Yadda za a bincika masu warware DNS da Mac ɗinka ke amfani da su a VPN

scutil --dns yana buga tsarin mai warwarewar da macOS ke tuntuɓa a zahiri, ba uwar garken DNS ɗaya da ka rubuta a kwamitin saituna ba. Fitarwar ta fi tsawon da yawancin mutane suke tsammani, domin tsarin yana riƙe da blok ɗin mai warware daban don hanyar da aka saba, don mahallin da ke da iyaka, da kuma don tura mai alaƙa da yanki. Blok ɗin da ke saman fitarwar ba lallai ba ne shine wanda ke amsa tambayar. Idan wani suna na sirri ya warware a ofis kuma ya kasa a daidai lokacin da VPN ɗin ya tashi, rashin daidaiton yana cikin ƙa'idodin daidaitawa da hanyoyi, ba a adireshin uwar garke ba. Karanta tsari tukuna, sannan tabbatar da amsa da bincike na gaske.

Karanta tsarin blok ɗin kafin adiresoshin

Kowane shigarwa yana buɗewa da resolver #N kuma yana lissafa nameserver[0], wani lokaci if_index, layin flags, reach, kuma idan blok ɗin ba daidaitaccen na kowa ba ne, domain da jerin search domain. Mai warware mai lamba 1 ba tare da yanki ba shine na kowa da ke kula da sunayen jama'a. Duk abin da ke ɗauke da Scoped a cikin tutocinsa yana da alaƙa da mahallin da if_index ya ambata, kuma duk abin da aka yiwa Supplemental alama yana aiki ne kawai ga yankunan da aka jera a ƙarƙashinsa.

Zaɓi shine daidaita ƙarshen kalma. Don suna kamar intranet.corp.example, macOS yana fifita mai warware wanda shigarwar domain ta kasance mafi tsayin ƙarshen da ya dace, don haka blok ɗin da ke da domain : corp.example yana cin nasara akan na kowa koda yana can ƙasa a fitarwar. order yana warware daidaito tsakanin yankuna masu tsayi ɗaya. Kallon farko ba safai yake buƙatar fiye da wannan ba: dukan fitarwar idan kana son karanta blok ɗaya daga farko zuwa ƙarshe, layukan farko don koyon tsarin blok ɗin, da wucewar da aka tace wanda ke buga kanun blok ɗin gefen layukan filin. Blok ɗin da ke da iyaka suna bayyana ƙarƙashin nasu kanun kuma ana karanta su kamar ci gaba da jerin da ke samansu, don haka riƙe kanu a gani duk lokacin da ka kawo fitarwar.

scutil --dns
scutil --dns | sed -n '1,45p'
scutil --dns | grep -nE '^resolver #|^DNS configuration'
scutil --dns | grep -nE 'resolver #[0-9]+|if_index|domain|flags|nameserver'

Haɗa if_index da mahallin ramin

Fihirisa yana da amfani ne kawai idan za ka iya ambaton mahallin da ke bayansa. scutil --nwi yana lissafa bayanan cibiyar sadarwar da tsarin ke riƙe, ciki har da babban mahalli da isarsuwa, yayin da ifconfig -l ke ba ka sunayen, inda utun0 zuwa utun9 sune 'yan takarar rami da abokin ciniki ke ƙirƙira yawanci. Apple yana amfani da scutil --dns a matsayin nasa misalin bincike a cikin jagorar turawa, kuma yana rubuta yadda Network Extension zai iya tura zaɓaɓɓun yankuna zuwa zaɓaɓɓun masu warware, wanda shine hanyar da waɗannan blok ɗin masu iyaka ke bayyanawa.

Binciken da ke warware tambayar shine ko mai warwarewar yana kan hanyar da ramin ya girka:

scutil --nwi
ifconfig utun4
route -n get 10.20.0.53
netstat -rn | grep -m5 utun

Idan route -n get ya dawo da ƙofa da mahalli waɗanda ba su dace da shigarwar mai warware ba, adireshin na iya zama daidai kuma duk da haka ba za a iya isa ba. Ramin da aka raba wanda ke ɗauke da ƙananan hanyoyin kamfanin kawai yana watsar da tambayoyin da aka nufa ga uwar garken DNS a wajensu, kuma gazawar tana bayyana a matsayin ƙarewar lokaci, shi ya sa fitarwar tsarin ke ci gaba da kama da tsafta.

