On Tue, Oct 21, 2008 at 10:44 PM, Kevin Darcy wrote:
> Linux Addict wrote:
> > On Tue, Oct 21, 2008 at 6:24 PM, Mark Andrews

> wrote:
> >
> >> In message <707abafb0810211024m2d1a3e55j5d495433db242217@mail. gmail.com

> >,
> >> "Linu
> >> x Addict" writes:
> >>
> >>> I get this error when I try resolve some specific records. Anyone know
> >>>
> >> what
> >>
> >>> it means and how to resolve it.
> >>>
> >> You got a malformed packet.
> >>
> >>
> >>> ;; Got bad packet: bad label type
> >>> 160 bytes
> >>> 2b 3c 81 80 00 01 00 04 00 00 00 00 09 5f 6b 65
> >>>
> >> id=11068
> >> questions=1
> >> answers=4
> >> authorityu=0
> >> additional=0
> >> _kerberos.
> >>
> >>> 72 62 65 72 6f 73 04 5f 75 64 70 05 49 54 57 45
> >>>
> >> _tcp. ITWEB.
> >>
> >>> 42 05 57 45 42 4d 44 03 4e 45 54 00 00 21 00 01
> >>>
> >> WEBMD. CET. SRV IN
> >>
> >>> c0 0c 00 21 00 01 00 00 00 77 00 10 00 00 00 64 <------------------\
> >>>
> >> compression point to offset 0x0c (_tcp.ITWEB.WEBMD.CET.) |
> >> SRV IN 119 16 0 100 |
> >>
> >>> 00 58 07 64 6e 79 64 63 30 32 c0 3f c0 0c 00 21 |
> >>>
> >> 88 dnydc02. compression pointer to offset 3f ----/
> >> (which is 0x64, which is not a valid label).
> >>
> >>> 00 01 00 00 00 77 00 10 00 00 00 64 00 58 07 64
> >>> 6e 79 64 63 30 31 c0 3f c0 0c 00 21 00 01 00 00
> >>> 00 77 00 10 00 00 00 64 00 58 07 64 6e 6a 64 63
> >>> 30 32 c0 3f c0 0c 00 21 00 01 00 00 00 77 00 10
> >>> 00 00 00 64 00 58 07 64 6e 6a 64 63 30 31 c0 3f
> >>>
> >>> Thanks
> >>> LA
> >>>
> >>>
> >>>
> >>>
> >> --
> >> Mark Andrews, ISC
> >> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> >> PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews@isc.org
> >>
> >>

> >
> >
> > This is awesome!! How did you decode it? Now How do I fix it?
> >
> >

> Well, the Message Format and Resource Record format are described in RFC
> 1035, and ASCII is, well, ASCII.
>
> How do you fix it?
>
> Are you seeing this from a BIND nameserver?
>
> If so, then there is presumably something in the middle corrupting the
> packet (not that I think BIND is perfect, but if it had a problem with
> basic packet construction I think we would have heard about it by now).
> Find out what that middlebox is and complain to the administrator/vendor.
>
> If it's from some non-BIND nameserver, then go complain to the implementor.
>
>
> - Kevin
>
>



I will figure it out from here. Thank you very much everyone!