DNS slow response - ReadList.com

9 msg	check-integrity complains while deleting MX rec...
7 msg	Problem with quering BIND on localhost
2 msg	Upgrade failed
3 msg	Root user only
1 msg	BIND DNS Training UK 8th Nov (2 days)
6 msg	RES_BLAST

DNS slow response
\ John Bourke (23 Oct 2007)
. \ Mark Andrews (24 Oct 2007)
. . \ Adam Tkac (24 Oct 2007)
. \ Adam Tkac (24 Oct 2007)

16 msg	DDNS
5 msg	Minor errors on boot
8 msg	bind 9.4.1-p1
2 msg	how nameserver load balancing?
2 msg	Dots in hostnames (or: AD vs. DNS 'Domains')
5 msg	split dns problem
5 msg	BIND 9.4.1-P1: 'allow-query' and 'allow-query-c...
2 msg	During a recursive query how does BIND decide w...
2 msg	create Bind-9.4.1-p1 rpm
6 msg	bind is logging with utc timestamp to syslog
1 msg	Re: New posting on ISC Website regarding Recent...
2 msg	BIND DLZ funnies and Segfaults
1 msg	Reg:update-policy

Subject:	DNS slow response
Group:	Bind-users
From:	John Bourke
Date:	23 Oct 2007

Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Hello,

We are ahving difficultly with intermittant slow resposne from our DNS
server. The slow response seems to occur during an initial DNS server
lookup of a domain name, where as a the response time for a cached look up
does not show slow response times.

The problem seems to occur due to a timeout, but I cannot identify why the
timeout occurs, as I cannot see the corresponding outgoing packet.

Here is as far as I have got today documenting the problem

The DNS server software configuration is as follows

[root@trench1ny ~]# cat /etc/issue
Red Hat Enterprise Linux AS release 4 (Nahant Update 3)
Kernel \r on an \m

[root@trench1ny ~]# named -v
BIND 9.2.4
[root@trench1ny ~]# more /etc/resolv.conf
nameserver 212.165.65.4

[root@trench1ny ~]# cat /etc/named.conf
// Default named.conf generated by install of bind-9.2.4-2
options {
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
};

zone "localhost" IN {
type master;
file "bgan.trench1ny.localhost";
};

zone "0.0.127.in-addr.arpa" {
type master;
file "bgan.trench1ny.127.0.0";
};

zone "." {
type hint;
file "root.zone";
};

zone "trench1ny" IN {
type master;
file "bgan.trench1ny.forward";
allow-update { none; };
};

zone "65.165.212.in-addr.arpa" {
type master;
file "bgan.trench1ny.212.165.65";
allow-update { none; };
};

include "/etc/rndc.key";

logging {
channel "default_syslog" {
syslog local6;
severity debug 5;
};

category default { default_syslog; };
category general { default_syslog; };
category config { default_syslog; };
category security { default_syslog; };
category resolver { default_syslog; };
category xfer-in { default_syslog; };
category xfer-out { default_syslog; };
category notify { default_syslog; };
category client { default_syslog; };
category network { default_syslog; };
category update { default_syslog; };
category queries { default_syslog; };
category lame-servers { default_syslog; };
};

[root@trench1ny ~]# cat /var/named/bgan.trench1ny.localhost
;
; trench1ny Zone file for forward localhost
;
; Change history
; ==============
;
; 20071020, <mailto:John.Bourke>
John.Bourke
; Created new file layout
;
$TTL 86400
@ IN SOA localhost root (

42 ; serial (d. adams)
3H ; refresh
15M ; retry
1W ; expiry
1D ) ; minimum

IN NS @
IN A 127.0.0.1

[root@trench1ny ~]# cat /var/named/bgan.trench1ny.127.0.0
;
; trench1ny Zone file for loopback
;
; Change history
; ==============
;
; 20071020, <mailto:John.Bourke>
John.Bourke
; Created new file layout
;
;
$TTL 8H; Minimum TTL
@ IN SOA trench1ny.ny.xantic.net. dnsadmin.xantic.net. (
2007102001 ; serial
8H ; Refresh
2H ; Retry
1W ; Expire
1D) ; Minimum TTL

1 PTR localhost.

[root@trench1ny ~]# cat /var/named/root.zone
; This file holds the information on root name servers needed to
; initialize cache of Internet domain name servers
; (e.g. reference this file in the "cache . <file>"
; configuration file of BIND domain name servers).
;
; This file is made available by InterNIC
; under anonymous FTP as
; file /domain/db.cache
; on server <ftp://ftp.INTERNIC.NET> FTP.INTERNIC.NET
; -OR- RS.INTERNIC.NET
;
; last update: Jan 29, 2004
; related version of root zone: 2004012900
;
;
; formerly NS.INTERNIC.NET
;
. 3600000 IN NS A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
;
; formerly NS1.ISI.EDU
;
. 3600000 NS B.ROOT-SERVERS.NET.
B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201
;
; formerly C.PSI.NET
;
. 3600000 NS C.ROOT-SERVERS.NET.
C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
;
; formerly TERP.UMD.EDU
;
. 3600000 NS D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
;
; formerly NS.NASA.GOV
;
. 3600000 NS E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
;
; formerly NS.ISC.ORG
;
. 3600000 NS F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
;
; formerly NS.NIC.DDN.MIL
;
. 3600000 NS G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
;
; formerly AOS.ARL.ARMY.MIL
;
. 3600000 NS H.ROOT-SERVERS.NET.
H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53
;
; formerly NIC.NORDU.NET
;
. 3600000 NS I.ROOT-SERVERS.NET.
I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
;
; operated by VeriSign, Inc.
;
. 3600000 NS J.ROOT-SERVERS.NET.
J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30
;
; operated by RIPE NCC
;
. 3600000 NS K.ROOT-SERVERS.NET.
K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
;
; operated by ICANN
;
. 3600000 NS L.ROOT-SERVERS.NET.
L.ROOT-SERVERS.NET. 3600000 A 198.32.64.12
;
; operated by WIDE
;
. 3600000 NS M.ROOT-SERVERS.NET.
M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
; End of File

[root@trench1ny ~]# cat /var/named/bgan.trench1ny.forward
;
; trench1ny Zone file
;
; Change history
; ==============
;
; 20071020, <mailto:John.Bourke>
John.Bourke
; Created new file layout
;
;
$TTL 8H; Minimum TTL
@ IN SOA trench1ny.ny.xantic.net. dnsadmin.xantic.net. (
2007102001 ; serial
8H ; refresh
2H ; retry
1W ; expire
1D) ; minimum

;
NS trench1ny.ny.xantic.net.
NS trench2ny.ny.xantic.net.
;
localhost A 127.0.0.1
;
trench1ny A 212.165.65.4
trench2ny A 212.165.65.5

[root@trench1ny ~]# cat /var/named/bgan.trench1ny.212.165.65
;
; trench1ny Zone file for reverse
;
; Change history
; ==============
;
; 20071020, <mailto:John.Bourke>
John.Bourke
; Created new file layout
;
;
$TTL 8H; Minimum TTL
@ IN SOA trench1ny.ny.xantic.net. dnsadmin.xantic.net. (
2007102001 ; serial
8H ; Refresh
2H ; Retry
1W ; Expire
1D) ; Minimum TTL

4 PTR trench1ny.ny.xantic.net.
5 PTR trench2ny.ny.xantic.net.

Logging has been enabled and syslog configued.

