Cisco IOS Order of Operations

Inside-to-Outside

Outside-to-Inside

If IPSec then check input access list decryption - for CET or IPSec check input access list Input MQC QoS Classification check input rate limits (Policing) input accounting redirect to web cache policy routing routing NAT inside to outside (local to global translation) crypto (check map and mark for encryption) check output access list inspect (Context-based Access Control (CBAC)) TCP intercept encryption QoS Queueing

If IPSec then check input access list decryption - for CET or IPSec check input access list Input MQC QoS Classification  check input rate limits (Policing) input accounting redirect to web cache NAT outside to inside (global to local translation) policy routing routing crypto (check map and mark for encryption) check output access list inspect CBAC TCP intercept encryption QoS Queueing

Source: here, here, and here (QoS)

Sources one and two contradict each other, so YMMV. The table reproduced above is from the second source with the addition of the QoS order of operations from source three. It still does not sounds right to me but leave me a comment if you think otherwise.

In the above table, the only difference between packets flowing from the inside -> outside or outside -> inside is NAT and routing.

When a packet is going outside you will route first. This allows the router to find out which exit interface is going to be used. At this point both the inbound and outbound interfaces are known then you also know if you need to apply NAT

When a packet is going outside to inside, you check the NAT translation table first according to the table above. I think you should check routing first as then you will know your inbound and outbound interface. This would then tell you if you need to check the NAT translation table for an existing entry.

For example: If a packet arrive at the outside interface and is destined for the DMZ which isn't NATed then you slow things by checking the NAT translation table before the routing table. However if you checked the routing table to determine you exit interface then you know there will be no NAT translations in place and you can skip this check.



More generally you could say the packet flow through a Cisco router is:

1. Input Decryption
2. Input ACLs
3. QoS classification
4. QoS policing
5. IP Accounting
6. WCCP
7. Routing
8. NAT
9. Crypto Check
10. Output ACLs
11. Encryption
12. QoS Queueing

SSL Handshaking

Auditing a network

Imagine that you have been contracted by a company to resolve their network issues. How would you go about tackling this issue? Here is some of my thoughts if I had to solve this:

1. audit the network
2. understand and discuss the customers issues
3. design an solution that satisfies the end customers
4. produce a project plan and budget
5. test changes in lab environment and or limited deployment
6. schedule and implement the changes
7. discuss with the end-users and report on the effectiveness

Network Auditing

For all tail sites record the following information:

• location, number of users and any on-site IT contacts
• type of hardware (eg routers, switches, firewalls, servers)
• network design, ip addressing, wifi channels and configuration
• serial numbers of all devices
• configuration of all devices
• software / firmware versions of all devices
• operating system type, version and patch level
• network links, capacity, service provider, circuit id, support details
• peak utilization of link
• business as usual requirements of the site

For all datacenter/hub sites record the following information:

• location
• type of hardware (eg routers, switches, firewalls, servers)
• network design and ip addressing
• serial numbers of all devices
• software / firmware versions of all devices
• configuration of all devices
• operating system type, version and patch level
• network links, capacity, service provider, circuit id, support details
• peak utilization of links or server loading
• business functions provided by the site
• redundancy / disaster recovery options
• load balancing and firewall configurations
• data backup and recovery (onsite and offsite)

WAN Network

• location and capacity of links
• current utiliation of links
• growth rate of traffic
• service providers, circuit ids and support procedures
• routing (ospf, bgp etc)
• ntp design
• syslog design
• snmp traps collection
• network monitoring and alerting

Processes and procedures

• backups
• alerting
• proactive and reactive monitoring
• software testing and patching
• capacity planning
• internal support process
• existing documentation and procedures

A lot of this information should be captured from the network monitoring systems. Most rely on snmp polling and the data can be extracted / exported to a text format. Other information should be gathered by talking to the staff who regularly work on this network to build, support and maintain it. This will undoubted lead to other avenues to explore.

