🚀 go-pugleaf

Mark Anderson <mea@nospambradnylion.com> wrote:

> I am now a bit more curious thus this post.

"The reason why it's sending the query over and over is because the DNS
server is returning a DNS response of RCODE: 2 (ServFail), which is not a
normal response. It indicates a server misconfiguration. If the server were
to return the standard RCODE: 3 (NXDOMAIN) response, then mDNSResponder
would stop sending queries. It's still a bug in mDNSResponder that it's not
handling the ServFail very well, but it explains why only a few people are
seeing this issue. Most people have DNS servers that return NXDOMAIN as the
response."

It seems this bug comes up with various updates to OSX.

The simpliest solution it seems is to have only one dns entry on the macbook
for the dns resolvers. With only one entry it'll time out even with the
servfail being returned.

I dunno what you are doing with this network, handing out free wifi or
whatever, but changing the dhcp configuration so the connecting computers
only get one dns server should work also.

-bruce
bje@ripco.com

In article bje@ripco.com says...
> 
> Mark Anderson <mea@nospambradnylion.com> wrote:
> 
> > I am now a bit more curious thus this post.
> 
> "The reason why it's sending the query over and over is because the DNS
> server is returning a DNS response of RCODE: 2 (ServFail), which is not a
> normal response. It indicates a server misconfiguration. If the server were
> to return the standard RCODE: 3 (NXDOMAIN) response, then mDNSResponder
> would stop sending queries. It's still a bug in mDNSResponder that it's not
> handling the ServFail very well, but it explains why only a few people are
> seeing this issue. Most people have DNS servers that return NXDOMAIN as the
> response."
> 
> It seems this bug comes up with various updates to OSX.

I went over the traces again and these devices aren't attempting any 
normal DNS.  They get an IP from my DHCP server and then they instantly 
start into IPv6 MDNS broadcasts which goes to every device that happened 
to be connected at the time.  Every now and then they'll dump a cache 
flush which is how I know that one device was my neighbor's because her 
computer name got dumped.  I see no normal traffic from anyone once the 
blasts start and in short time my server shuts off the interface for 
protection (my code).

A typical set of packet broadcasts look like this:

16:41:00.517556 60:33:4b:0a:8d:6d > 33:33:00:00:00:fb, ethertype IPv6 
(0x86dd), length 276: fe80::6233:4bff:fe0a:8d6d.mdns > ff02::fb.mdns: 0 
[2a] [6q] PTR (QM)? _apple-mobdev._tcp.local. PTR (QM)? _afpovertcp.
_tcp.local. PTR (QM)? _smb._tcp.local. PTR (QM)? _rfb._tcp.local. PTR 
(QM)? _adisk._tcp.local. PTR (QM)? _airport._tcp.local. (214)

16:41:00.517611 60:33:4b:0a:8d:6d > 33:33:00:00:00:fb, ethertype IPv6 
(0x86dd), length 86: fe80::6233:4bff:fe0a:8d6d > ff02::fb: HBH ICMP6, 
multicast listener reportmax resp delay: 0 addr: ff02::fb, length 24

over and over and over ad infinitum.

My servers simply ignore this.

> The simpliest solution it seems is to have only one dns entry on the 
macbook
> for the dns resolvers. With only one entry it'll time out even with the
> servfail being returned.

So it does sound like there may be something funny in the MacBook 
network stacks.  

> I dunno what you are doing with this network, handing out free wifi or
> whatever, but changing the dhcp configuration so the connecting computers
> only get one dns server should work also.

I do only give out one dns server IP in DHCP and I block all attempts to 
use an outside dns.  They must use my dns server.  It is funny how some 
devices try and try to use their own only to succumb to the Borg.  The 
bug here is in the MacBook's IPv6 stack and how they deal with mdns.  I 
heard Apple is big into MDNS whereas other device manufacturers don't 
use it that much if at all.