[root@trench1ny ~]# cat /etc/syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none;local6.none /var/log/messages

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Log all the mail messages in one place.
mail.* -/var/log/maillog

# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
*.emerg *

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log
kern.=debug
/var/log/iptables.log

local6.* /var/log/named.log

[root@trench1ny ~]# grep "\-d" /etc/init.d/named
daemon /usr/sbin/named -u named -d 9 ${OPTIONS};

Named is running correctly

[root@trench1ny ~]# service named status
number of zones: 6
debug level: 9
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is ON
server is up and running

There is nothing blocking traffic

[root@trench1ny ~]# service iptables status
Firewall is stopped.

A simple test script yields the lookup times.

[root@trench1ny named]# cat test.sh
while :
do
service named restart >> /dev/null
time nslookup www.bbc.co.uk >> /dev/null
done;

The nslookup time looks like this. Clearly there are some delays incurred

0.693
0.732
0.69
0.832
6.723
0.848
0.725
0.897
4.673
6.8
6.608
0.75
0.608
0.862
0.591
2.897
8.625
9.934
3.058
2.63
0.779
0.614
0.676
6.68
4.849
0.8
0.856
6.587
4.894
2.836
2.972
4.658
4.698
4.774
4.734
0.861
4.66
4.831
2.904

The lookup to <http://www.bbc.co.uk> www.bbc.co.uk causes lookups to

www.bbc.co.uk
<http://www.bbc.net.uk> www.bbc.net.uk
ns0.thdo.bbc.co.uk
ns0.rbsov.bbc.co.uk

The average response times based on a tcpdump trace are about 70ms, with one
or two exceptions.

On the occasion of the first logn delay lookup, DNS packets were responding
in normal time frames, but an abnormal trace is show below, with a 2 second
gap between a response and the next request.

285 28.118007 212.165.65.4 192.33.4.12 DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
286 0.013864 192.33.4.12 212.165.65.4 DNS
Standard query response
287 2.054585 212.165.65.4 217.79.164.131 DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
288 0.091873 217.79.164.131 212.165.65.4 DNS
Standard query response
289 0.015454 212.165.65.4 132.185.132.21 DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
290 0.076157 132.185.132.21 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
291 4.020823 212.165.65.4 213.246.167.131 DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
292 0.074034 213.246.167.131 212.165.65.4 DNS
Standard query response
293 0.027181 212.165.65.4 212.58.227.48 DNS
Standard query A ns0.rbsov.bbc.co.uk
294 0.008187 212.165.65.4 212.58.227.48 DNS
Standard query A ns0.thdo.bbc.co.uk
295 0.006788 212.165.65.4 212.58.227.48 DNS
Standard query A6 ns0.thdo.bbc.co.uk
296 0.015070 212.165.65.4 212.58.227.48 DNS
Standard query A6 ns0.rbsov.bbc.co.uk
297 0.041664 212.58.227.48 212.165.65.4 DNS
Standard query response A 212.58.227.47
298 0.007892 212.58.227.48 212.165.65.4 DNS
Standard query response A 212.58.224.20
299 0.006755 212.58.227.48 212.165.65.4 DNS
Standard query response
300 0.014689 212.58.227.48 212.165.65.4 DNS
Standard query response
301 0.066978 212.165.65.4 212.58.224.21 DNS
Standard query AAAA ns0.thdo.bbc.co.uk
302 0.007940 212.165.65.4 212.58.227.47 DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
303 0.012004 212.165.65.4 212.58.224.21 DNS
Standard query AAAA ns0.rbsov.bbc.co.uk
304 0.051525 212.58.224.21 212.165.65.4 DNS
Standard query response
305 0.009539 212.58.227.47 212.165.65.4 DNS
Standard query response, Format error
306 0.002926 212.165.65.4 212.58.227.47 DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
307 0.007284 212.58.224.21 212.165.65.4 DNS
Standard query response
308 0.066690 212.58.227.47 212.165.65.4 DNS
Standard query response A 212.58.227.72

NOTE: The format error message was seen for good and bad nslookup looks, so
it is not likely to be the issue.

on the occasions of a long response time, the following was notivced in the
logs, with a time out.

Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: cancelquery
Oct 23 12:17:18 trench1ny named[14910]: fctx 0x8b96bd0: timeout

Examining the packet trace at the time shows that there were no outstanding
lookups, and the trace pattern is normal.

named seems to "hang" for two seconds on the first lookup

No. Time Source Destination
Protocol Info
285 2007-10-23 12:17:16.385710 212.165.65.4 192.33.4.12
DNS Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
286 2007-10-23 12:17:16.399574 192.33.4.12 212.165.65.4
DNS Standard query response
287 2007-10-23 12:17:18.454159 212.165.65.4 217.79.164.131
DNS Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
288 2007-10-23 12:17:18.546032 217.79.164.131 212.165.65.4
DNS Standard query response
289 2007-10-23 12:17:18.561486 212.165.65.4 132.185.132.21
DNS Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
290 2007-10-23 12:17:18.637643 132.185.132.21 212.165.65.4
DNS Standard query response CNAME <http://www.bbc.net.uk>
www.bbc.net.uk
291 2007-10-23 12:17:22.658466 212.165.65.4 213.246.167.131
DNS Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
292 2007-10-23 12:17:22.732500 213.246.167.131 212.165.65.4
DNS Standard query response
293 2007-10-23 12:17:22.759681 212.165.65.4 212.58.227.48
DNS Standard query A ns0.rbsov.bbc.co.uk
294 2007-10-23 12:17:22.767868 212.165.65.4 212.58.227.48
DNS Standard query A ns0.thdo.bbc.co.uk
295 2007-10-23 12:17:22.774656 212.165.65.4 212.58.227.48
DNS Standard query A6 ns0.thdo.bbc.co.uk
296 2007-10-23 12:17:22.789726 212.165.65.4 212.58.227.48
DNS Standard query A6 ns0.rbsov.bbc.co.uk
297 2007-10-23 12:17:22.831390 212.58.227.48 212.165.65.4
DNS Standard query response A 212.58.227.47
298 2007-10-23 12:17:22.839282 212.58.227.48 212.165.65.4
DNS Standard query response A 212.58.224.20
299 2007-10-23 12:17:22.846037 212.58.227.48 212.165.65.4
DNS Standard query response
300 2007-10-23 12:17:22.860726 212.58.227.48 212.165.65.4
DNS Standard query response
301 2007-10-23 12:17:22.927704 212.165.65.4 212.58.224.21
DNS Standard query AAAA ns0.thdo.bbc.co.uk
302 2007-10-23 12:17:22.935644 212.165.65.4 212.58.227.47
DNS Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
303 2007-10-23 12:17:22.947648 212.165.65.4 212.58.224.21
DNS Standard query AAAA ns0.rbsov.bbc.co.uk
304 2007-10-23 12:17:22.999173 212.58.224.21 212.165.65.4
DNS Standard query response
305 2007-10-23 12:17:23.008712 212.58.227.47 212.165.65.4
DNS Standard query response, Format error
306 2007-10-23 12:17:23.011638 212.165.65.4 212.58.227.47
DNS Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
307 2007-10-23 12:17:23.018922 212.58.224.21 212.165.65.4
DNS Standard query response
308 2007-10-23 12:17:23.085612 212.58.227.47 212.165.65.4
DNS Standard query response A 212.58.227.72

looking for all timeouts in the log file shows lots of timeouts, but for
this test, not all of these timeouts relate to the www.bbc.oc.uk lookup.

