12.6 Less-Common Tasks
The following sections describe tricks you'll probably have to use less often but are still handy to have in your repertoire . Most of these will be helpful when you're trying to troubleshoot a DNS problem; they'll enable you to grub around in the messages the resolver sees and mimic a name server querying another name server or transferring zone data.
12.6.1 Seeing the Query and Response Messages
If you need to, you can direct nslookup to show you the queries it sends out and the responses it receives. Turning on debug shows you the responses. Turning on d2 shows you the queries as well. When you want to turn off debugging completely, you have to use set nodebug , since set nod2 turns off only level 2 debugging. After the following trace, we'll explain some parts of the message output. If you want, you can pull out your copy of RFC 1035, turn to page 25, and read along with our explanation.
C:\> nslookup Default Server: terminator.movie.edu Address: 184.108.40.206 > set q=mx > acmebw.com. Server: terminator.movie.edu Address: 220.127.116.11 ------------ Got answer: HEADER: opcode = QUERY, id = 9, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 2, authority records = 0, additional = 2 QUESTIONS: acmebw.com, type = MX, class = IN ANSWERS: -> acmebw.com type = MX, class = IN, dlen = 29 MX preference = 10, mail exchanger = store-forward.MSPRING.NET ttl = 86400 (1 day) -> acmebw.com type = MX, class = IN, dlen = 17 MX preference = 0, mail exchanger = domain-relay.MSPRING.NET ttl = 86400 (1 day) ADDITIONAL RECORDS: -> store-forward.MSPRING.NET type = A, class = IN, dlen = 4 internet address = 18.104.22.168 ttl = 3600 (1 hour) -> domain-relay.MSPRING.NET type = A, class = IN, dlen = 4 internet address = 22.214.171.124 ttl = 3600 (1 hour) ------------ Non-authoritative answer: acmebw.com type = MX, class = IN, dlen = 29 MX preference = 10, mail exchanger = store-forward.MSPRING.NET ttl = 86400 (1 day) acmebw.com type = MX, class = IN, dlen = 17 MX preference = 0, mail exchanger = domain-relay.MSPRING.NET ttl = 86400 (1 day) store-forward.MSPRING.NET type = A, class = IN, dlen = 4 internet address = 126.96.36.199 ttl = 3600 (1 hour) domain-relay.MSPRING.NET type = A, class = IN, dlen = 4 internet address = 188.8.131.52 ttl = 3600 (1 hour) > > set d2 > acmebw.com. Server: terminator.movie.edu Address: 184.108.40.206
This time the query is also shown:
------------ SendRequest( ), len 28 HEADER: opcode = QUERY, id = 9, rcode = NOERROR header flags: query, want recursion questions = 1, answers = 0, authority records = 0, additional = 0 QUESTIONS: acmebw.com, type = MX, class = IN ------------ ------------ Got answer (130 bytes):
The answer is the same as in the previous example.
The text between the dashes are the query and response messages. As promised , we will go through the message contents. DNS messages are composed of five sections:
For you sticklers for detail, there is a time when the number of questions in a query message isn't one: in an inverse query, when it's zero. In an inverse query, there is one answer in the query message, and the Question section is empty. The name server fills in the question. But, as we said, inverse queries are almost nonexistent. The Microsoft DNS Server doesn't even support them.
12.6.2 Querying Like a Name Server
You can make nslookup send out the same query message a name server would. Name server query messages are not much different from resolver messages. The primary difference in the query messages is that resolvers request recursion and name servers seldom do. Recursion is the default with nslookup , so you have to explicitly turn it off. The difference in operation between a resolver and a name server is that the resolver implements the search list and the name server doesn't. By default, nslookup implements the search list, so that, too, has to be turned off. Of course, judicious use of the trailing dot will have the same effect.
In raw nslookup terms, this means that to query like a resolver, you use nslookup 's default settings. To query like a name server, use set norecurse and set nosearch . On the command line, that's nslookup -norecurse -nosearch .
When a name server gets a query, it looks for the answer in its cache. If it doesn't have the answer and it is authoritative for the zone, the name server responds that the name doesn't exist or that there is no data for that type. If the name server doesn't have the answer and it is not authoritative for the zone, it starts walking up the namespace looking for NS records. There will always be NS records somewhere higher in the domain tree. As a last resort, it will use the NS records at the root domain, the highest level.
If the name server received a nonrecursive query, it would respond to the querier by giving the NS records that it had found. On the other hand, if the original query was a recursive query, the name server would then query the remote name servers in the NS records that it found. When the name server receives a response from one of the remote name servers, it caches the response and repeats this process, if necessary. The remote server's response will contain either the answer to the question or a list of name servers lower in the namespace and closer to the answer.