As for giving out free wifi, I'm giving out free wifi much like Facebook 
gives out "free" web services.  The devices that connect to my network 
unknowingly test various software I'm working on and contribute 
analytics for my study.  The bandwidth they use is rather trivial since 
I turn off Netflix streaming (a huge BW hog) and the well known porn 
streaming sites like xvideo.com and xhamster.com.  Once porno addicts 
get wind of free streaming my network will get overloaded with perverts  
so I shut it off.  Last year I had 1200 unique visitors averaging around 
250 unique visitors per month.  Lots of regulars and the number of 
tablets connecting is through the roof now.

My network is fairly secure from p2p abuse and other tom foolery but 
it's still a work in progress.  At first I thought these mdns blasts 
were malicious but now not so much.  I wonder how open wifis at places 
like Starbucks and McDonalds deal with these kind of situations since 
these blasts will bring down any open wifi.  Maybe they have access 
points that can deal with this -- I don't know.

On Thu, 21 Feb 2013 12:52:48 -0500, Mark Anderson wrote:

> In article bje@ripco.com says...
>> 
>> Mark Anderson <mea@nospambradnylion.com> wrote:
>> 
>>> I am now a bit more curious thus this post.
>> 
>> "The reason why it's sending the query over and over is because the DNS
>> server is returning a DNS response of RCODE: 2 (ServFail), which is not a
>> normal response. It indicates a server misconfiguration. If the server were
>> to return the standard RCODE: 3 (NXDOMAIN) response, then mDNSResponder
>> would stop sending queries. It's still a bug in mDNSResponder that it's not
>> handling the ServFail very well, but it explains why only a few people are
>> seeing this issue. Most people have DNS servers that return NXDOMAIN as the
>> response."
>> 
>> It seems this bug comes up with various updates to OSX.
> 
> I went over the traces again and these devices aren't attempting any 
> normal DNS.  They get an IP from my DHCP server and then they instantly 
> start into IPv6 MDNS broadcasts which goes to every device that happened 
> to be connected at the time.  Every now and then they'll dump a cache 
> flush which is how I know that one device was my neighbor's because her 
> computer name got dumped.  I see no normal traffic from anyone once the 
> blasts start and in short time my server shuts off the interface for 
> protection (my code).
> 
> A typical set of packet broadcasts look like this:
> 
> 16:41:00.517556 60:33:4b:0a:8d:6d > 33:33:00:00:00:fb, ethertype IPv6 
> (0x86dd), length 276: fe80::6233:4bff:fe0a:8d6d.mdns > ff02::fb.mdns: 0 
> [2a] [6q] PTR (QM)? _apple-mobdev._tcp.local. PTR (QM)? _afpovertcp.
> _tcp.local. PTR (QM)? _smb._tcp.local. PTR (QM)? _rfb._tcp.local. PTR 
> (QM)? _adisk._tcp.local. PTR (QM)? _airport._tcp.local. (214)
> 
> 16:41:00.517611 60:33:4b:0a:8d:6d > 33:33:00:00:00:fb, ethertype IPv6 
> (0x86dd), length 86: fe80::6233:4bff:fe0a:8d6d > ff02::fb: HBH ICMP6, 
> multicast listener reportmax resp delay: 0 addr: ff02::fb, length 24
> 
> over and over and over ad infinitum.
> 
> My servers simply ignore this.
> 
>> The simpliest solution it seems is to have only one dns entry on the 
> macbook
>> for the dns resolvers. With only one entry it'll time out even with the
>> servfail being returned.
> 
> So it does sound like there may be something funny in the MacBook 
> network stacks.  
> 
>> I dunno what you are doing with this network, handing out free wifi or
>> whatever, but changing the dhcp configuration so the connecting computers
>> only get one dns server should work also.
> 
> I do only give out one dns server IP in DHCP and I block all attempts to 
> use an outside dns.  They must use my dns server.  It is funny how some 
> devices try and try to use their own only to succumb to the Borg.  The 
> bug here is in the MacBook's IPv6 stack and how they deal with mdns.  I 
> heard Apple is big into MDNS whereas other device manufacturers don't 
> use it that much if at all.
> 
> As for giving out free wifi, I'm giving out free wifi much like Facebook 
> gives out "free" web services.  The devices that connect to my network 
> unknowingly test various software I'm working on and contribute 
> analytics for my study.  The bandwidth they use is rather trivial since 
> I turn off Netflix streaming (a huge BW hog) and the well known porn 
> streaming sites like xvideo.com and xhamster.com.  Once porno addicts 
> get wind of free streaming my network will get overloaded with perverts  
> so I shut it off.  Last year I had 1200 unique visitors averaging around 
> 250 unique visitors per month.  Lots of regulars and the number of 
> tablets connecting is through the roof now.
> 
> My network is fairly secure from p2p abuse and other tom foolery but 
> it's still a work in progress.  At first I thought these mdns blasts 
> were malicious but now not so much.  I wonder how open wifis at places 
> like Starbucks and McDonalds deal with these kind of situations since 
> these blasts will bring down any open wifi.  Maybe they have access 
> points that can deal with this -- I don't know.