[root@trench1ny log]# grep timeout named.log
Oct 23 12:17:18 trench1ny named[14910]: fctx 0x8b96bd0: timeout
Oct 23 12:17:20 trench1ny named[14910]: fctx 0x8b91cb0: timeout
Oct 23 12:17:22 trench1ny named[14910]: fctx 0x8b91cb0: timeout
Oct 23 12:19:35 trench1ny named[15739]: fctx 0xb4201348: timeout
Oct 23 12:19:38 trench1ny named[15739]: fctx 0x8ce6500: timeout
Oct 23 12:19:42 trench1ny named[15949]: fctx 0x8105d98: timeout
Oct 23 12:19:42 trench1ny named[15949]: fctx 0xb4201530: timeout
Oct 23 12:19:44 trench1ny named[15949]: fctx 0x8105d98: timeout
Oct 23 12:19:45 trench1ny named[15949]: fctx 0xb4201530: timeout
Oct 23 12:19:45 trench1ny named[15949]: fctx 0x810cc30: timeout
Oct 23 12:19:45 trench1ny named[15949]: fctx 0xb4203018: timeout
Oct 23 12:19:45 trench1ny named[15949]: fctx 0xb4203f60: timeout
Oct 23 12:19:45 trench1ny named[15949]: fctx 0xb4203530: timeout
Oct 23 12:20:12 trench1ny named[15949]: fctx 0xb4206848: timeout
Oct 23 12:20:14 trench1ny named[15949]: fctx 0xb4207d80: timeout
Oct 23 12:20:16 trench1ny named[15949]: fctx 0xb4207d80: timeout
Oct 23 12:20:51 trench1ny named[16182]: fctx 0xb4200b28: timeout
Oct 23 12:20:53 trench1ny named[16182]: fctx 0xb4200b28: timeout
Oct 23 12:20:55 trench1ny named[16182]: fctx 0xb4200b28: timeout
Oct 23 12:20:55 trench1ny named[16182]: fctx 0xb4200b28: too many timeouts,
disabling EDNS0
Oct 23 12:21:33 trench1ny named[16605]: fctx 0xb4201d50: timeout
Oct 23 12:21:33 trench1ny named[16605]: fctx 0x8625110: timeout
Oct 23 12:21:35 trench1ny named[16605]: fctx 0xb4201d50: timeout
Oct 23 12:21:35 trench1ny named[16605]: fctx 0x8625110: timeout
Oct 23 12:21:35 trench1ny named[16605]: fctx 0xb4209580: timeout
Oct 23 12:21:35 trench1ny named[16605]: fctx 0xb40010b8: timeout
Oct 23 12:21:35 trench1ny named[16605]: fctx 0xb40004d8: timeout
Oct 23 12:21:35 trench1ny named[16605]: fctx 0xb4001c88: timeout
Oct 23 12:22:39 trench1ny named[16998]: fctx 0xb4200900: timeout
Oct 23 12:22:39 trench1ny named[16998]: fctx 0xb4201f28: timeout
Oct 23 12:22:39 trench1ny named[16998]: fctx 0x83b00b0: timeout
Oct 23 12:22:39 trench1ny named[16998]: fctx 0x83ae960: timeout
Oct 23 12:22:39 trench1ny named[16998]: fctx 0x83af4c8: timeout
Oct 23 12:22:39 trench1ny named[16998]: fctx 0x83afe30: timeout
Oct 23 12:23:41 trench1ny named[17201]: fctx 0xb420f6a8: timeout
Oct 23 12:24:16 trench1ny named[17406]: fctx 0xb4002638: timeout
Oct 23 12:24:18 trench1ny named[17406]: fctx 0xb4002638: timeout
Oct 23 12:24:20 trench1ny named[17406]: fctx 0xb4208770: timeout
Oct 23 12:24:22 trench1ny named[17406]: fctx 0xb4208770: timeout
Oct 23 12:24:57 trench1ny named[17644]: fctx 0xb42037e8: timeout
Oct 23 12:24:59 trench1ny named[17644]: fctx 0xb42037e8: timeout
Oct 23 12:25:01 trench1ny named[17644]: fctx 0xb4217d28: timeout
Oct 23 12:25:01 trench1ny named[17644]: fctx 0x9d26c80: timeout
Oct 23 12:25:01 trench1ny named[17644]: fctx 0xb420d460: timeout
Oct 23 12:25:01 trench1ny named[17644]: fctx 0xb4210b70: timeout
Oct 23 12:25:01 trench1ny named[17644]: fctx 0x9d29cb8: timeout
Oct 23 12:25:01 trench1ny named[17644]: fctx 0x9d2afb0: timeout
Oct 23 12:25:01 trench1ny named[17644]: fctx 0xb4210d00: timeout
Oct 23 12:25:01 trench1ny named[17644]: fctx 0xb4221610: timeout
Oct 23 12:25:02 trench1ny named[17644]: fctx 0x9d2e700: timeout
Oct 23 12:25:02 trench1ny named[17644]: fctx 0x9d25cc0: timeout
Oct 23 12:25:02 trench1ny named[17644]: fctx 0x9d2c548: timeout
Oct 23 12:25:03 trench1ny named[17644]: fctx 0xb420d5c0: timeout
Oct 23 12:25:03 trench1ny named[17644]: fctx 0xb4213970: timeout
Oct 23 12:25:03 trench1ny named[17644]: fctx 0xb420fb88: timeout
Oct 23 12:25:03 trench1ny named[17644]: fctx 0xb4200c18: timeout
Oct 23 12:25:03 trench1ny named[17644]: fctx 0xb4218448: timeout
Oct 23 12:25:03 trench1ny named[17644]: fctx 0xb420c758: timeout
Oct 23 12:25:03 trench1ny named[17644]: fctx 0xb4210b70: timeout
Oct 23 12:25:04 trench1ny named[17644]: fctx 0xb4210d00: timeout
Oct 23 12:25:04 trench1ny named[17644]: fctx 0x9d2b3c0: timeout
Oct 23 12:25:04 trench1ny named[17644]: fctx 0x9d25cc0: timeout
Oct 23 12:25:04 trench1ny named[17644]: fctx 0x9d2c548: timeout
Oct 23 12:25:14 trench1ny named[17911]: fctx 0xb420d080: timeout
Oct 23 12:25:14 trench1ny named[17911]: fctx 0xb420f3d0: timeout
Oct 23 12:25:14 trench1ny named[17911]: fctx 0xb420df20: timeout
Oct 23 12:25:14 trench1ny named[17911]: fctx 0xb4212248: timeout
Oct 23 12:25:14 trench1ny named[17911]: fctx 0xb4215ab8: timeout
Oct 23 12:25:14 trench1ny named[17911]: fctx 0x83fc480: timeout
Oct 23 12:25:14 trench1ny named[17911]: fctx 0xb42167a0: timeout
Oct 23 12:25:14 trench1ny named[17911]: fctx 0x83f5150: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0xb421da80: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0xb421ceb0: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0xb4219018: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0xb4206568: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0x83ff0b8: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0xb42170e0: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0xb42203f0: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0xb4221368: timeout
Oct 23 12:25:15 trench1ny named[17911]: fctx 0xb4213200: timeout
Oct 23 12:25:16 trench1ny named[17911]: fctx 0xb420df20: timeout
Oct 23 12:25:16 trench1ny named[17911]: fctx 0xb4212248: timeout
Oct 23 12:25:17 trench1ny named[17911]: fctx 0xb42167a0: timeout
Oct 23 12:25:17 trench1ny named[17911]: fctx 0x8406090: timeout
Oct 23 12:25:18 trench1ny named[17911]: fctx 0xb421ceb0: timeout
Oct 23 12:25:18 trench1ny named[17911]: fctx 0xb4206568: timeout
Oct 23 12:25:18 trench1ny named[17911]: fctx 0xb42170e0: timeout
Oct 23 12:25:18 trench1ny named[17911]: fctx 0xb4221368: timeout
Oct 23 12:25:19 trench1ny named[17911]: fctx 0xb42167a0: timeout
Oct 23 12:25:19 trench1ny named[17911]: fctx 0x8406588: timeout
Oct 23 12:25:19 trench1ny named[17911]: fctx 0xb4213200: timeout
Oct 23 12:25:19 trench1ny named[17911]: fctx 0x8406090: timeout
Oct 23 12:25:20 trench1ny named[17911]: fctx 0xb421ceb0: timeout
Oct 23 12:25:20 trench1ny named[17911]: fctx 0xb4206568: timeout
Oct 23 12:25:20 trench1ny named[17911]: fctx 0x8377fc8: timeout
Oct 23 12:25:20 trench1ny named[17911]: fctx 0x83f7e20: timeout