Let's assume for our example that we are trying to satisfy a recursive query and that we didn't find any NS records until we checked the gov domain. That is in fact the case when we ask the name server on relay.hp.com about www.whitehouse.gov it doesn't find any NS records until the gov domain. From there we switch servers to a gov name server and ask the same question. It directs us to the whitehouse.gov servers. We then switch to a whitehouse.gov name server and ask the same question:
C:\> nslookup Default Server: relay.hp.com Address: 220.127.116.11 > set norec -- Query like a name server: turn off recursion > set nosearch -- Turn off the search list > www.whitehouse.gov -- We don't need to dot-terminate since we've turned search off Server: relay.hp.com Address: 18.104.22.168 Name: www.whitehouse.gov Served by: - H.ROOT-SERVERS.NET 22.214.171.124 gov - B.ROOT-SERVERS.NET 126.96.36.199 gov - C.ROOT-SERVERS.NET 188.8.131.52 gov - D.ROOT-SERVERS.NET 184.108.40.206 gov - E.ROOT-SERVERS.NET 220.127.116.11 gov - I.ROOT-SERVERS.NET 18.104.22.168 gov - F.ROOT-SERVERS.NET 22.214.171.124 gov - G.ROOT-SERVERS.NET 126.96.36.199 gov - A.ROOT-SERVERS.NET 188.8.131.52 gov
Switch to a gov name server. You may have to turn recursion back on temporarily, if the name server doesn't have the address already cached:
> server e.root-servers.net Default Server: e.root-servers.net Address: 184.108.40.206
Ask the same question of the gov name server. It will refer us to name servers closer to our desired answer:
> www.whitehouse.gov. Server: e.root-servers.net Address: 220.127.116.11 Name: www.whitehouse.gov Served by: - SEC1.DNS.PSI.NET 18.104.22.168 WHITEHOUSE.GOV - SEC2.DNS.PSI.NET 22.214.171.124 WHITEHOUSE.GOV
Switch to a whitehouse.gov name servereither of them will do:
> server sec1.dns.psi.net. Default Server: sec1.dns.psi.net Address: 126.96.36.199 > www.whitehouse.gov. Server: sec1.dns.psi.net Address: 188.8.131.52 Name: www.whitehouse.gov Addresses: 184.108.40.206, 220.127.116.11
We hope this example gives you a feeling for how name servers look up names . If you need to refresh your understanding of what this looks like graphically, flip back to Figure 2-12 and Figure 2-13.
Before we move on, notice that we asked each of the servers the very same question: "What's the address for www.whitehouse.gov ?" What do you think would happen if the gov name server itself had already cached www.whitehouse.gov 's address? The gov name server would have answered the question out of its cache instead of referring us to the whitehouse.gov name servers. Why is this significant? Suppose you messed up a particular host's address in your zone. Someone points it out to you, and you clean up the problem. Even though your name server now has the correct data, some remote sites find the old, messed-up data when they look up the name. One of the name servers higher up in the domain tree has cached the incorrect data; when it receives a query for that host's address, it returns the incorrect data instead of referring the querier to your name servers. What makes this problem hard to track down is that only one of the "higher up" name servers has cached the incorrect data, so only some of the remote lookups get the wrong answerthe ones that use this server. Fun, huh? Eventually, though, the "higher up" name server will time out the old record. If you're pressed for time, you can contact the administrators of the remote name server and ask them to kill and restart their name servers to flush the cache. Of course, if the remote name server is an important, much-used name server, they may tell you where to go with that suggestion.
12.6.3 Zone Transfers
You can use nslookup to transfer a whole zone with the ls command. This feature is useful for troubleshooting, for figuring out how to spell a remote host's name, or just for counting how many hosts are in some remote zone. Since the output can be substantial, nslookup allows you to redirect the output to a file.
Beware: a lot of hosts won't let you pull a copy of their zones, either for security reasons or to limit the load on their name server hosts. The Internet is a friendly place, but administrators have to defend their turf.
nslookup filters zone transfer data: it shows you only some of the zone unless you tell it otherwise . By default, you see only address and name server data. You will see all of the zone data if you tell nslookup to display data of any type. The nslookup help (available in the main Windows 2000 help) or command summary (shown by typing help at the nslookup prompt) tells you all the parameters to the ls command. We are going to show only the -t parameter, since the others can be emulated with -t . The -t option takes one argument: the data type to filter on. So, to pull a copy of a zone and see all the MX data, use ls -t mx . Let's do some zone transfers:
C:\> nslookup Default Server: terminator.movie.edu Address: 18.104.22.168 > ls movie.edu. -- List NS and A records for movie.edu [terminator.movie.edu] movie.edu. NS server = terminator.movie.edu movie.edu. NS server = wormhole.movie.edu carrie A 22.214.171.124 diehard A 126.96.36.199 misery A 188.8.131.52 robocop A 184.108.40.206 shining A 220.127.116.11 terminator A 18.104.22.168 wh249 A 22.214.171.124 wh253 A 126.96.36.199 wormhole A 188.8.131.52 wormhole A 184.108.40.206 > ls -t any movie.edu > /temp/movie.edu.txt -- List all data into \temp\ -- movie.edu.txt [terminator.movie.edu] Received 25 records.
Those forward slashes in the ls command aren't a misprint?I>nslookup was originally written for Unix as part of the BIND distribution. Microsoft must have missed the slashes when porting nslookup to Windows 2000.