They deal with it by not having morons such as Mark Anderson design the
wifi network in the first place.

This is seriously one of the dumbest fucking things I've ever heard of.

-- 
smr

In article me@shawnritchie.com says...
> They deal with it by not having morons such as Mark Anderson design the
> wifi network in the first place.
> 
> This is seriously one of the dumbest fucking things I've ever heard of.

I think the term you're searching for here is VLAN.  Thanks for playing.  
And I haven't let loose with any details of whatever wifi design you 
think I fucked up not that anything like facts weigh in to one of your 
grumpy-hemmoroids-are-acting-up-again rants.

Mark Anderson <mea@nospambradnylion.com> wrote:
> In article me@shawnritchie.com says...
>> They deal with it by not having morons such as Mark Anderson design the
>> wifi network in the first place.
>> 
>> This is seriously one of the dumbest fucking things I've ever heard of.
> 
> I think the term you're searching for here is VLAN.  Thanks for playing.  
> And I haven't let loose with any details of whatever wifi design you 
> think I fucked up not that anything like facts weigh in to one of your 
> grumpy-hemmoroids-are-acting-up-again rants.

English, please.

On Thu, 21 Feb 2013 13:21:08 -0500, Mark Anderson wrote:

> In article me@shawnritchie.com says...
>> They deal with it by not having morons such as Mark Anderson design the
>> wifi network in the first place.
>> 
>> This is seriously one of the dumbest fucking things I've ever heard of.
> 
> I think the term you're searching for here is VLAN.  Thanks for playing.  
> And I haven't let loose with any details of whatever wifi design you 
> think I fucked up not that anything like facts weigh in to one of your 
> grumpy-hemmoroids-are-acting-up-again rants.

Yeah, I build networks for a good living, thanks.

The fact that you're running this "experiment", and I apologize to that
word since what you're doing here barely qualifies for it, using shitty
consumer-grade APs, that provide you zero of the data you need to actually
do anything with your results, AND you couldn't look up a basic, known bug
on your own means that your little science project is about as laughable
and less valid than a retarded fifth grader's baking soda volcano.

-- 
smr

In article <vl546mt245oi.1hq2quy7fglk2$.dlg@40tude.net>,
 smr <me@shawnritchie.com> wrote:

> Yeah, I build networks for a good living, thanks.

what a cunt thing to type

In article me@shawnritchie.com says...
> Yeah, I build networks for a good living, thanks.

It doesn't matter what you say you can do; what matters is that you can 
do as you say.


> The fact that you're running this "experiment", and I apologize to that
> word since what you're doing here barely qualifies for it, using shitty
> consumer-grade APs, 

This is rich.  Not knowing the problem space nor a single requirement 
you somehow have an idea on its implementation.  


This is a different bug than what Bruce mentioned and not being an Apple 
fanboi I don't know where to hunt down their bugs (although to Apple 
fanbois, any problems are someone else's fault. Apples are infallible).  
I posted here because I found it interesting and maybe someone with 
knowledge (not you obviously) would have some insight on a recent 
upgrade cycle with MacBooks.

On Thu, 21 Feb 2013 16:59:22 -0500, Mark Anderson wrote:

> In article me@shawnritchie.com says...
>> Yeah, I build networks for a good living, thanks.
> 
> It doesn't matter what you say you can do; what matters is that you can 
> do as you say.