Oct 23 12:25:21 trench1ny named[17911]: fctx 0xb42167a0: timeout
Oct 23 12:25:21 trench1ny named[17911]: fctx 0xb42167a0: too many timeouts,
disabling EDNS0
Oct 23 12:25:22 trench1ny named[17911]: fctx 0xb4206568: timeout
Oct 23 12:25:22 trench1ny named[17911]: fctx 0xb4206568: too many timeouts,
disabling EDNS0
Oct 23 12:25:23 trench1ny named[17911]: fctx 0x8377fc8: timeout
Oct 23 12:25:25 trench1ny named[17911]: fctx 0x8377fc8: timeout
Oct 23 12:25:27 trench1ny named[17911]: fctx 0x8377fc8: timeout
Oct 23 12:25:27 trench1ny named[17911]: fctx 0x8377fc8: too many timeouts,
disabling EDNS0
Oct 23 12:25:39 trench1ny named[17911]: fctx 0xb42072b0: timeout
Oct 23 12:26:14 trench1ny named[18154]: fctx 0x887e910: timeout
Oct 23 12:26:19 trench1ny named[18362]: fctx 0x901b9f8: timeout
Oct 23 12:26:52 trench1ny named[18557]: fctx 0x87669d0: timeout
Oct 23 12:27:24 trench1ny named[18755]: fctx 0x8654458: timeout
Oct 23 12:27:57 trench1ny named[18950]: fctx 0x8f7b000: timeout
Oct 23 12:27:57 trench1ny named[18950]: fctx 0x8ff2ca0: timeout
Oct 23 12:27:59 trench1ny named[18950]: fctx 0x8f7b000: timeout
Oct 23 12:27:59 trench1ny named[18950]: fctx 0x8ff2ca0: timeout
Oct 23 12:28:00 trench1ny named[18950]: fctx 0xb42063f8: timeout
Oct 23 12:28:00 trench1ny named[18950]: fctx 0xb4001218: timeout
Oct 23 12:28:00 trench1ny named[18950]: fctx 0xb4000638: timeout
Oct 23 12:28:00 trench1ny named[18950]: fctx 0xb4001de8: timeout
Oct 23 12:28:27 trench1ny named[18950]: fctx 0xb42067a0: timeout
Oct 23 12:28:29 trench1ny named[18950]: fctx 0xb42067a0: timeout
Oct 23 12:28:31 trench1ny named[18950]: fctx 0xb42067a0: timeout
Oct 23 12:28:31 trench1ny named[18950]: fctx 0xb42067a0: too many timeouts,
disabling EDNS0
Oct 23 12:28:36 trench1ny named[19178]: fctx 0xb4200bb0: timeout
Oct 23 12:28:36 trench1ny named[19178]: fctx 0xb4202200: timeout
Oct 23 12:28:38 trench1ny named[19178]: fctx 0xb4200bb0: timeout
Oct 23 12:28:38 trench1ny named[19178]: fctx 0xb4202200: timeout
Oct 23 12:28:38 trench1ny named[19178]: fctx 0x953bd58: timeout
Oct 23 12:28:38 trench1ny named[19178]: fctx 0xb4205720: timeout
Oct 23 12:28:38 trench1ny named[19178]: fctx 0x953ce40: timeout
Oct 23 12:28:38 trench1ny named[19178]: fctx 0xb4204c48: timeout
Oct 23 12:28:57 trench1ny named[19178]: fctx 0x95438c0: timeout
Oct 23 12:28:57 trench1ny named[19178]: fctx 0x9547a70: timeout
Oct 23 12:28:57 trench1ny named[19178]: fctx 0xb4206910: timeout
Oct 23 12:28:57 trench1ny named[19178]: fctx 0xb4202508: timeout
Oct 23 12:28:57 trench1ny named[19178]: fctx 0x954d280: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0xb4213898: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0xb42103a0: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0xb4211948: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0x9559600: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0xb420f728: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0xb4203498: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0xb420c2d8: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0xb4216de0: timeout
Oct 23 12:28:58 trench1ny named[19178]: fctx 0xb4212040: timeout
Oct 23 12:28:59 trench1ny named[19178]: fctx 0x95438c0: timeout
Oct 23 12:28:59 trench1ny named[19178]: fctx 0x9547a70: timeout
Oct 23 12:29:00 trench1ny named[19178]: fctx 0x9543b38: timeout
Oct 23 12:29:00 trench1ny named[19178]: fctx 0xb420ce20: timeout
Oct 23 12:29:00 trench1ny named[19178]: fctx 0x9559600: timeout
Oct 23 12:29:02 trench1ny named[19178]: fctx 0x9559600: timeout
Oct 23 12:29:06 trench1ny named[19178]: fctx 0xb4208b40: timeout
Oct 23 12:29:08 trench1ny named[19178]: fctx 0x954eb78: timeout
Oct 23 12:29:21 trench1ny named[19633]: fctx 0xb4205fe0: timeout
Oct 23 12:29:22 trench1ny named[19633]: fctx 0x95d0ac0: timeout
Oct 23 12:29:22 trench1ny named[19633]: fctx 0x95d1658: timeout
Oct 23 12:29:22 trench1ny named[19633]: fctx 0xb4209c20: timeout
Oct 23 12:29:22 trench1ny named[19633]: fctx 0x95cd968: timeout
Oct 23 12:29:22 trench1ny named[19633]: fctx 0x95cf930: timeout
Oct 23 12:29:22 trench1ny named[19633]: fctx 0x95d4d18: timeout
Oct 23 12:29:22 trench1ny named[19633]: fctx 0x9547818: timeout
Oct 23 12:29:24 trench1ny named[19633]: fctx 0x95cd610: timeout
Oct 23 12:29:24 trench1ny named[19633]: fctx 0xb4208780: timeout
Oct 23 12:29:24 trench1ny named[19633]: fctx 0x95cd968: timeout
Oct 23 12:29:24 trench1ny named[19633]: fctx 0x95cf930: timeout
Oct 23 12:29:24 trench1ny named[19633]: fctx 0x9547818: timeout
Oct 23 12:29:24 trench1ny named[19633]: fctx 0x95d61f8: timeout
Oct 23 12:29:26 trench1ny named[19633]: fctx 0xb4208780: timeout
Oct 23 12:29:26 trench1ny named[19633]: fctx 0xb420bb70: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0xb420a678: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0xb4216190: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0x9306bb0: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0x9310178: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0xb4205fc0: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0xb420d248: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0xb42044f8: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0x9310d20: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0x9311a50: timeout
Oct 23 12:29:54 trench1ny named[19906]: fctx 0xb420f5a8: timeout
Oct 23 12:29:55 trench1ny named[19906]: fctx 0xb4218020: timeout
Oct 23 12:29:55 trench1ny named[19906]: fctx 0xb4206808: timeout
Oct 23 12:29:56 trench1ny named[19906]: fctx 0xb4205fc0: timeout
Oct 23 12:29:56 trench1ny named[19906]: fctx 0xb4216190: timeout
Oct 23 12:29:56 trench1ny named[19906]: fctx 0xb42044f8: timeout
Oct 23 12:29:57 trench1ny named[19906]: fctx 0x9311a50: timeout
Oct 23 12:29:57 trench1ny named[19906]: fctx 0xb4206808: timeout
Oct 23 12:29:57 trench1ny named[19906]: fctx 0xb4218020: timeout
Oct 23 12:29:58 trench1ny named[19906]: fctx 0xb420d238: timeout
Oct 23 12:29:59 trench1ny named[19906]: fctx 0xb420ab10: timeout
Oct 23 12:30:19 trench1ny named[20309]: fctx 0x95b0968: timeout
Oct 23 12:30:20 trench1ny named[20309]: fctx 0x95bd890: timeout
Oct 23 12:30:20 trench1ny named[20309]: fctx 0x95bf620: timeout
Oct 23 12:30:21 trench1ny named[20309]: fctx 0xb4206970: timeout
Oct 23 12:30:23 trench1ny named[20309]: fctx 0xb4206970: timeout
Oct 23 12:30:48 trench1ny named[20309]: fctx 0x95aa788: timeout
