linux-kernel - 1.0.0.0 DNS replies for many domain names (network)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <78c462ad0712140350v62ae169fm7a2ce077325ace5f@mail.gmail.com>
Date:	Fri, 14 Dec 2007 17:20:17 +0530
From:	"Amogh Hooshdar" <amoghhooshdar@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: 1.0.0.0 DNS replies for many domain names (network)

I am having a strange problem with Debian Etch 4.0 (both 64-bit and
32-bit) using 2.6.18 kernel. Most websites do not open with browser,
Pidgin and most other GUI applicatoins. but I am able to ping them
fine. I am also able to do nslookup properly. When I tried to
investigate it with Wireshark net sniffer, I observed the following.

PROBLEM WITH 2.6.18
Say, I try to open www.google.com, browser sends DNS query for
www.google.com to my DNS server which is correctly configured in
resolv.conf. It replies with the correct IP address. www.google.com
redirects the browser to www.google.co.in. browser sends a DNS query
again for www.google.co.in and the DNS server replies with 1.0.0.0
which obviously is the wrong address.

Similar thing happens for many other domains like ftp.us.debian.org,
etc. It is quite random and happens 95% of the times. In other words I
am virtually not able to access internet.

OK WITH 2.6.20
The above was for Debian. With a Ubuntu 7.04 which has 2.6.20 kernel
everything is fine. no problems at all. With windows also no problem
at all.

Is this due to something in the 2.6.18 kernel which is related to the
way it sends a DNS query. Any information on this subject would be
highly appreciated since I am trying to understand why one distro
causes the problem and not the other. is it related to the kernel or
only to the distro?

Key words: DNS, domain, networking, IP address
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/