Bi tambayar DNS mataki-mataki don gano ainihin tushen
Adireshin resolver da aka tura wa abokin ciniki ba ya ƙayyade wane tushe resolver ke gani. Bi abokin ciniki, mai turawa da uwar garken da ke karɓa, sannan ka rubuta hanyar.
Ba wa abokin ciniki adireshin resolver yana ƙayyade inda ake tura tambayoyi, ba wane tushe resolver zai gani ba. Sarrafa hanya, turawa da fassara kowanne yana da nasa lokaci tsakanin ƙarshen biyu. Littafin jagora na tambayoyin tushe yana bin tambayar mataki-mataki kuma yana rubuta abin da kowane mai lura ya gani a zahiri. Tsari yana da muhimmanci, domin maganar da aka yi kafin lura kawai zato ne da ingantaccen tsari.
Rubuta tsarin kafin ka tattara hujjoji
Wurare huɗu na iya gaya maka wani abu game da tushen DNS, kuma ba dukansu suke faɗin abu ɗaya ba. Ƙwaƙwalwar abokin ciniki ta san wane tushe zai yi amfani da shi, mai turawa ya san abin da ya aika zuwa sama, na'urar da ke fassara ta san abin da ta sake rubutawa, kuma resolver mai karɓa ya san abin da ya iso. Rubuta waɗanne daga cikinsu za ka iya isa da gaske kafin ka tattara komai.
| Observation point | What it can prove | What it cannot prove | How to read it |
|---|---|---|---|
| client kernel | which source address it would use for that resolver | anything a device in between rewrote | ip route get against the resolver address |
| forwarder | that it sent an upstream query, and from which source | what the client originally asked for | its own log and its cache state |
| translating device | that a source was rewritten, and to what | whether the query was legitimate | NAT policy and its counters |
| receiving resolver | the address that actually arrived | which client behind that address asked | a scoped capture on port 53 |
Rubuta kuma abin da kake tsammani, har da resolver ɗin da kake tsammanin ana amfani da shi. Hanyar da aka raba na iya tura tambayar wani wuri daban, kuma cache na iya amsawa ba tare da wata musayar zuwa sama ba, don haka zaton da aka riƙe a tunani kawai ba zai tsira daga mamaki na farko ba. Riƙe tsarin da aka bayyana da hanyar da aka lura a ginshiƙai daban na rubutu ɗaya; idan biyun ba su daidaita, ka sami tambayar da ta cancanci bibiya.
Duba wane tsari ne ya aika tambayar da gaske
Fara daga abokin ciniki: rubuta adireshin resolver, sunan tambayar da lokaci, sannan tabbatar da wane tsari ne ya aika ta. Layin farko da ke ƙasa yana ambaton tsarin da ke riƙe da socket ɗin UDP, kuma wannan ita ce duba da wannan kanun ya yi alkawari. Idan wannan tsari mataimakin burauza ne ko yanayin gudanar da kwantena maimakon resolver ɗin tsarin, sauran sawun yana bayyana hanyar da babu wanda ya nema.
ss -tunp 'dport = :53'
dig @10.20.30.53 host.corp.example +noall +answer
ip route get 10.20.30.53A kan na'ura mai mu'amala da yawa, gano wane adireshin tushe ƙwaƙwalwar ke zaɓa don wannan manufa kafin ka duba wani wuri. Wannan shi ne matsayi na ƙarshe da hanyar ke gaba ɗaya ƙarƙashin ikonka, kuma ita ce ƙimar da za ka kwatanta da abin da resolver ke bayarwa. Bambanci alama ce da wani abu a tsakiya ya sake rubuta fakitin, ko an aika tambayoyi biyu daban-daban.
Riƙe sunayen gwaji a ciki, domin sunan ciki da aka aika zuwa resolver na jama'a ba ya tabbatar da komai game da hanyar ciki kuma yana wallafa sunan da ba ka buƙatar wallafawa. Burauza mai amfani da DNS mai tsaro ba zai bayyana a cikin jerin socket ɗin ba kwata-kwata, kuma wannan rashi shi ne amsar.
Mai turawa yana yin tambaya ta biyu daban
Mai turawa yana mai da musayar ɗaya zuwa biyu. Buƙatar daga ƙasa tana iso, sannan mai turawa ya aika tambayarsa zuwa sama daga adireshin da ya zaɓa. Tsarinsa, ba abokin ciniki ba, shi ne ke ƙayyade abin da resolver na sama ke gani.
littafin dnsmasq ya cancanci karantawa saboda wannan dalili: yana bayyana yadda mai turawa ke zaɓar uwar garken sama da yadda yake ɗaure gefen sauraro, kuma babu wani abu a cikin wannan tsari da ke ɗaukar tushen abokin ciniki zuwa sama. Don haka log ɗin resolver da ke nuna adireshin ƙofa abu ne na al'ada, ba hujjar lalacewa ba. Rashi ma ana iya karanta shi ba daidai ba kamar haka, domin bugun cache ba ya haifar da wata tambaya zuwa sama kuma yana kama da tambayar da ba ta taɓa zuwa ba. Karanta tsarin mai turawa da yanayin cache ɗinsa kafin ka yanke ɗaya daga cikin shari'o'in biyu. Tambayoyi biyu, wurare biyu da za a duba.
Karanta tushen a resolver mai karɓa
Lura ɗaya tilo da ke warware wannan ana yin ta a gefen uwar garke. Duk abin da aka tsinkaya daga jerin mu'amalar abokin ciniki ya kasance zato ne har resolver ya bayar da rahoton abin da ya iso da gaske.
tcpdump -ni any port 53 and host 10.20.30.53Ɗauki hoto a na'urar resolver, riƙe hoton gajere kuma mai iyaka, kuma adana shi inda manufa ta yarda. Idan tushen da aka lura adireshi ne da aka fassara, tambaya ta gaba ita ce wace na'ura ta yi fassarar kuma ko manufarta ita ce da aka yi niyya. Hoto yana amsa abin da ya iso; ba ya bayyana dalilin da manufa ta yarda da shi. Ambaci mai lura da matakin a cikin rubutu, domin maganar sirri game da ƙofa magana ce game da wannan matakin, ba game da dukan hanyar ba.
Rubuta binciken a matsayin hanya, ba adireshi ba
Rubuta abokin ciniki, resolver, kowane mai turawa, tushen da aka lura a kowane mataki da manufar da ke tafiyar da shi. Irin wannan rikodin yana amsa yawancin tambayoyin nan gaba ba tare da wani hoto ba. Zana shi a matsayin sarƙa, domin jerin adireshi yana ɓoye wane mataki ya haifar da wanne.
Haɗa kwanan wata, sigar abokin ciniki da bitar tsari ga zanen, domin mai karatu daga baya ya iya cewa ko har yanzu yana aiki. Raba tushen jigilar kaya daga duk abin da sabis ɗin ke sarrafawa, domin ganin adireshin ƙofa ba ya faɗin komai game da abin da kuma ake adanawa. Matsayin resolver ma ba ya faɗin komai game da wane abokin ciniki ya tambaya. Raba waɗannan maganganu shi ne ke sa shawarar ta kasance mai iya karewa a bita.