Oct 23 12:30:50 trench1ny named[20309]: fctx 0x95aa788: timeout
Oct 23 12:30:52 trench1ny named[20309]: fctx 0x95ab480: timeout
Oct 23 12:31:27 trench1ny named[20605]: fctx 0xb4208690: timeout
Oct 23 12:31:29 trench1ny named[20605]: fctx 0xb4208690: timeout
Oct 23 12:32:04 trench1ny named[20828]: fctx 0xb420cb78: timeout
Oct 23 12:32:39 trench1ny named[21041]: fctx 0xb4106568: timeout
Oct 23 12:33:14 trench1ny named[21246]: fctx 0x960f0e8: timeout
Oct 23 12:33:16 trench1ny named[21246]: fctx 0x960f0e8: timeout
Oct 23 12:33:50 trench1ny named[21464]: fctx 0xb410a198: timeout
Oct 23 12:33:53 trench1ny named[21464]: fctx 0xa075748: timeout
Oct 23 12:33:58 trench1ny named[21679]: fctx 0x8794e40: timeout
Oct 23 12:34:27 trench1ny named[21679]: fctx 0xb420c608: timeout
Oct 23 12:34:29 trench1ny named[21679]: fctx 0xb42096c8: timeout
Oct 23 12:35:04 trench1ny named[21897]: fctx 0xb4205768: timeout
Oct 23 12:35:06 trench1ny named[21897]: fctx 0xb4202a78: timeout
Oct 23 12:36:14 trench1ny named[22315]: fctx 0x9161e48: timeout
Oct 23 12:36:16 trench1ny named[22315]: fctx 0xb42012b8: timeout
Oct 23 12:36:21 trench1ny named[22533]: fctx 0x9a151f0: timeout
Oct 23 12:36:21 trench1ny named[22533]: fctx 0x9a167f8: timeout
Oct 23 12:36:23 trench1ny named[22533]: fctx 0x9a151f0: timeout
Oct 23 12:36:23 trench1ny named[22533]: fctx 0x9a167f8: timeout
Oct 23 12:36:25 trench1ny named[22533]: fctx 0x9a151f0: timeout
Oct 23 12:36:25 trench1ny named[22533]: fctx 0x9a167f8: timeout
Oct 23 12:36:25 trench1ny named[22533]: fctx 0x9a21880: timeout
Oct 23 12:36:25 trench1ny named[22533]: fctx 0x9a17bf0: timeout
Oct 23 12:36:25 trench1ny named[22533]: fctx 0x9a1a570: timeout
Oct 23 12:36:25 trench1ny named[22533]: fctx 0x9a245c0: timeout
Oct 23 12:36:27 trench1ny named[22533]: fctx 0x9a21880: timeout
Oct 23 12:36:27 trench1ny named[22533]: fctx 0x9a17bf0: timeout
Oct 23 12:36:27 trench1ny named[22533]: fctx 0x9a1a570: timeout
Oct 23 12:36:27 trench1ny named[22533]: fctx 0x9a245c0: timeout
Oct 23 12:36:51 trench1ny named[22533]: fctx 0x9a1c648: timeout
Oct 23 12:36:53 trench1ny named[22533]: fctx 0x9a1f638: timeout
Oct 23 12:37:28 trench1ny named[22748]: fctx 0x85bf410: timeout
Oct 23 12:37:33 trench1ny named[22961]: fctx 0x926c1b0: timeout
Oct 23 12:37:33 trench1ny named[22961]: fctx 0x92e3df0: timeout
Oct 23 12:37:33 trench1ny named[22961]: fctx 0xb4204e60: timeout
Oct 23 12:37:33 trench1ny named[22961]: fctx 0x92e6f40: timeout
Oct 23 12:37:33 trench1ny named[22961]: fctx 0x92e4b58: timeout
Oct 23 12:37:33 trench1ny named[22961]: fctx 0x92e8b08: timeout
Oct 23 12:39:37 trench1ny named[22961]: fctx 0x92eb0c8: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb4204e60: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb420b698: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb42056b8: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb420c410: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0x92ed308: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb4213178: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0x926c8c8: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb4212500: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0x92e83f0: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb421bc48: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb42168c8: timeout
Oct 23 12:39:38 trench1ny named[22961]: fctx 0xb421c650: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0x92e8f58: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0x92f25f0: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0x92f7770: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0xb42036c0: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0xb42069e8: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0xb421ea40: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0x92ef8b8: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0xb4221600: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0xb420c570: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0xb420ce68: timeout
Oct 23 12:39:39 trench1ny named[22961]: fctx 0x92eb0c8: timeout
Oct 23 12:39:40 trench1ny named[22961]: fctx 0x92e83f0: timeout
Oct 23 12:39:40 trench1ny named[22961]: fctx 0x926c8c8: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0x92e8f58: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb4213ec8: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb4217a58: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb42036c0: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb42069e8: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0x92f2c80: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb4225510: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb420bfc8: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb4225e78: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb421c650: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0x92f7770: timeout
Oct 23 12:39:41 trench1ny named[22961]: fctx 0xb421ea40: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0xb4221600: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0x92eb0c8: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0xb4223360: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0xb4213708: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0xb4220578: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0xb4220b48: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0x92e83f0: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0x92e83f0: too many timeouts,
disabling EDNS0
Oct 23 12:39:42 trench1ny named[22961]: fctx 0x92f2a88: timeout
Oct 23 12:39:42 trench1ny named[22961]: fctx 0x92f0f40: timeout
Oct 23 12:39:43 trench1ny named[22961]: fctx 0x92e8f58: timeout
Oct 23 12:39:43 trench1ny named[22961]: fctx 0x92e8f58: too many timeouts,
disabling EDNS0
Oct 23 12:39:43 trench1ny named[22961]: fctx 0xb42036c0: timeout
Oct 23 12:39:43 trench1ny named[22961]: fctx 0xb42036c0: too many timeouts,
disabling EDNS0
Oct 23 12:39:43 trench1ny named[22961]: fctx 0xb42069e8: timeout
Oct 23 12:39:43 trench1ny named[22961]: fctx 0xb42069e8: too many timeouts,
disabling EDNS0
Oct 23 12:39:43 trench1ny named[22961]: fctx 0xb421bc48: timeout
Oct 23 12:39:43 trench1ny named[22961]: fctx 0xb4213ec8: timeout
Oct 23 12:39:44 trench1ny named[22961]: fctx 0xb4201ab0: timeout

