Individual Server Details

[pat wei]

Hi

I'm running the dns benchmark v2r3 tool in different environments and use it also to see what is working in which environment and what not. I.e. we have many times regular DNS blocked by firewalls, DOT as well, but rarely DOH.

Example: In my main environment many DOH servers report that "DNS queries are not being answered here" and I would like to understand what went wrong.

1) Is there a way to access the details of each server, individually, to see if the tools was able to get:

• DNS of server resolved,
• UDP/TCP Connectivity,
• TLS Session establishment,
• number of dns queries sent and also
• what dns queries were sent and maybe not answered?

or do you already display part of that information but I just don't know what details you report for which step that breaks?

If I compare to DOT outputs, which none work in this environment, I get different status replies "refuses secure TLS handshake", "refuses secure transactions", "never replies to bad domains".

So maybe for DOH, when it says DNS queries are not being answered here it actually means, that the dns lookup, tcp connectivity, tls session were sucessfully established but no answer?

2) is there a way to re-trigger a single server of the list and maybe get all details for this server and its attempt?

 

[Steve]

Hi @pat wei,
Since the benchmark is targeted more toward a broad general audience who's interested mostly in performance, the sorts of details you're looking for are not being gathered. There is much more detailed data available from the CSV file that can be saved after the benchmark finishes. Note, this is not the "save benchmark results", which is a deliberately trimmed summary, but rather the "Export last results to CSV file" command.

I am (informally) collecting (not really soliciting) ideas for a future round of significant improvements (once I've finished work on several other app priorities). I have capture your requests for that future work. Thanks!

 

[Schrodinger's Cat]

If I compare to DOT outputs, which none work in this environment, I get different status replies "refuses secure TLS handshake", "refuses secure transactions", "never replies to bad domains".

So maybe for DOH, when it says DNS queries are not being answered here it actually means, that the dns lookup, tcp connectivity, tls session were sucessfully established but no answer?

2) is there a way to re-trigger a single server of the list and maybe get all details for this server and its attempt?

Sounds like something flakey is going on, is there something interfering with your traffic perhaps? Perhaps elaborating on your environment might help

There is a way to manually re-trigger a server, that is you remove that one single server and re add it. (It is known during dnsbv2 development that under certain conditions(we dont know why), remove and re add might turn a previously red server green, I have one of those environments.. lol... and it is (mostly) specific to Quad9 resolvers at my location.

PS: some DoT servers require TLS1.3 and up... DNSB relies on Windows scrypt that (for unknown to me) reason does only up to TLS1.2 [This is not steve's fault as Microsoft themself claim support for TLS1.3 in Windows 11 but in reality they are still using TLS1.2 for their own apps ie. windows update / Onedrive client. DoH uses a different windows API that suports HTTP2 and has TLS1.3 support.

PS2: for the details you might be looking for, might i suggest (if you are adventurous) external tools eg. `dig` / `kdig` to figure out ip resolved, or if a DoT or DoH is supposed to work and Wireshark to watch all the packets sent and received, tls handshake and all

 

[pat wei]

Sounds like something flakey is going on, is there something interfering with your traffic perhaps? Perhaps elaborating on your environment might help

There is a way to manually re-trigger a server, that is you remove that one single server and re add it. (It is known during dnsbv2 development that under certain conditions(we dont know why), remove and re add might turn a previously red server green, I have one of those environments.. lol... and it is (mostly) specific to Quad9 resolvers at my location.

PS: some DoT servers require TLS1.3 and up... DNSB relies on Windows scrypt that (for unknown to me) reason does only up to TLS1.2 [This is not steve's fault as Microsoft themself claim support for TLS1.3 in Windows 11 but in reality they are still using TLS1.2 for their own apps ie. windows update / Onedrive client. DoH uses a different windows API that suports HTTP2 and has TLS1.3 support.

PS2: for the details you might be looking for, might i suggest (if you are adventurous) external tools eg. `dig` / `kdig` to figure out ip resolved, or if a DoT or DoH is supposed to work and Wireshark to watch all the packets sent and received, tls handshake and all

PS2: I can definitely use other tools to dig into the issue, but since dns benchmark is probably already doing the steps for me, I was hoping it would add details about the connections, so for me to avoid having to individually troubleshoot the issues

 

[pat wei]

Feedback/Feature Request?

Have others also asked to get all the data of the tabs in one tab?

I click through Name, Owner, Status, Response Time all the time and for me it would be great to have all of that data in different columns but together, as I loose sometimes the context of what I was looking for ;( Especially hard to see in response time what the actual server was without going back and forth.


Some additional questions:

1) Start up DNS Tests

Is there some documentation about what DNS servers are tested when the program starts up?

In my main environment we block Internet UDP DNS Access and therefore I get an error message and have to press the ignore every time.


But I would be interested to see what was tested and probably the results. In my environment only my internal ones work and some DOH (as the corporate firewall probably cannot block these good enough)

2) More details about the different symbols and colors and status?

I'm a bit color blind and wonder about some of the colors and status:

This full circle probably means all good:

This non full circle might indicate nothing works?

(probably red)

This non full circle might indicate partially working?

(for me this looks lighter than the one above) and the text suggests it is working, or maybe only partially and thats why no full circle?

Then this circle stays the same but the text changes colors for sidelining

For the DOT I have some messages that I probably need to google for but I would love to understand from the program what they mean, i.e. which step they are:

- especially this one"never replies to bad domains" I find interesting what that means

From the list that comes by default, I find a few entries in IPv6 with this Name:

After running a benchmark, what is the meaning of the symbol left over and what did it mean while running?

And what does the thin black line stand for?

 

[Steve]

@pat wei, —> https://www.grc.com/dns/operation.htm

These documentation pages still reflect the v1 freeware since I've still been working to get DNSBv2 launched. But as soon as I can get to those pages I'll be updating them. But MOST of what's there remains correct and should answer all of your questions.

 

[peterblaise]

"... to get all the data of the tabs in one tab ..."

... scour Tabular Data after a Benchmark - it's all there in text and math.