dns packets malformed

[Robbie Matthews]

I have seen this problem repeatedly. It seems to be a problem with Ubuntu 8.10, particularly the X64 version.

Most commonly seems to affect wireless connections using a local server for DHCP and DNS lookup.

Symptom:
Although NetworkManager has properly configured the wireless interface, and correctly set up /etc/resolv.conf with the address of the router, DNS lookup just fails. ping etc works, but only if you use the IP address (ie, google.com=72.14.205.100)

Manually adding your ISPs nameserver to /etc/resolv.conf seems to fix the problem (as far as getting you onto the internet) but it would appear that this is in fact masking the underlying problem.

Using 'host google.com' as an example, this is the result of the dns lookup request:

sudo tcpdump -i wlan0 -X -vvv -n -l -s 256 port 53
tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 256 bytes
12:04:33.836997 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 56) 192.168.0.3.43626 > 192.168.0.1.53: [udp sum ok] 40938+ A? google.com. (28)
    0x0000: 4500 0038 0000 4000 4011 b960 c0a8 0003 E..8..@.@..`....
    0x0010: c0a8 0001 aa6a 0035 0024 200e 9fea 0100 .....j.5.$......
    0x0020: 0001 0000 0000 0000 0667 6f6f 676c 6503 .........google.
    0x0030: 636f 6d00 0001 0001 com.....
12:04:33.839626 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 72) 192.168.0.255.53 > 192.168.0.3.43626: [udp sum ok] 40938- q: A? google.com. 1/0/0 google.com. A 209.85.171.100 (44)
    0x0000: 4500 0048 0000 4000 4011 b852 c0a8 00ff E..H..@.@..R....
    0x0010: c0a8 0003 0035 aa6a 0034 3b11 9fea 8100 .....5.j.4;.....
    0x0020: 0001 0001 0000 0000 0667 6f6f 676c 6503 .........google.
    0x0030: 636f 6d00 0001 0001 c00c 0001 0001 0000 com.............
    0x0040: 2710 0004 d155 ab64

As can been seen, the return packet has a source address of 192.168.0.255 ... which is wrong, and the address resolution ignores it.

Doing the same query and trace on a different computer on the same network gives this result:
tcpdump: listening on ath0, link-type EN10MB (Ethernet), capture size 256 bytes
20:34:09.348011 IP (tos 0x0, ttl 64, id 16610, offset 0, flags [DF], proto: UDP (17), length: 56) 192.168.0.3.32774 > 192.168.0.1.53: [udp sum ok] 5070+ A? google.com. (28)
       0x0000: 4500 0038 40e2 4000 4011 787e c0a8 0003 E..8@.@.@.x~....
       0x0010: c0a8 0001 8006 0035 0024 d68e 13ce 0100 .......5.$......
       0x0020: 0001 0000 0000 0000 0667 6f6f 676c 6503 .........google.
       0x0030: 636f 6d00 0001 0001 com.....
20:34:09.349927 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: UDP (17), length: 72) 192.168.0.1.53 > 192.168.0.3.32774: [udp sum ok] 5070- q: A? google.com. 1/0/0 google.com. A 74.125.45.100 (44)
       0x0000: 4500 0048 0000 4000 4011 b950 c0a8 0001 E..H..@.@..P....
       0x0010: c0a8 0003 0035 8006 0034 f768 13ce 8100 .....5...4.h....
       0x0020: 0001 0001 0000 0000 0667 6f6f 676c 6503 .........google.
       0x0030: 636f 6d00 0001 0001 c00c 0001 0001 0000 com.............
       0x0040: 2710 0004 4a7d 2d64 '...J}-d

This works just fine, the return package is properly formed.

It only appears to be a problem using the local router as a nameserver. Using the ISPs nameservers, you can see the packets being properly formed.
Just to add complexity to the problem, if you take the interface up and down a few times, the symptoms change.