Oh, I can, duder. Try me.

>> The fact that you're running this "experiment", and I apologize to that
>> word since what you're doing here barely qualifies for it, using shitty
>> consumer-grade APs, 
> 
> This is rich.  Not knowing the problem space nor a single requirement 
> you somehow have an idea on its implementation.  

Your design has led you to have to manually power-cycle APs multiple times
per day. And you think that, by blocking _websites_, you've somehow blocked
the majority of porn traffic, well... 

You also admit you can't govern this well enough to avoid having to just
shut it all down due to, according to your weirldy judgmental language,
"porno addicts" and "perverts".

I think the average user would be safer raw-dogging a west Chicago Ave.
hooker than attaching a device to your "free" wifi network.

> This is a different bug than what Bruce mentioned and not being an Apple 
> fanboi I don't know where to hunt down their bugs (although to Apple 
> fanbois, any problems are someone else's fault. Apples are infallible).  
> I posted here because I found it interesting and maybe someone with 
> knowledge (not you obviously) would have some insight on a recent 
> upgrade cycle with MacBooks.

Yes. It's a good tactic to blandly and incorrectly insult the entire
userbase that's likely to have the answer you're too incompetent to find
yourself. Let us know how that works out.

-- 
smr

MacOwner <macowner@gmail.com> wrote:
> In article <vl546mt245oi.1hq2quy7fglk2$.dlg@40tude.net>,
> smr <me@shawnritchie.com> wrote:
> 
>> Yeah, I build networks for a good living, thanks.
> 
> what a cunt thing to type

it may be, but I'm going to have to side with smr knows networking better 
than mr. spicy maggots.

Can somebody else explain what the point of the weird crashing wireless 
network with one dns server is again?

In article presence@MUNGEpanix.com says...
> Can somebody else explain what the point of the weird crashing wireless 
> network with one dns server is again?

You only need two dns servers if a certain level of reliability for that 
service is a requirement.  The open wifi is an unreliable resource.  In 
other words, you get what you pay for.  You people prove the old saying:  
"Ignorance is bliss."

In article me@shawnritchie.com says...
> Your design has led you to have to manually power-cycle APs multiple times
> per day. And you think that, by blocking _websites_, you've somehow blocked
> the majority of porn traffic, well... 

The manually power cycling the AP is a problem and something that needs 
to be addressed in the requirements for whatever AP I choose to replace 
the el cheapos with.  I need to understand the problem first. 

> You also admit you can't govern this well enough to avoid having to 
just
> shut it all down due to, according to your weirldy judgmental language,
> "porno addicts" and "perverts".

I'm not trying to thwart all porn, just the major streaming sites.  
These sites reveal themselves in my data collection although my current 
set of blocked sites have worked for about 6 months now without any need 
for additional entries.  You can do amazing things with a simple regex.  
I don't want to attract perverts because I don't want my limited BW to 
be used for streaming.  Youtube is OK because people tend to watch a few 
videos, get bored, and move on.  Netflix is usually a two hour constant 
BW hog and sometimes more.   Porno people tend to watch porno after 
porno after porno according to my analytics.   It seems counter 
intuitive since you would think most people will have relieved 
themselves after the first few minutes.  I think one of my neighbors is 
a lesbian.

BTW: The shutting down of the network is my sword of Damocles algorithm.  
If the sword falls something is wrong, possibly an attack on the server, 
that requires human intervention to proceed.

In article <5nu1bd2ngu6w.b03lx8h2nsgl$.dlg@40tude.net>,
 smr <me@shawnritchie.com> wrote:

> On Thu, 21 Feb 2013 16:59:22 -0500, Mark Anderson wrote:
> 
> > In article me@shawnritchie.com says...
> >> Yeah, I build networks for a good living, thanks.
> > 
> > It doesn't matter what you say you can do; what matters is that you can 
> > do as you say.
> 
> Oh, I can, duder. Try me.
> 
> >> The fact that you're running this "experiment", and I apologize to that
> >> word since what you're doing here barely qualifies for it, using shitty
> >> consumer-grade APs, 
> > 
> > This is rich.  Not knowing the problem space nor a single requirement 
> > you somehow have an idea on its implementation.  
> 
> Your design has led you to have to manually power-cycle APs multiple times
> per day. And you think that, by blocking _websites_, you've somehow blocked
> the majority of porn traffic, well... 
> 
> You also admit you can't govern this well enough to avoid having to just
> shut it all down due to, according to your weirldy judgmental language,
> "porno addicts" and "perverts".
> 
> I think the average user would be safer raw-dogging a west Chicago Ave.
> hooker than attaching a device to your "free" wifi network.
> 
> > This is a different bug than what Bruce mentioned and not being an Apple 
> > fanboi I don't know where to hunt down their bugs (although to Apple 
> > fanbois, any problems are someone else's fault. Apples are infallible).  
> > I posted here because I found it interesting and maybe someone with 
> > knowledge (not you obviously) would have some insight on a recent 
> > upgrade cycle with MacBooks.
> 
> Yes. It's a good tactic to blandly and incorrectly insult the entire
> userbase that's likely to have the answer you're too incompetent to find
> yourself. Let us know how that works out.

cunt, again.

WTF is with you?

you walk around full cunt 24/7?

In article <kg68e9$hlp$1@reader1.panix.com>,
 Cydrome Leader <presence@MUNGEpanix.com> wrote:

> MacOwner <macowner@gmail.com> wrote:
> > In article <vl546mt245oi.1hq2quy7fglk2$.dlg@40tude.net>,
> > smr <me@shawnritchie.com> wrote:
> > 
> >> Yeah, I build networks for a good living, thanks.
> > 
> > what a cunt thing to type
> 
> it may be, but I'm going to have to side with smr knows networking better 
> than mr. spicy maggots.
> 
> Can somebody else explain what the point of the weird crashing wireless 
> network with one dns server is again?

smr is a cunt, wakes up a cunt, and emanates cunt all day long.

what don't you get?

it's cunt.

it's not "may be cunt". it's cunt.

Cydrome Leader <presence@mungepanix.com> wrote:

> Can somebody else explain what the point of the weird crashing wireless 
> network with one dns server is again?


It's OSX, and it's two dns servers, and it came in with version 10.8 from
last summer. It also seems to have been carried over to ios, for the
iphones, ipads and ipods, to a certain degree.

For whatever reason, it seems to effect the MacBooks more than anything
else, over wifi.

Basically the general thinking is, when the dhcp server gives the two ip
addresses for the name server to the device, if web browsing around you hit
a lookup that returns servfail (which normally occurs on a reverse lookup)
instead of nxdomain, what happens is, the device doesn't accept the servfail
and queries the other, gets the same, goes back to the first, gets the same,
goes to the secondary, creating a loop of lookups.

It seems like it's more on the router handing the dhcp, I guess some gives
the router address (it's own) for both dns servers, some gives one external
and itself, some pass along the isp's upstream ones.

The ones that give itself are the ones that fail, the macbook floods the
thing with dns requests because it's stuck in the dns query loop. Some of
the routers crap out, some lock out the device as an attack, some reboot.

Many people who started to have a problem like, wifi works for 10-15 minutes
then I have to reboot the router or macbook to get another 10-15 minutes
have solved it by changing the issued dns servers for dhcp to a single
address.

I guess when the macbook sees the single address for dns and gets the
servfail, it accepts it as the truth. With 2 dns servers available it never
accepts it as true.

Honesty though, I've never seen anyone mention this as an ipv6 problem,
thus, this probably isn't the same thing as Anderson is seeing but sounds
related.

-bruce
bje@ripco.com

In article bje@ripco.com says...
> Honesty though, I've never seen anyone mention this as an ipv6 
problem,
> thus, this probably isn't the same thing as Anderson is seeing but sounds
> related

It does sound related and perhaps the reason ipv6 hasn't been a problem 
is that hardly anyone uses it yet most all devices run some kind of ipv6 
stack, maybe for testing and/or compatibility reasons.  Maybe people who 
use MacBooks use a wifi product made by Apple that won't have this 
problem.  I went back to check the October and November incidents and 
they're both ipv6 as well.

