<div dir="ltr">Hello Moritz, George,<br><div><br></div><div>Thanks for the response.</div><div><br></div><div>Here is what I did after your comments</div><div><br></div><div><b>Setup:</b></div><div>Client(<b>10.0.0.4</b>) -> Unbound <b>10.0.0.6</b>(cache enabled) -> Server(named) <b>10.0.0.240</b><br></div><div><br></div><div>client tested with dig command for <a href="http://mx.dnstest.com">mx.dnstest.com</a> query. this record is having TTL of 31.</div><div>I initially flooded the setup with 3000 requests and then I configured named to return servfail to observe retries behavior.</div><div><b>My question is: "Is it really possible to see exact 5 queries (outbound-msg-retry: 5) going out of unbound" ? and how to validate this feature? </b></div><div><br></div><div>Here are Tcpdump captures:</div><div><br></div><div><b>CLIENT:</b></div><div>[root@host-10-218-23-24:Active:Standalone] config # dig @<a href="http://10.0.0.6">10.0.0.6</a> <a href="http://mx.dnstest.com">mx.dnstest.com</a> MX<br><br>; <<>> DiG 9.11.36 <<>> @<a href="http://10.0.0.6">10.0.0.6</a> <a href="http://mx.dnstest.com">mx.dnstest.com</a> MX<br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 30540<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags:; udp: 1232<br>;; QUESTION SECTION:<br>;<a href="http://mx.dnstest.com">mx.dnstest.com</a>. IN MX<br><br>;; Query time: 3112 msec<br>;; SERVER: 10.0.0.6#53(10.0.0.6)<br>;; WHEN: Wed Jul 27 06:23:30 UTC 2022<br>;; MSG SIZE rcvd: 43<br><br>[root@host-10-218-23-24:Active:Standalone] config #<br></div><div><b>UNBOUND:</b></div>06:23:48.624763 IP 192.168.232.180.domain > 10.218.23.35.37028: 36064 5/0/1 A 54.171.230.55, A 34.243.160.129, A 54.217.10.153, A 34.254.182.186, A 54.247.62.1 (124)<br>06:23:48.624790 IP 192.168.232.180.domain > 10.218.23.35.52430: 17066 5/0/1 AAAA 2a05:d018:91c:3200:2846:99fb:81b6:1e11, AAAA 2a05:d018:91c:3200:c887:2f22:290f:a7c, AAAA 2a05:d018:91c:3200:d8b6:37bc:63f9:703c, AAAA 2a05:d018:91c:3200:5e0d:21a9:26ca:90b5, AAAA 2a05:d018:91c:3200:c8f:1a06:a2dd:450f (184)<br>06:23:48.624820 IP 192.168.232.180.domain > 10.218.23.35.41585: 51456 5/0/1 A 54.247.62.1, A 54.171.230.55, A 34.243.160.129, A 54.217.10.153, A 34.254.182.186 (124)<br>06:23:48.624825 IP 192.168.232.180.domain > 10.218.23.35.43194: 24738 5/0/1 AAAA 2a05:d018:91c:3200:c887:2f22:290f:a7c, AAAA 2a05:d018:91c:3200:d8b6:37bc:63f9:703c, AAAA 2a05:d018:91c:3200:5e0d:21a9:26ca:90b5, AAAA 2a05:d018:91c:3200:c8f:1a06:a2dd:450f, AAAA 2a05:d018:91c:3200:2846:99fb:81b6:1e11 (184)<br>06:23:48.625371 IP clientmachine.novalocal.59871 > 10.0.0.240.domain: 35883+ PTR? 35.23.218.10.in-addr.arpa. (43)<br>06:23:53.630691 IP clientmachine.novalocal.59871 > 10.0.0.240.domain: 35883+ PTR? 35.23.218.10.in-addr.arpa. (43)<br><b>06:24:12.173300 IP 10.0.0.4.62651 > clientmachine.novalocal.domain: 30540+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (55)<br>06:24:12.174582 IP clientmachine.novalocal.8897 > 10.0.0.240.domain: 34128+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:12.225062 IP clientmachine.novalocal.57442 > 10.0.0.240.domain: 59847+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:12.275975 IP clientmachine.novalocal.22614 > 10.0.0.240.domain: 33303+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:12.376605 IP clientmachine.novalocal.50495 > 10.0.0.240.domain: 29263+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:12.477535 IP clientmachine.novalocal.41078 > 10.0.0.240.domain: 64941+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:12.678278 IP clientmachine.novalocal.40026 > 10.0.0.240.domain: 22158+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:12.879194 IP clientmachine.novalocal.63789 > 10.0.0.240.domain: 22982+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:13.280116 IP clientmachine.novalocal.4570 > 10.0.0.240.domain: 16690+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:13.681226 IP clientmachine.novalocal.37294 > 10.0.0.240.domain: 1284+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)<br>06:24:14.482445 IP clientmachine.novalocal.21467 > 10.0.0.240.domain: 38521+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43)</b><br>06:24:15.284316 IP clientmachine.novalocal.domain > 10.0.0.4.62651: 30540 ServFail 0/0/1 (43)<br><div>06:24:27.228645 IP 192.168.232.180.domain > 10.218.20.141.55836: 53616 NXDomain 0/1/0 (112) </div><div><br></div><div><br></div><div><b>NAMED:</b></div><div>06:21:40.024902 IP 10.0.0.6.59871 > 10.0.0.240.53: 35883+ PTR? 35.23.218.10.in-addr.arpa. (43) in slot1/tmm0 lis= port=1.2 trunk=<br>06:21:45.029881 IP 10.0.0.6.59871 > 10.0.0.240.53: 35883+ PTR? 35.23.218.10.in-addr.arpa. (43) in slot1/tmm0 lis= port=1.2 trunk=<br><b>06:22:03.573096 IP 10.0.0.6.8897 > 10.0.0.240.53: 34128+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm1 lis= port=1.2 trunk=<br>06:22:03.623394 IP 10.0.0.6.57442 > 10.0.0.240.53: 59847+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm0 lis= port=1.2 trunk=<br>06:22:03.674324 IP 10.0.0.6.22614 > 10.0.0.240.53: 33303+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm3 lis= port=1.2 trunk=<br>06:22:03.774943 IP 10.0.0.6.50495 > 10.0.0.240.53: 29263+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm0 lis= port=1.2 trunk=<br>06:22:03.875884 IP 10.0.0.6.41078 > 10.0.0.240.53: 64941+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm3 lis= port=1.2 trunk=<br>06:22:04.076611 IP 10.0.0.6.40026 > 10.0.0.240.53: 22158+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm2 lis= port=1.2 trunk=<br>06:22:04.277505 IP 10.0.0.6.63789 > 10.0.0.240.53: 22982+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm2 lis= port=1.2 trunk=<br>06:22:04.678511 IP 10.0.0.6.4570 > 10.0.0.240.53: 16690+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm2 lis= port=1.2 trunk=<br>06:22:05.079457 IP 10.0.0.6.37294 > 10.0.0.240.53: 1284+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm1 lis= port=1.2 trunk=<br>06:22:05.880784 IP 10.0.0.6.21467 > 10.0.0.240.53: 38521+ [1au] MX? <a href="http://mx.dnstest.com">mx.dnstest.com</a>. (43) in slot1/tmm1 lis= port=1.2 trunk=</b><br></div><div><br></div><div>Thanks,</div><div>Ashok</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jun 20, 2022 at 11:06 PM Moritz C. K. U. Schneider via Unbound-users <<a href="mailto:unbound-users@lists.nlnetlabs.nl">unbound-users@lists.nlnetlabs.nl</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello Ashok!<br>
<br>
<br>
Am Donnerstag, den 16.06.2022, 23:08 +0530 schrieb ashok athukuri via Unbound-<br>
users:<br>
> Here is my unbound.conf:<br>
> # The number of retries when a non-positive response is received.<br>
> outbound-msg-retry: 5<br>
> forward-zone:<br>
> name: "."<br>
> forward-addr: 10.0.0.240<br>
<br>
First of all the option "outbound-msg-retry" must be configured below a<br>
"server" clause. So your configuration should look like this:<br>
<br>
server:<br>
outbound-msg-retry: 5<br>
forward-zone:<br>
name: "."<br>
forward-addr: 10.0.0.240<br>
<br>
I am not sure, if you only missed that in your mail or also in the<br>
config file.<br>
<br>
> here is how I tested:<br>
> on machine#1 ran command #dig @<a href="http://127.0.0.1" rel="noreferrer" target="_blank">127.0.0.1</a> <a href="http://mx.dnstest.com" rel="noreferrer" target="_blank">mx.dnstest.com</a> MX<br>
> My expectation is I should see 5 outgoing queries from Machine#1 to Machine#2<br>
> as Machine#2 send Serve fail as a response<br>
><br>
> Test Result:<br>
> I see more than 5 outgoing msgs/queries (I see 9 msgs/queries) on Machine#1<br>
> This behavior I am not able to understand with definition. I expect only 5<br>
> msgs to Machine#2<br>
<br>
It is correct that you might see more queries than the one configured<br>
"outbound-msg-retry". Unbound will start to send probes to your<br>
forwarders to measure the round trip time. The round trip distribution<br>
will be used by unbound to decide when to send a second request for the<br>
same request to the same forwarder, in case the UDP packet was been<br>
dropped.<br>
<br>
For your testing you an try to set the "infra-cache-min-rtt" to a high<br>
value (something equal/higher than your DNS timeout value, i.e.<br>
something in the some seconds range) and the check if you see less<br>
outgoing queries.<br>
<br>
Another way to test this is to send a lot of queries to your forwarders<br>
to let unbound calculate the round trip distribution before sending your<br>
test query.<br>
<br>
Hope my explanation helps, since I am also only guessing what might had<br>
happened on your systems.<br>
<br>
<br>
Kind regards<br>
Moritz<br>
<br>
</blockquote></div>