The next question is

1. What exactly is timing out ?
2. Is there a pattern ?

The pattern for timeouts for www.bbc.co.uk lookups seem to occur at the
start of the lookup sequence rather than at the end. So the initial lookups
of

www.bbc.co.uk <http://www.bbc.co.uk/>
www.b <http://www.bbc.net.uk/> bc.net.uk

yield time outs, but the further look ups of the name servers for bbc.co.uk
and the final lookup of the address for www.bbc.co.uk do not show any
timeouts.

A normal sequence looks like this

35 29.793107 212.165.65.4 E.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
36 0.079928 E.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
37 0.030066 212.165.65.4 NS4.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
38 0.077073 NS4.NIC.uk 212.165.65.4 DNS
Standard query response
39 0.012910 212.165.65.4 ns1.thdo.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
40 0.073101 ns1.thdo.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
41 0.017888 212.165.65.4 NS6.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
42 0.080747 NS6.NIC.uk 212.165.65.4 DNS
Standard query response
43 0.025118 212.165.65.4 ns1.rbsov.bbc.co.uk DNS
Standard query A ns0.thdo.bbc.co.uk
44 0.017040 212.165.65.4 ns1.rbsov.bbc.co.uk DNS
Standard query A6 ns0.thdo.bbc.co.uk
45 0.003954 212.165.65.4 ns1.rbsov.bbc.co.uk DNS
Standard query A ns0.rbsov.bbc.co.uk
46 0.013451 212.165.65.4 ns1.rbsov.bbc.co.uk DNS
Standard query A6 ns0.rbsov.bbc.co.uk
47 0.036039 ns1.rbsov.bbc.co.uk 212.165.65.4 DNS
Standard query response A 212.58.224.20
48 0.016860 ns1.rbsov.bbc.co.uk 212.165.65.4 DNS
Standard query response
49 0.000645 212.165.65.4 ns0.thdo.bbc.co.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
50 0.003374 ns1.rbsov.bbc.co.uk 212.165.65.4 DNS
Standard query response A 212.58.227.47
51 0.012961 ns1.rbsov.bbc.co.uk 212.165.65.4 DNS
Standard query response
52 0.058216 ns0.thdo.bbc.co.uk 212.165.65.4 DNS
Standard query response, Format error
53 0.017666 212.165.65.4 ns.bbc.co.uk DNS
Standard query AAAA ns0.thdo.bbc.co.uk
54 0.004833 212.165.65.4 ns0.thdo.bbc.co.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
55 0.012958 212.165.65.4 ns.bbc.co.uk DNS
Standard query AAAA ns0.rbsov.bbc.co.uk
56 0.055527 ns.bbc.co.uk 212.165.65.4 DNS
Standard query response
57 0.009515 ns0.thdo.bbc.co.uk 212.165.65.4 DNS
Standard query response A 212.58.227.76
58 0.007951 ns.bbc.co.uk 212.165.65.4 DNS
Standard query response

The abnormal sequences look like this, here is a selection of traces

285 32.032868 212.165.65.4 C.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
286 0.013864 C.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
287 2.054585 212.165.65.4 NS2.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
288 0.091873 NS2.NIC.uk 212.165.65.4 DNS
Standard query response
289 0.015454 212.165.65.4 ns1.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
290 0.076157 ns1.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
291 4.020823 212.165.65.4 NS5.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
292 0.074034 NS5.NIC.uk 212.165.65.4 DNS
Standard query response

531 32.074431 212.165.65.4 A.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
532 0.008896 A.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
533 2.071472 212.165.65.4 NS6.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
534 0.082332 NS6.NIC.uk 212.165.65.4 DNS
Standard query response
535 0.016903 212.165.65.4 ns1.thdo.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
536 0.074739 ns1.thdo.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
537 2.021650 212.165.65.4 NS1.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
538 0.070593 NS1.NIC.uk 212.165.65.4 DNS
Standard query response