I had another incident yesterday from the same neighbor who probably has 
no idea why she can't use my open wifi.  Something weird might be going 
on with how the switches on the APs handle this type of ipv6 multicast 
but I don't want to get into that here.  I wish I could simply turn off 
ipv6 but on three different manufacturers of the el cheapo APs, none 
give me this option.

In my humble opinion, in these modern times with so many open wifis and 
people using untrusted networks, multicast should never emanate from any 
device except for UDP bootp to get an IP address.  On trusted private 
networks that have the services these devices want then fine, multicast 
away.  The default should be off.
 

In article mea@nospambradnylion.com says...
> It does sound related and perhaps the reason ipv6 hasn't been a problem 
> is that hardly anyone uses it yet most all devices run some kind of ipv6 
> stack, maybe for testing and/or compatibility reasons.  Maybe people who 
> use MacBooks use a wifi product made by Apple that won't have this 
> problem.  I went back to check the October and November incidents and 
> they're both ipv6 as well.

Hashing this out here in writing was a good exercise for me because I 
think I now know the problem and for the alien archaeologists who one 
day dig up this newsgroup I'll post the solution.  The MacBooks or 
Powerbooks must be using ipv6 for some legitimate purposes on Apple's 
LAN products.  I'm getting a lot of MacBooks doing this now so Apple 
might be rolling this behaviour out more and more with recent OS 
releases.  Although IPads, IPhones, Ipods, etc. use ipv4 mdns, I haven't 
seen any of them us ipv6 mdns -- yet. 

That said, the problem was with a single vendor's AP/switch that caused 
a loop between the two of them.  Taking the second AP of that vendor off 
the network eliminated the loops when these multicasts occurred.  The 
topology of this network is very simple and there are no natural switch 
loops.  That vendor's switch was not handling the ipv6 multicast 
correctly and the problem with going el cheapo is that you get what you 
pay for.  I was able to narrow it down because I'm getting a lot of 
MacBooks or Powerbooks recently for some reason.

I could probably test this further but am not interested in debugging 
some off brand manufacturer's product that I got on sale for $12 at 
Microcenter (which is why I have more than one).  I think the MacBooks 
are a little abusive however and might have caused the hiccup.  In my 
recent trace with a successful session with my neighbor MacBook where 
she was able to do something and didn't cause a network crash, I counted 
112 mdns broadcasts with sometimes big 1400+ byte packets all within 
seconds upon entering the network.  All the APs now were able to handle 
this but for some reason I think this behavior contributed to trigging 
the loop in the off brand pair.  So Apple should share some blame in 
this -- IMHO.  There is no good reason to broadcast this tripe 112 
times.  After five what's the point?

On Feb 21, 5:26 pm, Mark Anderson <m...@nospambradnylion.com> wrote:
> In article m...@shawnritchie.com says...
>
> > Your design has led you to have to manually power-cycle APs multiple times
> > per day. And you think that, by blocking _websites_, you've somehow blocked
> > the majority of porn traffic, well...
>
> The manually power cycling the AP is a problem and something that needs
> to be addressed in the requirements for whatever AP I choose to replace
> the el cheapos with.  I need to understand the problem first.
>
>
>
> > You also admit you can't govern this well enough to avoid having to
> just
> > shut it all down due to, according to your weirldy judgmental language,
> > "porno addicts" and "perverts".
>
> I'm not trying to thwart all porn, just the major streaming sites.
> These sites reveal themselves in my data collection although my current
> set of blocked sites have worked for about 6 months now without any need
> for additional entries.  You can do amazing things with a simple regex.
> I don't want to attract perverts because I don't want my limited BW to
> be used for streaming.  Youtube is OK because people tend to watch a few
> videos, get bored, and move on.  Netflix is usually a two hour constant
> BW hog and sometimes more.   Porno people tend to watch porno after
> porno after porno according to my analytics.   It seems counter
> intuitive since you would think most people will have relieved
> themselves after the first few minutes.  I think one of my neighbors is
> a lesbian.

A good way to gather blackmailing info, a weeks worth of history from
each neighbor.