DNS Load balancing

This is an outsiders perspective on how akamai do DNS based load balancing. The website we will be looking at is www.theage.com.au. See previous post on how to manaually follow the delegation chain but in summary it as follows:

Domain	Name Servers
.	root server
au	au root servers
com.au	au root servers
theage.com.au	Akamai name servers below

ns1-207.akam.net.       20727   IN      A       193.108.91.207
usw4.akam.net.          9913    IN      A       64.211.42.196
usc4.akam.net.          10282   IN      A       96.17.169.10
usw2.akam.net.          14102   IN      A       64.211.42.196
ns1-179.akam.net.       20727   IN      A       193.108.91.179
asia2.akam.net.         12896   IN      A       63.150.131.81
eur5.akam.net.          10282   IN      A       62.41.62.233
use5.akam.net.          18317   IN      A       81.52.250.132

I believe this table remain the same across the various continents and converts the customers domain name to a akamazied name in the g.akamai.net subdomain. No metric are used at this point and its purely a static mapping. In this case:

;; ANSWER SECTION:
www.theage.com.au.      300     IN      CNAME   dsa.f2.com.au.edgesuite.net.
dsa.f2.com.au.edgesuite.net. 17178 IN   CNAME   a1040.g.akamai.net.

;; AUTHORITY SECTION:
g.akamai.net.           1000    IN      SOA     n0g.akamai.net. hostmaster.akamai.com. 1313505437 1000 1000 1000 1800

 When you now query the name servers for the g.akamai.net you then get a metric enabled veiw of the network and get pointed to the closest server. The traceroutes in each of the sections below shows that it there is onlyl 3-4 hops between source and destination.

See this and this for further info.




Australia

12:00am zzz:~ > dig www.theage.com.au

; <<>> DiG 9.6.1-P1 <<>> www.theage.com.au
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44302
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 9, ADDITIONAL: 6

;; QUESTION SECTION:
;www.theage.com.au.             IN      A

;; ANSWER SECTION:
www.theage.com.au.      300     IN      CNAME   dsa.f2.com.au.edgesuite.net.
dsa.f2.com.au.edgesuite.net. 18657 IN   CNAME   a1040.g.akamai.net.
a1040.g.akamai.net.     20      IN      A       144.135.8.238
a1040.g.akamai.net.     20      IN      A       144.135.8.239

;; AUTHORITY SECTION:
g.akamai.net.           1004    IN      NS      n6g.akamai.net.
g.akamai.net.           1004    IN      NS      n5g.akamai.net.
g.akamai.net.           1004    IN      NS      n3g.akamai.net.
g.akamai.net.           1004    IN      NS      n7g.akamai.net.
g.akamai.net.           1004    IN      NS      n8g.akamai.net.
g.akamai.net.           1004    IN      NS      n2g.akamai.net.
g.akamai.net.           1004    IN      NS      n1g.akamai.net.
g.akamai.net.           1004    IN      NS      n0g.akamai.net.
g.akamai.net.           1004    IN      NS      n4g.akamai.net.

;; ADDITIONAL SECTION:
n1g.akamai.net.         425     IN      A       61.9.193.171
n7g.akamai.net.         1284    IN      A       61.9.193.171
n4g.akamai.net.         1284    IN      A       61.9.193.173
n0g.akamai.net.         1080    IN      A       125.56.205.28
n2g.akamai.net.         1622    IN      A       125.56.205.45
n5g.akamai.net.         379     IN      A       61.9.193.171

;; Query time: 246 msec
;; SERVER: 10.202.200.215#53(10.202.200.215)
;; WHEN: Wed Aug 17 00:12:37 2011
;; MSG SIZE  rcvd: 395