593 32.083044 212.165.65.4 D.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
594 0.010946 D.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
595 2.069384 212.165.65.4 NS4.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
596 0.076661 NS4.NIC.uk 212.165.65.4 DNS
Standard query response
597 0.025643 212.165.65.4 ns1.rbsov.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
598 0.072845 ns1.rbsov.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
599 4.036202 212.165.65.4 NSB.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
600 0.007648 NSB.NIC.uk 212.165.65.4 DNS
Standard query response

655 32.100709 212.165.65.4 E.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
656 0.079960 E.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
657 4.030161 212.165.65.4 NS1.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
658 2.001705 212.165.65.4 NSD.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
659 0.007679 NSD.NIC.uk 212.165.65.4 DNS
Standard query response

964 32.089794 212.165.65.4 B.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
965 0.088127 B.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
966 0.051949 212.165.65.4 NS4.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
967 0.076684 NS4.NIC.uk 212.165.65.4 DNS
Standard query response
968 0.026047 212.165.65.4 ns1.thls.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
969 0.074067 ns1.thls.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
970 2.034426 212.165.65.4 NS7.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
971 0.078629 NS7.NIC.uk 212.165.65.4 DNS
Standard query response

1026 32.070766 212.165.65.4 H.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1027 0.012464 H.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
1028 4.038056 212.165.65.4 NS2.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1029 0.092438 NS2.NIC.uk 212.165.65.4 DNS
Standard query response
1030 0.014849 212.165.65.4 ns1.thls.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1031 0.075646 ns1.thls.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
1032 4.019380 212.165.65.4 NS1.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
1033 0.070230 NS1.NIC.uk 212.165.65.4 DNS
Standard query response

1086 32.092236 212.165.65.4 B.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1087 0.090026 B.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
1112 4.123168 212.165.65.4 NS5.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1117 0.072527 NS5.NIC.uk 212.165.65.4 DNS
Standard query response
1127 0.710474 212.165.65.4 ns1.rbsov.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1132 0.073176 ns1.rbsov.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
1223 4.436529 212.165.65.4 NS6.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
1225 0.080688 NS6.NIC.uk 212.165.65.4 DNS
Standard query response

1481 32.093006 212.165.65.4 H.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1482 0.012353 H.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
1483 0.035672 212.165.65.4 NS3.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1484 0.070890 NS3.NIC.uk 212.165.65.4 DNS
Standard query response
1485 0.016208 212.165.65.4 ns1.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1486 0.073210 ns1.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
1487 2.021021 212.165.65.4 NS4.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
1488 0.076786 NS4.NIC.uk 212.165.65.4 DNS
Standard query response

1730 32.094417 212.165.65.4 J.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1731 0.120282 J.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
1732 0.051842 212.165.65.4 NSC.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1733 0.007824 NSC.NIC.uk 212.165.65.4 DNS
Standard query response
1734 0.045993 212.165.65.4 ns1.thls.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1735 0.072767 ns1.thls.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
1736 6.038042 212.165.65.4 NSB.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
1737 0.007555 NSB.NIC.uk 212.165.65.4 DNS
Standard query response

1930 32.058562 212.165.65.4 F.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1931 0.081197 F.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
1932 2.052110 212.165.65.4 NS5.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1933 0.071389 NS5.NIC.uk 212.165.65.4 DNS
Standard query response
1934 0.026151 212.165.65.4 ns1.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
1935 0.073988 ns1.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
1936 2.034104 212.165.65.4 NSA.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
1937 0.007907 NSA.NIC.uk 212.165.65.4 DNS
Standard query response

2342 32.037175 212.165.65.4 G.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2343 0.039524 G.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
2344 2.035740 212.165.65.4 NSB.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2345 0.007889 NSB.NIC.uk 212.165.65.4 DNS
Standard query response
2346 0.017404 212.165.65.4 ns1.rbsov.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2347 2.000427 212.165.65.4 ns1.thdo.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2348 0.071786 ns1.thdo.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
2349 2.019821 212.165.65.4 NS4.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
2350 0.076269 NS4.NIC.uk 212.165.65.4 DNS
Standard query response

2405 32.090235 212.165.65.4 A.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2406 0.009285 A.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
2407 0.070690 212.165.65.4 NSD.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2408 0.007661 NSD.NIC.uk 212.165.65.4 DNS
Standard query response
2409 0.046500 212.165.65.4 ns1.thls.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2410 0.072810 ns1.thls.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
2411 4.036038 212.165.65.4 NS7.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
2412 0.078423 NS7.NIC.uk 212.165.65.4 DNS
Standard query response

2467 32.086702 212.165.65.4 A.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2468 0.009113 A.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
2469 0.033853 212.165.65.4 NSA.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2470 0.007780 NSA.NIC.uk 212.165.65.4 DNS
Standard query response
2471 0.022446 212.165.65.4 ns1.thdo.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2472 0.072618 ns1.thdo.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
2473 2.018617 212.165.65.4 NS7.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
2474 0.079168 NS7.NIC.uk 212.165.65.4 DNS
Standard query response

2529 32.089374 212.165.65.4 F.ROOT-SERVERS.NET DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2530 0.081070 F.ROOT-SERVERS.NET 212.165.65.4 DNS
Standard query response
2531 0.051906 212.165.65.4 NS3.NIC.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2532 0.071043 NS3.NIC.uk 212.165.65.4 DNS
Standard query response
2533 0.025913 212.165.65.4 ns1.rbsov.bbc.co.uk DNS
Standard query A <http://www.bbc.co.uk> www.bbc.co.uk
2534 0.071386 ns1.rbsov.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME <http://www.bbc.net.uk> www.bbc.net.uk
2535 2.034055 212.165.65.4 NS1.NIC.uk DNS
Standard query A <http://www.bbc.net.uk> www.bbc.net.uk
2536 0.070529 NS1.NIC.uk 212.165.65.4 DNS
Standard query response

In all cases where there has been a delay, the previous resposne had
contained a list of Authoritive name servers and IP addresses for these name
servers.

