Home page logo

nanog logo nanog mailing list archives

Re: Odd DNS responses for www.neopets.com
From: "Adam \"Tauvix\" Debus" <nanog () delsol net>
Date: Wed, 5 Feb 2003 19:44:38 -0800

When I worked for NeoPets in the summer of 2000 they had a server farm about
that size. It was behind a NetFoundry (I think) Load Balancer at the time.
Perhaps their load balancer died and they had to get back up in a hurry.


Adam "Tauvix" Debus
Linux Certified Professional, Linux Certified Administrator #447641
Network Administrator, ReachONE Internet
adam () reachone com

----- Original Message -----
From: "Deepak Jain" <deepak () ai net>
To: "Alex Lambert" <alambert () quickfire org>; "Stephen Milton"
<milton () isomedia com>; <nanog () merit edu>
Sent: Wednesday, February 05, 2003 7:40 PM
Subject: RE: Odd DNS responses for www.neopets.com

Maybe it's just me, but isn't there something odd about a DNS query
coming back with 78 entries for the same host?  It sends back an UDP
packet that gets truncated and the DNS resolver reverts to TCP to get
the full list.

This is often used for server pools (as I'm guessing you know).

It seems to cause problems with Windows clients and/or Windows DNS
servers.  Seems like overkill.

The 78 addresses listed here are all in one bit of a /24. In the
cases I've
seen, there are a few servers listed in several different locations,
network- (and location-) wise. I agree that this looks really
weird. Perhaps
they use it as a cheap load balancer?

Perhaps they use it to pad their IP allocations??


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]