Infoblox’s global team of threat hunters uncovers a DNS operation with the ability to bypass traditional security measures and control the Great Firewall of China. Read about “Muddling Meerkat” and the many other threat actors discovered by Infoblox Threat Intel here.

NIOS DNS DHCP IPAM

Reply

How can I read the OPT PSEUDOSECTION in the following dig message response

Authority
Posts: 19
508     0

Hi;

 

How can I read the OPT PSEUDOSECTION in the following dig message response. Note there is a Zscaler client on the device that did the dig.

 

dig @ns1.infoblox.com lame.training.infoblox.com.

; <<>> DiG 9.10.6 <<>> @ns1.infoblox.com lame.training.infoblox.com.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 6452
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; OPT=15: 00 17 5b 36 38 2e 31 38 33 2e 32 30 37 2e 31 5d 20 72 63 6f 64 65 3d 52 45 46 55 53 45 44 20 66 6f 72 20 6c 61 6d 65 2e 74 72 61 69 6e 69 6e 67 2e 69 6e 66 6f 62 6c 6f 78 2e 63 6f 6d 2f 61 ("..[68.183.207.1] rcode=REFUSED for lame.training.infoblox.com/a")
; OPT=15: 00 16 41 74 20 64 65 6c 65 67 61 74 69 6f 6e 20 6c 61 6d 65 2e 74 72 61 69 6e 69 6e 67 2e 69 6e 66 6f 62 6c 6f 78 2e 63 6f 6d 20 66 6f 72 20 6c 61 6d 65 2e 74 72 61 69 6e 69 6e 67 2e 69 6e 66 6f 62 6c 6f 78 2e 63 6f 6d 2f 61 ("..At delegation lame.training.infoblox.com for lame.training.infoblox.com/a")
;; QUESTION SECTION:
;lame.training.infoblox.com. IN A

;; Query time: 913 msec
;; SERVER: 23.96.113.219#53(23.96.113.219)
;; WHEN: Thu Jul 11 12:33:57 AEST 2024
;; MSG SIZE  rcvd: 201

 

 

Kindly

Wasfi

 

Re: How can I read the OPT PSEUDOSECTION in the following dig message response

New Member
Posts: 1
509     0

Hello Wasfi,

The pseudo section decode is included by DiG in the output -those pseudo section are extended error messages.  See the portion in quotes at the end of each OPT.  So, the first extended error code says: "[68.183.207.1] rcode=REFUSED for lame.training.infoblox.com/a" and the second says, "At delegation lame.training.infoblox.com for lame.training.infoblox.com/a"

 

Dan Mather

Showing results for 
Search instead for 
Did you mean: 

Recommended for You