No. Time Source Destination Protocol
Info
3030 0.076224 ns1.thls.bbc.co.uk 212.165.65.4 DNS
Standard query response CNAME www.bbc.net.uk

Frame 3030 (600 bytes on wire, 600 bytes captured)
Ethernet II, Src: Cisco_27:ea:f0 (00:17:95:27:ea:f0), Dst: GlobalDa_45:02:68
(00:17:a4:45:02:68)
Internet Protocol, Src: ns1.thls.bbc.co.uk (132.185.240.21), Dst:
212.165.65.4 (212.165.65.4)
User Datagram Protocol, Src Port: domain (53), Dst Port: 33172 (33172)
Domain Name System (response)
[Request In: 3029]
[Time: 0.076224000 seconds]
Transaction ID: 0x95f3
Flags: 0x8010 (Standard query response, No error)
Questions: 1
Answer RRs: 1
Authority RRs: 11
Additional RRs: 16
Queries
<http://www.bbc.co.uk> www.bbc.co.uk: type A, class IN
Answers
<http://www.bbc.co.uk> www.bbc.co.uk: type CNAME, class IN, cname
<http://www.bbc.net.uk> www.bbc.net.uk
Authoritative nameservers
uk: type NS, class IN, ns NS5.NIC.uk
uk: type NS, class IN, ns NSA.NIC.uk
uk: type NS, class IN, ns NS1.NIC.uk
uk: type NS, class IN, ns NS6.NIC.uk
uk: type NS, class IN, ns NS4.NIC.uk
uk: type NS, class IN, ns NSC.NIC.uk
uk: type NS, class IN, ns NS7.NIC.uk
uk: type NS, class IN, ns NSB.NIC.uk
uk: type NS, class IN, ns NSD.NIC.uk
uk: type NS, class IN, ns NS2.NIC.uk
uk: type NS, class IN, ns NS3.NIC.uk
Additional records
NS5.NIC.uk: type A, class IN, addr 213.246.167.131
NSA.NIC.uk: type A, class IN, addr 204.74.112.44
NSA.NIC.uk: type AAAA, class IN, addr 2001:502:d399::44
NS1.NIC.uk: type A, class IN, addr 195.66.240.130
NS1.NIC.uk: type AAAA, class IN, addr 2a01:40:1001:35::2
NS6.NIC.uk: type A, class IN, addr 213.248.254.130
NS4.NIC.uk: type A, class IN, addr 194.83.244.131
NS4.NIC.uk: type AAAA, class IN, addr 2001:630:181:35::83
NSC.NIC.uk: type A, class IN, addr 199.7.66.44
NS7.NIC.uk: type A, class IN, addr 212.121.40.130
NSB.NIC.uk: type A, class IN, addr 204.74.113.44
NSD.NIC.uk: type AAAA, class IN, addr 2001:502:100e::44
NSD.NIC.uk: type A, class IN, addr 199.7.67.44
NS2.NIC.uk: type A, class IN, addr 217.79.164.131
NS3.NIC.uk: type A, class IN, addr 213.219.13.131
<Root>: type OPT

Trying to make sense of the logs

Oct 23 12:17:16 trench1ny named[14910]: client 212.165.65.4#33104: UDP
request
Oct 23 12:17:16 trench1ny named[14910]: client 212.165.65.4#33104: using
view '_default'
Oct 23 12:17:16 trench1ny named[14910]: client 212.165.65.4#33104: request
is not signed
Oct 23 12:17:16 trench1ny named[14910]: client 212.165.65.4#33104: recursion
available: approved
Oct 23 12:17:16 trench1ny named[14910]: client 212.165.65.4#33104: query
Oct 23 12:17:16 trench1ny named[14910]: client 212.165.65.4#33104: query:
www.bbc.co.uk IN A
Oct 23 12:17:16 trench1ny named[14910]: client 212.165.65.4#33104: query
(cache) approved
Oct 23 12:17:16 trench1ny named[14910]: client 212.165.65.4#33104: replace
Oct 23 12:17:16 trench1ny named[14910]: clientmgr @0x8b628d0: createclients
Oct 23 12:17:16 trench1ny named[14910]: clientmgr @0x8b628d0: create new
Oct 23 12:17:16 trench1ny named[14910]: client @0x8b96910: create
Oct 23 12:17:16 trench1ny named[14910]: createfetch: www.bbc.co.uk A
Oct 23 12:17:16 trench1ny named[14910]: client @0x8b96910: udprecv
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: create
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: join
Oct 23 12:17:16 trench1ny named[14910]: fetch 0x8b2b848 (fctx 0x8b96bd0):
created
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: start
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: try
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: cancelqueries
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: getaddresses
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: query

Oct 23 12:17:16 trench1ny named[14910]: resquery 0x8b96258 (fctx 0x8b96bd0):
send
Oct 23 12:17:16 trench1ny named[14910]: resquery 0x8b96258 (fctx 0x8b96bd0):
sent
Oct 23 12:17:16 trench1ny named[14910]: resquery 0x8b96258 (fctx 0x8b96bd0):
senddone
Oct 23 12:17:16 trench1ny named[14910]: resquery 0x8b96258 (fctx 0x8b96bd0):
response

This seems to indicate a normal send and response, and corresponds to an
outgoing and response packet at that time.

Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: noanswer_response
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: cache_message
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: cancelquery
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: cancelqueries
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b970b8
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b912d8
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b11af0
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b11ee0
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b11d30
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b97148
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b8f4e0
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b2b478
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b8f2a0
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b8f330
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b2b3e8
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b8efd0
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_destroyfind on find
0x8b8ef40
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: try
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: cancelqueries
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: getaddresses
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b97a00 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found AAAA for
name 0x8b97a00
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b93648 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b93590 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b92840 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found AAAA for
name 0x8b92840
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b92788 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b926d0 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b92618 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b92560 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found AAAA for
name 0x8b92560
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b924a8 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b923f0 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found A for name
0x8b92338 in db
Oct 23 12:17:16 trench1ny named[14910]: dns_adb_createfind: found AAAA for
name 0x8b92338
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: query

Oct 23 12:17:16 trench1ny named[14910]: resquery 0x8b8ca58 (fctx 0x8b96bd0):
send
Oct 23 12:17:16 trench1ny named[14910]: resquery 0x8b8ca58 (fctx 0x8b96bd0):
sent
Oct 23 12:17:16 trench1ny named[14910]: resquery 0x8b8ca58 (fctx 0x8b96bd0):
senddone
Oct 23 12:17:16 trench1ny named[14910]: fctx 0x8b96bd0: cancelquery
Oct 23 12:17:18 trench1ny named[14910]: fctx 0x8b96bd0: timeout

This seems it indicate a send and then timeout, or does it ?
This does not correspond to any packet in the packet trace.

Oct 23 12:17:18 trench1ny named[14910]: fctx 0x8b96bd0: try
Oct 23 12:17:18 trench1ny named[14910]: fctx 0x8b96bd0: query

The trace at the time does not show an outgoing request which might have
timed out

285 2007-10-23 12:17:16.385710 212.165.65.4 192.33.4.12
DNS Standard query A <http://www.bbc.co.uk/> www.bbc.co.uk
286 2007-10-23 12:17:16.399574 192.33.4.12 212.165.65.4
DNS Standard query response
287 2007-10-23 12:17:18.454159 212.165.65.4 217.79.164.131
DNS Standard query A <http://www.bbc.co.uk/> www.bbc.co.uk
288 2007-10-23 12:17:18.546032 217.79.164.131 212.165.65.4
DNS Standard query response

So is there an outgoing request which is lost ? If the logs sa that a
request packet is send, and the tcpdump does not see it, then maybe the
request is being dropped somewhere ?

The named trace does not indicate the details of the sent query, like IP
address ..... Although the trace was on one interface, Another extensive
test showed that no packets were directed towards the second interface on
the box.

Any comments ??????????

Thanks

john

john