary):
> ID 0
> flags all zero except for the rcode=3D2
> all counts zero
> 6 trailing NUL bytes
>=20
> Once pdns_server started responding NOTIMP, instead of dropping the =
query, the equipment was happy.

Argus system and network monitoring software [1] sends DNS status =
requests.

If you look at [2], it states:

"UDP/DNS sends a 'status-query', UDP/DNSQ sends an 'IN ANY' query. some =
DNS servers (notably djbdns) do not handle 'status' queries.=E2=80=9D

On the wire, it is an apparently random identifier, that doesn=E2=80=99t =
change between queries and only contains a 12 byte DNS header, opcode 2, =
rcode 0, all bits and counters 0.

Hope this helps

Warmly,

Roy

[1] http://argus.tcp4me.com/ <http://argus.tcp4me.com/>
[2] http://argus.tcp4me.com/services.html =
<http://argus.tcp4me.com/services.html>=

--Apple-Mail=_75A56711-CDF6-4DC5-B2B4-231E557ED2AB
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div =
class=3D"">On 9 Nov 2016, at 12:01, Peter van Dijk &lt;<a =
href=3D"mailto:peter.van.dijk@powerdns.com" =
class=3D"">peter.van.dijk@powerdns.com</a>&gt; wrote:</div><br =
class=3D"Apple-interchange-newline"><div class=3D""><div class=3D"">Hello =
Robert,<br class=3D""><br class=3D"">On 12 Oct 2016, at 21:38, Robert =
Edmonds wrote:<br class=3D""><br class=3D""><blockquote type=3D"cite" =
class=3D"">What are status queries? Were they ever defined? Are they =
obsolete?<br class=3D""></blockquote><br class=3D"">I have been unable =
to find a definition, and I tried quite hard earlier this year when a =
customer complained we were not handling them! Some VOIP equipment that =
shall remain unnamed needed to do ENUM queries, but only after a =
successful =E2=80=98health check=E2=80=99.<br class=3D""><br =
class=3D"">The health check looked like this (sorry, don=E2=80=99t have =
the pcap handy, just this summary):<br class=3D"">ID 0<br class=3D"">flags=
 all zero except for the rcode=3D2<br class=3D"">all counts zero<br =
class=3D"">6 trailing NUL bytes<br class=3D""><br class=3D"">Once =
pdns_server started responding NOTIMP, instead of dropping the query, =
the equipment was happy.</div></div></blockquote><br =
class=3D""></div><div>Argus system and network monitoring software [1] =
sends DNS status requests.</div><div><br class=3D""></div><div>If you =
look at [2], it states:</div><div><br class=3D""></div><div>"UDP/DNS =
sends a 'status-query', UDP/DNSQ sends an 'IN ANY' query. some DNS =
servers (notably djbdns) do not handle 'status' =
queries.=E2=80=9D</div><div><br class=3D""></div><div>On the wire, it is =
an apparently random identifier, that doesn=E2=80=99t change between =
queries and only contains a 12 byte DNS header, opcode 2, rcode 0, all =
bits and counters 0.</div><div><br class=3D""></div><div>Hope this =
helps</div><div><br class=3D""></div><div>Warmly,</div><div><br =
class=3D""></div><div>Roy</div><div><br class=3D""></div><div>[1]&nbsp;<a =
href=3D"http://argus.tcp4me.com/" =
class=3D"">http://argus.tcp4me.com/</a></div><div>[2]&nbsp;<a =
href=3D"http://argus.tcp4me.com/services.html" =
class=3D"">http://argus.tcp4me.com/services.html</a></div></body></html>=

--Apple-Mail=_75A56711-CDF6-4DC5-B2B4-231E557ED2AB--