It starts working after a fashion:

host returns a "malformed message packet" ... as can be seen from the tcpdump trace below, the response packet is short:

 host -v google.com 192.168.0.1

Received 44 bytes from 192.168.0.1#53 in 10 ms
Trying "google.com"
;; Warning: Message parser reports malformed message packet.
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34713
;; flags: qr rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com. IN AAAA

21:12:43.075041 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 56) 192.168.0.8.34063 > 192.168.0.1.53: [udp sum ok] 34713+ AAAA? google.com. (28)
    0x0000: 4500 0038 0000 4000 4011 b95b c0a8 0008 E..8..@.@..[....
    0x0010: c0a8 0001 850f 0035 0024 5d9a 8799 0100 .......5.$].....
    0x0020: 0001 0000 0000 0000 0667 6f6f 676c 6503 .........google.
    0x0030: 636f 6d00 001c 0001 com.....
21:12:43.080714 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 56) 192.168.0.1.53 > 192.168.0.8.34063: [udp sum ok] 34713- q: AAAA? google.com. 1/0/0 [|domain]
    0x0000: 4500 0038 0000 4000 4011 b95b c0a8 0001 E..8..@.@..[....
    0x0010: c0a8 0008 0035 850f 0024 dd98 8799 8100 .....5...$......
    0x0020: 0001 0001 0000 0000 0667 6f6f 676c 6503 .........google.
    0x0030: 636f 6d00 001c 0001 com.....

----------------
This appears to be a widespread problem, hopefully this will be of some help solving the underlying issue.

Robbie

[Robbie Matthews (robbie-mithril)]

I've been able to duplicate the exact symptoms on another laptop running Ubuntu 8.10

The above traces were produced on an HP Pavillion dv9000 (running a 64 bit kernel).
Got exactly the same result on a Dell Inspiron 6000 (running a 32 bit kernel).

I also set up a second nameserver on the same lan, and got exactly the same results. The problem definitely appears related to nameservers running on the same local network... internet nameservers seem unaffected.

[Robbie Matthews (robbie-mithril)]

Another symptom: sometimes the dns lookup will work for a minute or two immediately after booting, then go into fail mode.

[Simos Xenitellis  (simosx)]

This is an issue I have seen quite a few times. You can google search for this and get several results.
The cause of the problem is either
1. the type of IPv6 that Ubuntu has enabled by default (ahem) does not allow DNS requests to the router to succeed. Try to disable IPv6 and check to see if this is the case.
2. There is a flag that is added to packets from Ubuntu that your router is unable to cope with.

Sorry for the rushed description above. I hope it helps you to take this issue further.
I really doubt that this issue has to do with NetworkManager.

[Inspired (inspired)]

I seem to be experiencing a problem similar, perhaps the same, as this... but on 9.04
It has just started to occur though. Wifi and wired connections were fine until a few days ago.
Now connection goes through and seems fine. But domain name resolution does not happen. I can't ping anything by domain, unless it happens to be in my hosts file. I also can't ping the router IP even though I can connect to the router via a browser, using its IP address.

I will try the tests mentioned above to see if this is in fact the same.
Was a solution found to this? Is it possible to clean out and reinstall the entire networking system on Ubuntu? On windows if network ever spat the dummy big time, I would just remove all networking software components, including (most importantly) the TCP/IP network stuff... then install them again. Never failed to fix unresolvable networking issues that appeared due to something getting messed up after previously working. Is there anyway to reinstall the networking on Ubuntu in a similar way?

[Giulio Malventi (giulio-people)]

Still valid on 9.10, including the symptom in post #2.