The traceroute to 144.135.8.238 is then

  1 TenGigabitEthernet0-12-0-2.exi-core1.Melbourne.telstra.net (203.50.80.1) 4 msec 0 msec 4 msec
  2 Bundle-Pos3.chw-core2.Sydney.telstra.net (203.50.11.14) 16 msec 12 msec 12 msec
  3 TenGigabitEthernet8-1.pic2.Sydney.telstra.net (203.50.20.185) 12 msec 12 msec 16 msec
  4 telstr810.lnk.telstra.net (165.228.132.18) 20 msec 12 msec 20 msec
  5 144.135.8.239 16 msec 16 msec 16 msec

Europe (Germany)

; <<>> DiG 9.2.1 <<>> @dns.taide.net www.theage.com.au a
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6203
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 9, ADDITIONAL: 0

;; QUESTION SECTION:
;www.theage.com.au.		IN	A

;; ANSWER SECTION:
www.theage.com.au.	36	IN	CNAME	dsa.f2.com.au.edgesuite.net.
dsa.f2.com.au.edgesuite.net. 21337 IN	CNAME	a1040.g.akamai.net.
a1040.g.akamai.net.	20	IN	A	193.219.194.8
a1040.g.akamai.net.	20	IN	A	193.219.194.11

;; AUTHORITY SECTION:
g.akamai.net.		1276	IN	NS	n7g.akamai.net.
g.akamai.net.		1276	IN	NS	n8g.akamai.net.
g.akamai.net.		1276	IN	NS	n0g.akamai.net.
g.akamai.net.		1276	IN	NS	n1g.akamai.net.
g.akamai.net.		1276	IN	NS	n2g.akamai.net.
g.akamai.net.		1276	IN	NS	n3g.akamai.net.
g.akamai.net.		1276	IN	NS	n4g.akamai.net.
g.akamai.net.		1276	IN	NS	n5g.akamai.net.
g.akamai.net.		1276	IN	NS	n6g.akamai.net.

;; Query time: 1 msec
;; SERVER: 193.219.193.135#53(dns.taide.net)
;; WHEN: Tue Aug 16 16:15:57 2011
;; MSG SIZE  rcvd: 299

The traceroute to 193.219.194.8 is

traceroute to 193.219.194.8 (193.219.194.8), 30 hops max, 38 byte packets
 1  NO-NIT-VN-15 (193.219.193.115)  0.385 ms  0.237 ms  0.331 ms
 2  NO-NIT-TN-2 (193.219.193.132)  0.498 ms  0.403 ms  0.401 ms
 3  193.219.194.8 (193.219.194.8)  0.296 ms  0.246 ms  0.404 ms

USA

; <<>> DiG 9.3.2-P2.1 <<>> any www.theage.com.au
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18494
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.theage.com.au.		IN	ANY

;; ANSWER SECTION:
www.theage.com.au.	256	IN	CNAME	dsa.f2.com.au.edgesuite.net.
dsa.f2.com.au.edgesuite.net. 21556 IN	CNAME	a1040.g.akamai.net.
a1040.g.akamai.net.	20	IN	A	173.223.52.154
a1040.g.akamai.net.	20	IN	A	173.223.52.169

;; Query time: 1 msec
;; SERVER: 204.152.204.100#53(204.152.204.100)
;; WHEN: Tue Aug 16 08:28:34 2011
;; MSG SIZE  rcvd: 137

Traceroute Results:

 1  10.31.6.1 (10.31.6.1)  8.040 ms  14.992 ms  10.738 ms
 2  66.63.169.249 (66.63.169.249)  45.798 ms  51.654 ms  0.626 ms
 3  96.44.180.246 (96.44.180.246)  0.485 ms  0.441 ms  0.281 ms
 4  akamai.com.any2ix.coresite.com (206.223.143.82)  0.396 ms  0.361 ms  0.302 ms
 5  a173-223-52-169.deploy.akamaitechnologies.com (173.223.52.169)  0.338 ms  0.248 ms  0.265 ms

Tracing DNS Delegation Manually (simple non load balanced domains)

Using the command dig on a unix box you can trace how the a domain name is delegated. The most important sections to look at in the dig output is the Answer and Additional Sections. Lets try an working out the chain of authorization for rscott.org. I then follow this up with a more complex trace for www.vispinabox.net.au.

