Subject: Re: !aa &&!ra question

From: Kevin Darcy <[email-masked]>
Date: Tue, 12 Aug 2003 17:01:06 -0400

Edward Lewis wrote:

> Under what conditions can a response have the aa bit off and the ra bit off?
>
> I'm assuming that aa means that the data came from the data the
> server is authoritative for, or in the bad old days, the first
> "retransmission" of a response by a cache.
>
> I'm assuming that ra means I'll do recursion (for you).
>
> Is it possible that !aa && !ra means that I've learned this via
> recursion, but I won't recurse for you?

Yes. And referrals.

                                                                - Kevin

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Tue, 12 Aug 2003 23:08:35 +0200 (CEST)

> recursion, but I won't recurse for you?

Responses from authoritative servers will also give (!ra,!aa) when queried
for data that give either delegations or referrals to root(hints).

There are probably more cases.

Roy

---

From: Edward Lewis <[email-masked]>
Date: Tue, 12 Aug 2003 17:57:52 -0400

>for data that give either delegations or referrals to root(hints).

I shoulda added '&& ancount > 0" which rules out referrals.  (I'm 
looking at some real data from a test.)  I've seen Kevin's answer too.

Thanks.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

One good way to avoid becoming scared: always keep your eyes shut.

---

From: Roy Arends <[email-masked]>
Date: Wed, 13 Aug 2003 00:31:36 +0200 (CEST)

> looking at some real data from a test.)  I've seen Kevin's answer too.

I guess it must be glue@root then:

try:

dig +norec @a.root-servers.net ns1.mynet.net. a

roy

---

From: Roy Arends <[email-masked]>
Date: Wed, 13 Aug 2003 00:34:20 +0200 (CEST)

> dig +norec @a.root-servers.net ns1.mynet.net. a

Scratch that, any BIND 8.* (and prolly 4.*) will give glue back in answer
section with !aa & !ra.

Roy

---

From: Robert Elz <[email-masked]>
Date: Wed, 13 Aug 2003 15:29:19 +0700

Date:        Tue, 12 Aug 2003 16:36:01 -0400
    From:        Edward Lewis <[email-masked]>
    Message-ID:  <a05111b0dbb5eff8cc6c6@[192.149.252.108]>

  | Under what conditions can a response have the aa bit off and the ra bit off?

!aa just means server is not auth for the answer.
!ra just means no recursion available.

Those are independent, attempting to assign a common meaning to any
combination of those bits is not a wise thing to attempt.

I suspect that you're really asking "how can a server possibly ever
get data that it isn't auth for if it doesn't offer recursion"?

The answer to that is "any of a million ways, and nothing you should care
about".

Doing recursion for someone else is one way, glue is another, ...

kre

---

From: Roy Arends <[email-masked]>
Date: Wed, 13 Aug 2003 10:52:41 +0200 (CEST)

> The answer to that is "any of a million ways, and nothing you should care

Au contraire !

It is a good exercise. Classifying responses is handy for debugging
dns-related problems. I care about that. I assume more people do.

Roy

---

From: Robert Elz <[email-masked]>
Date: Wed, 13 Aug 2003 18:09:44 +0700

Date:        Wed, 13 Aug 2003 10:52:41 +0200 (CEST)
    From:        Roy Arends <[email-masked]>
    Message-ID:  <[email-masked]>

  | Au contraire !
  | 
  | It is a good exercise. Classifying responses is handy for debugging
  | dns-related problems. I care about that. I assume more people do.
 
Perhaps I used the wrong words.   What I meant was that nothing can
draw any firm conclusions about meaning from this - even if you think
you know today everything about how this might have happened, tomorrow
someone will invent a new way to get to the same state.

That's fine for a human who is willing to do the work, including e-mail
to server admins, wacko queries to the server to attempt to figure out
its version, e-mail to the software authors, ...

It isn't something that any software should ever use for any purpose
however, and in particular, the

query that Ed asked in the message that started this - yes, it is
possible, but it is only one possibility, and it would be wrong to
conclude that is the correct interpretation in a particular case without
lots more investigation.

kre

---

From: Edward Lewis <[email-masked]>
Date: Wed, 13 Aug 2003 09:23:43 -0400

>its version, e-mail to the software authors, ...

Willing, well, is one word...'directed' is another. ;)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

---

From: Edward Lewis <[email-masked]>
Date: Wed, 13 Aug 2003 09:22:17 -0400

>get data that it isn't auth for if it doesn't offer recursion"?

Pretty much...

>The answer to that is "any of a million ways, and nothing you should care

In the context I'm in, it matters.  Under the banner of "lame 
delegation testing," I want to make sure that named servers are 
authoritative and not just answering.  I also want to be able to send 
a heuristic statement about "what's the matter" to the delegation's 
operator.  (Ya know, turnover of staff and whatnot.)

<The testing per se is OT for this list, I was just trying to 
understand the protocol settings I was seeing.  If anyone wants to 
discuss the testing, try [email-masked]>

>Doing recursion for someone else is one way, glue is another, ...

Okay - in my context (SOA lookups) it seems like it would be 
insidious, under-handed recursion and not glue. ;)