[^_Pepe_^ (jose-angel-fernandez-freire)]

If the issue remains, could you run the following command from a
Terminal (Applications->Accessories->Terminal) while running Karmic. It
will automatically gather and attach updated debug information to this
report.

apport-collect -p linux 312399

[Giulio Malventi (giulio-people)]

Architecture: i386
ArecordDevices:
 **** List of CAPTURE Hardware Devices ****
 card 0: VT82xx [HDA VIA VT82xx], device 0: AD198x Analog [AD198x Analog]
   Subdevices: 1/1
   Subdevice #0: subdevice #0
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: giulio 2296 F.... pulseaudio
CRDA: Error: [Errno 2] No such file or directory
Card0.Amixer.info:
 Card hw:0 'VT82xx'/'HDA VIA VT82xx at 0xbfffc000 irq 17'
   Mixer name : 'Analog Devices AD1986A'
   Components : 'HDA:11d41986,1043818f,00100500'
   Controls : 38
   Simple ctrls : 22
DistroRelease: Ubuntu 9.10
HibernationDevice: RESUME=UUID=0feac568-5c45-4cc8-afb8-b4c00bfd1cdb
MachineType: System manufacturer System Product Name
NonfreeKernelModules: nvidia
Package: linux (not installed)
ProcCmdLine: root=UUID=3767d5af-bd16-4fe2-b6af-62d2f4bb970e ro quiet splash
ProcEnviron:
 SHELL=/bin/bash
 PATH=(custom, user)
 LANG=it_IT.UTF-8
ProcVersionSignature: Ubuntu 2.6.31-17.54-generic
RelatedPackageVersions: linux-firmware 1.26
Uname: Linux 2.6.31-17-generic i686
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev powerdev sambashare scanner uml-net video www-data
WpaSupplicantLog:

dmi.bios.date: 03/25/2008
dmi.bios.vendor: Phoenix Technologies, LTD
dmi.bios.version: ASUS P5VD2-VM ACPI BIOS Revision 1302
dmi.board.name: P5VD2-VM
dmi.board.vendor: ASUSTeK Computer INC.
dmi.board.version: 1.XX
dmi.chassis.asset.tag: 123456789000
dmi.chassis.type: 3
dmi.chassis.vendor: Chassis Manufacture
dmi.chassis.version: 1111
dmi.modalias: dmi:bvnPhoenixTechnologies,LTD:bvrASUSP5VD2-VMACPIBIOSRevision1302:bd03/25/2008:svnSystemmanufacturer:pnSystemProductName:pvr:rvnASUSTeKComputerINC.:rnP5VD2-VM:rvr1.XX:cvnChassisManufacture:ct3:cvr1111:
dmi.product.name: System Product Name
dmi.sys.vendor: System manufacturer

[Jeremy Foshee (jeremyfoshee)]

Hi Robbie,

This bug was reported a while ago and there hasn't been any activity in it recently. We were wondering if this is still an issue? Can you try with the latest development release of Ubuntu? ISO CD images are available from http://cdimage.ubuntu.com/releases/lucid.

If it remains an issue, could you run the following command from a Terminal (Applications->Accessories->Terminal). It will automatically gather and attach updated debug information to this report.

apport-collect -p linux 312399

Also, if you could test the latest upstream kernel available that would be great. It will allow additional upstream developers to examine the issue. Refer to https://wiki.ubuntu.com/KernelMainlineBuilds . Once you've tested the upstream kernel, please remove the 'needs-upstream-testing' tag. This can be done by clicking on the yellow pencil icon next to the tag located at the bottom of the bug description and deleting the 'needs-upstream-testing' text. Please let us know your results.

Thanks in advance.

[This is an automated message. Apologies if it has reached you inappropriately; please just reply to this message indicating so.]

[Jeremy Foshee (jeremyfoshee)]

This bug report was marked as Incomplete and has not had any updated comments for quite some time. As a result this bug is being closed. Please reopen if this is still an issue in the current Ubuntu release http://www.ubuntu.com/getubuntu/download . Also, please be sure to provide any requested information that may have been missing. To reopen the bug, click on the current status under the Status column and change the status back to "New". Thanks.

[This is an automated message. Apologies if it has reached you inappropriately; please just reply to this message indicating so.]