1) Get a list of root name servers

8:21pm zzz:~ > dig -t ns

; <<>> DiG 9.6.1-P1 <<>> -t ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47225
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 11

;; QUESTION SECTION:
;.                              IN      NS

;; ANSWER SECTION:
.                       81362   IN      NS      k.root-servers.net.
.                       81362   IN      NS      g.root-servers.net.
.                       81362   IN      NS      a.root-servers.net.
.                       81362   IN      NS      l.root-servers.net.
.                       81362   IN      NS      d.root-servers.net.
.                       81362   IN      NS      c.root-servers.net.
.                       81362   IN      NS      e.root-servers.net.
.                       81362   IN      NS      j.root-servers.net.
.                       81362   IN      NS      f.root-servers.net.
.                       81362   IN      NS      i.root-servers.net.
.                       81362   IN      NS      h.root-servers.net.
.                       81362   IN      NS      b.root-servers.net.
.                       81362   IN      NS      m.root-servers.net.

;; ADDITIONAL SECTION:
k.root-servers.net.     40082   IN      A       193.0.14.129
a.root-servers.net.     40082   IN      A       198.41.0.4
l.root-servers.net.     40082   IN      A       199.7.83.42
d.root-servers.net.     40082   IN      A       128.8.10.90
c.root-servers.net.     40082   IN      A       192.33.4.12
e.root-servers.net.     40082   IN      A       192.203.230.10
j.root-servers.net.     40082   IN      A       192.58.128.30
f.root-servers.net.     40082   IN      A       192.5.5.241
i.root-servers.net.     40082   IN      A       192.36.148.17
b.root-servers.net.     40082   IN      A       192.228.79.201
m.root-servers.net.     40082   IN      A       202.12.27.33

;; Query time: 0 msec
;; SERVER: 10.202.200.215#53(10.202.200.215)
;; WHEN: Tue Aug 16 20:27:31 2011
;; MSG SIZE  rcvd: 417

This shows there is a number of root name servers server we could pick from in the Answer section of the output. The additional section gives you the ip address of these name servers and we could have picked any but decided to go with k.root as its the first.


2) Ask the first server (eg k.root) who looks after org

8:27pm zzz:~ > dig -t ns @193.0.14.129 org

; <<>> DiG 9.6.1-P1 <<>> -t ns @193.0.14.129 org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61373
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 6

;; QUESTION SECTION:
;org.                           IN      NS

;; ANSWER SECTION:
org.                    62902   IN      NS      c0.org.afilias-nst.info.
org.                    62902   IN      NS      d0.org.afilias-nst.org.
org.                    62902   IN      NS      b0.org.afilias-nst.org.
org.                    62902   IN      NS      a0.org.afilias-nst.info.
org.                    62902   IN      NS      b2.org.afilias-nst.org.
org.                    62902   IN      NS      a2.org.afilias-nst.info.

;; ADDITIONAL SECTION:
b0.org.afilias-nst.org. 60805   IN      A       199.19.54.1
b2.org.afilias-nst.org. 60805   IN      A       199.249.120.1
a0.org.afilias-nst.info. 69187  IN      A       199.19.56.1
a0.org.afilias-nst.info. 69187  IN      AAAA    2001:500:e::1
c0.org.afilias-nst.info. 69187  IN      A       199.19.53.1
c0.org.afilias-nst.info. 69187  IN      AAAA    2001:500:b::1

;; Query time: 6 msec
;; SERVER: 193.0.14.129#53(193.0.14.129)
;; WHEN: Tue Aug 16 20:29:06 2011
;; MSG SIZE  rcvd: 279

3) Ask b0.org who looks after rscott.org

8:29pm zzz:~ > dig -t ns @199.19.54.1 rscott.org

; <<>> DiG 9.6.1-P1 <<>> -t ns @199.19.54.1 rscott.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43625
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;rscott.org.                    IN      NS

;; ANSWER SECTION:
rscott.org.             6500    IN      NS      ns14.zoneedit.com.
rscott.org.             6500    IN      NS      ns7.zoneedit.com.

