Landela umbuzo we-DNS isinyathelo ngesinyathelo ukuthola umthombo wangempela
Ikheli le-resolver eliphushwayo alinqumi ukuthi i-resolver ibona muphi umthombo. Landela iklayenti, isidluliseli kanye neseva eyamukelayo, bese ubhala indlela.
Ukunikeza iklayenti ikheli le-resolver kunquma ukuthi imibuzo iyaphi, hhayi ukuthi i-resolver izobona muphi umthombo. Ukuhlela indlela, ukudlulisa kanye nokuhumusha konke kuba nesikhathi sakho phakathi kwemikhawulo emibili. Incwadi yokulandela yemibuzo yomthombo ilandela umbuzo isinyathelo ngesinyathelo futhi ibhala lokho umbonisi ngamunye akubona ngempela. Ukulandelana kubalulekile, ngoba isitatimende esenziwe ngaphambi kokubona siyinto nje yokuqagela enokuhleleka okungcono.
Bhala ukuhlelwa ngaphambi kokuqoqa ubufakazi
Izindawo ezine zingakutshela okuthile mayelana nomthombo we-DNS, futhi azikusho konke into efanayo. Ikhirnuli yeklayenti iyazi ukuthi izosebenzisa muphi umthombo, isidluliseli siyazi ukuthi sathumela ini phezulu, idivayisi ehumushayo iyazi ukuthi yabhala ini futhi, futhi i-resolver eyamukelayo iyazi ukuthi kwafika ini. Bhala ukuthi yikuphi kwalokhu ongafinyelela kukho ngempela ngaphambi kokuqoqa noma yini.
| Observation point | What it can prove | What it cannot prove | How to read it |
|---|---|---|---|
| client kernel | which source address it would use for that resolver | anything a device in between rewrote | ip route get against the resolver address |
| forwarder | that it sent an upstream query, and from which source | what the client originally asked for | its own log and its cache state |
| translating device | that a source was rewritten, and to what | whether the query was legitimate | NAT policy and its counters |
| receiving resolver | the address that actually arrived | which client behind that address asked | a scoped capture on port 53 |
Bhala futhi okulindelwe nguwe, kuhlanganise ne-resolver okholelwa ukuthi iyasetshenziswa. Indlela ehlukanisiwe ingathumela umbuzo kwenye indawo ngokuphelele, futhi i-cache ingaphendula ngaphandle kwanoma yikuphi ukushintshana phezulu, ngakho-ke umqondo ogcinwa engqondweni kuphela awusoze wadlula isimangaliso sokuqala. Gcina umklamo oshiwo kanye nendlela eboniwe kumakholomu ahlukene ombhalo ofanayo; lapho kokubili kungavumelani, uthole umbuzo ofanele ukulandelwa.
Hlola ukuthi iyiphi inqubo eyathumela umbuzo ngempela
Qala eklayentini: bhala ikheli le-resolver, igama lombuzo kanye nesikhathi, bese uqinisekisa ukuthi iyiphi inqubo eyawuthumela. Umugqa wokuqala ngezansi usho inqubo ephethe isokhethi ye-UDP, futhi lokho ukuhlola okuthenjiswa yilesi sihloko. Uma leyo nqubo ingumsizi wesiphequluli noma indawo yokusebenza ye-container esikhundleni se-resolver yohlelo, umkhondo osele uchaza indlela okungekho muntu oyicelile.
ss -tunp 'dport = :53'
dig @10.20.30.53 host.corp.example +noall +answer
ip route get 10.20.30.53Kusibungu esinezixhumanisi eziningi, thola ukuthi iyiphi ikheli lomthombo elikhethwa yikhirnuli kuleyo ndawo ngaphambi kokuba ubheke kwenye indawo. Lelo yiphuzu lokugcina lapho indlela isengaphansi kwakho ngokuphelele, futhi yilona nalelo inani ozolifanisa nalokho okubikwa yi-resolver. Ukungavumelani kuwuphawu lokuthi okuthile phakathi kubhale kabusha iphakethe, noma ukuthi imibuzo emibili ehlukene ithunyelwe.
