Question
DNS fail: What does it mean when packet sniffer shows the packet, but there is no flow?
I try to perform a name service lookup.
The packet sniffer shows the incoming packet alright.
2.949054 192.168.98.103.57575 -> 172.30.2.24.53: udp 37
3.312285 192.168.98.103.60698 -> 172.30.2.24.53: udp 37
3.401912 192.168.98.103.35894 -> 172.30.2.24.53: udp 31
3.408263 192.168.98.103.46152 -> 172.30.2.24.53: udp 34
3.684756 192.168.98.103.36344 -> 172.30.2.24.53: udp 37
3.923974 192.168.98.103.48066 -> 172.30.2.24.53: udp 37
4.166572 192.168.98.103.34428 -> 172.30.2.24.53: udp 31
4.222811 192.168.98.103.34984 -> 172.30.2.24.53: udp 31
4.238474 192.168.98.103.34193 -> 172.30.2.24.53: udp 31
Since the DNS lookup is not working (not arriving at the server) I try flow debugging
FW1 (vdc) # diag debug enable
FW1 (vdc) # diag debug flow filter saddr 192.168.98.103
FW1 (vdc) # diag debug flow filter daddr 172.30.2.24
FW1 (vdc) # diag debug flow filter dport 53
FW1 (vdc) # diag debug flow show console enable
show trace messages on console
FW1 (vdc) # diag debug flow trace start 10
FW1 (vdc) #
It shows nothing.
Note that the traffic to the other nameserver at 172.30.2.25 does go through and also shows a flow being established.
Why could that be?
Thanks.
Marki
