nsd users - May 2020 - Timeout for TCP queries to NSD

Hi NSD developers,

I'm using the "dnspython" module to AXFR some large zones from one
of
our NSD 4.2.4 servers. Around a quarter of the time, the AXFR fails, and 
python throws an EOFError exception. This usually means that the server 
closed the connection. The same AXFRs, when done with "dig", always
succeed.

I think that since "dnspython" is quite slow, there must be some kind
of
timeout being triggered in NSD, and it closes the connection. However, 
the only mention of any TCP-related timeout in nsd.conf is 
"tcp-timeout". The explanation of that option isn't very clear to
me. It
says:

"Overrides the default TCP timeout. This also affects zone transfers 
over TCP."

Is this for incoming queries to NSD, or outgoing TCP queries made by 
NSD? Also, what is the default TCP timeout that this refers to?

And if this is not related to TCP queries to an NSD server, then where 
and what timeouts does NSD apply when answering TCP queries?

Just for comparison, the same AXFRs, made using "dnspython" to a BIND 
server, all succeed. BIND's default TCP timeout paramters are all set to 
30s.

Regards,
Anand

Hi Anand,

On 14/05/2020 12:32, Anand Buddhdev via nsd-users wrote:
> Hi NSD developers,
> 
> I'm using the "dnspython" module to AXFR some large zones
from one of
> our NSD 4.2.4 servers. Around a quarter of the time, the AXFR fails, and
> python throws an EOFError exception. This usually means that the server
> closed the connection. The same AXFRs, when done with "dig",
always
> succeed.
> 
> I think that since "dnspython" is quite slow, there must be some
kind of
> timeout being triggered in NSD, and it closes the connection. However,
> the only mention of any TCP-related timeout in nsd.conf is
> "tcp-timeout". The explanation of that option isn't very
clear to me. It
> says:
> 
> "Overrides the default TCP timeout. This also affects zone transfers
> over TCP."
> 
> Is this for incoming queries to NSD, or outgoing TCP queries made by
> NSD? Also, what is the default TCP timeout that this refers to?
Yes this applies to incoming queries and to outgoing queries.  120
seconds by default.

A much smaller value, of 200 msec, is used when the server is nearly
full on capacity, for incoming connections that are over the limit.
Also when the server has updated the existing connections get a smaller
100 msec timeout to wait for them to complete their tcp query to NSD.

That last feature since 4.2.1.  The tcp full shorter timeout is since
4.1.11.

Best regards, Wouter
> 
> And if this is not related to TCP queries to an NSD server, then where
> and what timeouts does NSD apply when answering TCP queries?
> 
> Just for comparison, the same AXFRs, made using "dnspython" to a
BIND
> server, all succeed. BIND's default TCP timeout paramters are all set
to
> 30s.
> 
> Regards,
> Anand
> _______________________________________________
> nsd-users mailing list
> nsd-users at lists.nlnetlabs.nl
> https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users