Gcina amagama okuhlola engaphakathi, ngoba igama langaphakathi elithunyelwa ku-resolver yomphakathi alifakazeli lutho ngendlela yangaphakathi futhi lishicilela igama obekungadingeki ukuba ulishicilele. Isiphequluli esine-DNS evikekile evuliwe ngeke sivele nhlobo kulolo hlu lwamasokhethi, futhi lokho kungabikhona kuyimpendulo uqobo.
Isidluliseli senza umbuzo wesibili ohlukile
Isidluliseli siphendula ukushintshana okukodwa kube okubili. Isicelo esivela ngezansi siyafika, bese isidluliseli sithumela umbuzo waso phezulu lisuka ekhelini elilikhethayo. Ukuhlelwa kwaso, hhayi iklayenti, kunquma ukuthi i-resolver ephezulu ibona ini.
incwadi ye-dnsmasq ifanele ukufundwa ngenxa yaleso sizathu: ichaza ukuthi isidluliseli sikhetha kanjani amaseva aphezulu futhi sibopha uhlangothi lwaso lokulalela, futhi akukho lutho kulokho kuhlelwa okuthwala umthombo weklayenti phezulu. Ngakho-ke ilogi ye-resolver ekhombisa ikheli lesango yinto evamile, hhayi ubufakazi besiphambeko. Ukungabikhona nakho kulula ukukufunda ngokungalungile, ngoba ukushaya kwe-cache akukhiqizi mbuzo wephezulu futhi kubukeka kufana ncamashi nombuzo ongakaze ufike. Funda ukuhlelwa kwesidluliseli kanye nesimo se-cache yaso ngaphambi kokuthatha noma yisiphi salezi ziphetho ezimbili. Imibuzo emibili, izindawo ezimbili zokubheka.
Funda umthombo ku-resolver eyamukelayo
Ukubona okukodwa okuxazulula lokhu kuthathwa ohlangothini lweseva. Noma yini esuselwa ohlwini lwezixhumanisi zeklayenti ihlala iwumqondo wokuqagela kuze kube yilapho i-resolver ibika ukuthi kwafika ini ngempela.
tcpdump -ni any port 53 and host 10.20.30.53Thwebula kusibungu se-resolver, gcina ukuthwebula kufushane futhi kunomkhawulo, futhi kugcine lapho inqubomgomo ivuma khona. Uma umthombo oboniwe uyikheli elihunyushiwe, umbuzo olandelayo ukuthi iyiphi idivayisi eyenze ukuhumusha nokuthi inqubomgomo yayo yiloyo ebiyelwe yini. Ukuthwebula kuphendula ukuthi kwafika ini; akuchazi ukuthi kungani inqubomgomo ikuvumile. Shono umbonisi kanye nesinyathelo embhalweni, ngoba isitatimende sobumfihlo mayelana nesango siyisitatimende ngalelo sinyathelo, hhayi ngayo yonke indlela.
Bhala okutholakele njengendlela, hhayi njengekheli
Bhala iklayenti, i-resolver, noma yisiphi isidluliseli, umthombo oboniwe esinyathelweni ngasinye kanye nenqubomgomo ewulawulayo. Umbhalo onjalo uphendula imibuzo eminingi yesikhathi esizayo ngaphandle kokunye ukuthwebula. Dweba njengeketango, ngoba uhlu lwamakheli lufihla ukuthi isiphi isinyathelo esikhiqize siphi.
Namathisela emfanekisweni usuku, inguqulo yeklayenti kanye nokubuyekezwa kokuhlelwa, ukuze umfundi wakamuva akwazi ukusho ukuthi kusasebenza yini. Hlukanisa umthombo wokuthutha kukho konke okunye okucutshungulwa yisevisi, ngoba ukubona ikheli lesango akusho lutho mayelana nokuthi yini enye egciniwe. Indawo ye-resolver nayo ayisho lutho mayelana nokuthi iyiphi iklayenti ebuze. Ukuhlukanisa lezi zitatimende yikho okwenza isiphetho simeleke ekubuyekezweni.