Tambayi mai warwarewar tsarin, sannan uwar garken

Kayan aiki uku suna amsa tambayoyi uku daban-daban, kuma rikita su yana haifar da yawancin yanke shawara marasa kyau a wannan fannin. dscacheutil -q host -a name yana wucewa ta wurin mai warwarewar tsarin da talakawan aikace-aikace ke amfani da shi, don haka blok ɗin masu iyaka da na ƙari suna aiki. dig ba tare da hujjar uwar garke ba yana karanta /etc/resolv.conf, wanda ba shine tushen gaskiya ga warware mai iyaka a macOS ba, kuma yana tsallake ƙa'idodin kowane yanki gaba ɗaya. dig @address yana isa uwar garke ɗaya daidai kuma ba ya gaya maka komai game da zaɓi.

dscacheutil -q host -a name intranet.corp.example
dig intranet.corp.example
dig @10.20.0.53 intranet.corp.example
nslookup intranet.corp.example

Lokacin da umarnin farko ya amsa kuma na biyu ya dawo da NXDOMAIN, ka sami rabuwar da kake nema kuma babu abin da ya lalace. Lokacin da na farko ya ƙare a lokaci yayin da dig @10.20.0.53 ke amsa, mai warwarewar yana aiki amma ba za a iya isa ba a hanyar da ramin ya zaɓa, don haka mataki na gaba shine route -n get maimakon gyara saitunan DNS. Ka riƙe sunayen sirri daga duk abin da ka liƙa a tikiti ko rubutu da aka raba.

Abin da fitarwar ba za ta iya nuna maka ba

Yadudduka da yawa suna zaune sama ko gefen jerin masu warware, kuma kowanne zai iya aika tambaya zuwa wani wuri da fitarwar ba ta taɓa ambatawa ba. Mai bincike da ke da DNS mai aminci a kunne zai iya warware ta hanyar rufaffen tasharsa, don haka shafi da ke lodawa yayin da dscacheutil ke ƙarewa ba sabani ba ne. Wakilin DNS da software na tsaro ya girka yana aiki a matsayin mai ba da Network Extension kuma yana tura tambayoyi da kansa, kuma scutil --dns yana nuna abin da aka saita maimakon adireshin sama da wakilin ya yi amfani da shi a ƙarshe. Yankunan bincike suna ƙara murɗawa ta uku: sunan da bai cancanta ba ana ƙara masa kowace ƙarshen da aka jera a tsari, don haka blok ɗin da ya amsa na iya zama wanda ba ka taɓa zato ba.

Amsoshin da suka tsufa sune mafi arha a ware kuma mafi yawan tsallakewa:

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
scutil --dns | head -20

Idan fitarwar ta canza bayan wankewa, yanayin yana cikin ajiya kuma fitarwar da ta gabata tana bayanin ramin da bai wanzu ba kuma. Idan bai canza ba, tsarin shine yadda yake, kuma tambayar ta koma hanyoyi da manufar aikace-aikace.

Takaitaccen jagora na kafin da bayan

Ɗauki tushen layi ne kawai a inda manufa ta yarda, kuma ka riƙe fayilolin a wajen kowane babban fayil da aka daidaita. Jerin da ke ƙasa shine abin da nake gudanarwa a injinan abokan ciniki: ɗauki tushen, haɗa, sake ɗauka, sannan bambanta kuma bincika.

scutil --dns > ~/dns-before.txt
# connect the VPN, then:
scutil --dns > ~/dns-after.txt
diff -u ~/dns-before.txt ~/dns-after.txt
dscacheutil -q host -a name intranet.corp.example

Karanta bambancin ta blok ba ta layi ba. Sabon mai warware mai iyaka wanda ke ɗauke da fihirisan mahallin rami da shigarwar domain don ƙarshen sirri shine siffar da ake tsammani. Sabon mai warware na kowa wanda ke nuni ga adireshin jama'a wani bincike ne da ya cancanci a kawo wa wanda ya mallaki bayanan abokin ciniki. Sannan sake maimaita binciken a cikin aikace-aikacen da ya gaza a zahiri, ba kawai a cikin harsashi ba, kuma rubuta mahallin daga route -n get gefen sakamakon.

Don soke canji, cire haɗin kuma sake maimaita ɗaukar tushen layi. Idan blok ɗin mai iyaka ya tafi, abokin ciniki ya share bayansa. Idan blok ɗin har yanzu ana lissafa shi da mahallin da bai wanzu ba kuma, yanayin ya tsufa, kuma wankewa tare da sake haɗawa shine mafi taushin gyara kafin wani ya taɓa bayanan.

Bincike huɗu a wannan tsari: shin wani blok ɗin mai warware ya dace da mafi tsayin ƙarshen sunan; shin wannan blok ɗin yana da alaƙa da mahallin da ramin ya girka; shin hanyar zuwa uwar garken sunansa tana amfani da ramin; kuma shin mai warwarewar tsarin, ba dig ba, yana mayar da amsar. Binciken farko da ya gaza yana gaya maka ko za ka canza manufar DNS, hanyoyin ramin, ko aikace-aikacen. Idan duka huɗu sun wuce kuma sunan har yanzu ya gaza, matsalar tana sama da DNS, kuma abu na gaba da za a bincika shine duk abin da ke amsa tashar 53 a gabansa.