;; ADDITIONAL SECTION:
ns14.zoneedit.com.      3019    IN      A       209.126.137.108

;; Query time: 7 msec
;; SERVER: 199.19.54.1#53(199.19.54.1)
;; WHEN: Tue Aug 16 20:30:27 2011
;; MSG SIZE  rcvd: 93

4) Ask ns14.zoneedit who looks after rscott.org and it replies back that it does.

8:30pm zzz:~ > dig -t ns @209.126.137.108 rscott.org

; <<>> DiG 9.6.1-P1 <<>> -t ns @209.126.137.108 rscott.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43297
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;rscott.org.                    IN      NS

;; ANSWER SECTION:
rscott.org.             6432    IN      NS      ns14.zoneedit.com.
rscott.org.             6432    IN      NS      ns7.zoneedit.com.

;; ADDITIONAL SECTION:
ns14.zoneedit.com.      2951    IN      A       209.126.137.108

;; Query time: 5 msec
;; SERVER: 209.126.137.108#53(209.126.137.108)
;; WHEN: Tue Aug 16 20:31:35 2011
;; MSG SIZE  rcvd: 93

5) Lets ask ns14.zoneedit for the Start of Authority Record

8:31pm zzz:~ > dig -t soa @209.126.137.108 rscott.org

; <<>> DiG 9.6.1-P1 <<>> -t soa @209.126.137.108 rscott.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49213
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; QUESTION SECTION:
;rscott.org.                    IN      SOA

;; ANSWER SECTION:
rscott.org.             7200    IN      SOA     ns7.zoneedit.com. soacontact.zoneedit.com. 2011271408 300 300 300 300

;; AUTHORITY SECTION:
rscott.org.             6395    IN      NS      ns7.zoneedit.com.
rscott.org.             6395    IN      NS      ns14.zoneedit.com.

;; ADDITIONAL SECTION:
ns14.zoneedit.com.      2914    IN      A       209.126.137.108

;; Query time: 170 msec
;; SERVER: 209.126.137.108#53(209.126.137.108)
;; WHEN: Tue Aug 16 20:32:12 2011
;; MSG SIZE  rcvd: 140

The "ns7.zoneedit.com" is the DNS master hence ns14 is the slave. The soacontact.zoneedit.com. means that if you have problems with this domain, contact soacontact@zoneedit.com. @'s have special meaning in zone files, so we replace it with a "." See here for all the other parameters.

6) Lets ask ns14.zoneedit for the A record (ie the ip address to send the traffic to)

8:32pm zzz:~ > dig -t a @209.126.137.108 rscott.org

; <<>> DiG 9.6.1-P1 <<>> -t a @209.126.137.108 rscott.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62799
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; QUESTION SECTION:
;rscott.org.                    IN      A

;; ANSWER SECTION:
rscott.org.             6008    IN      A       66.96.144.175

;; AUTHORITY SECTION:
rscott.org.             6008    IN      NS      ns7.zoneedit.com.
rscott.org.             6008    IN      NS      ns14.zoneedit.com.

;; ADDITIONAL SECTION:
ns14.zoneedit.com.      2527    IN      A       209.126.137.108

;; Query time: 5 msec
;; SERVER: 209.126.137.108#53(209.126.137.108)
;; WHEN: Tue Aug 16 20:38:39 2011
;; MSG SIZE  rcvd: 109

===========================================


Now for a slightly harder one: www.vispinabox.net.au


1) Get the root list
8:38pm zzz:~ > dig -t ns

; <<>> DiG 9.6.1-P1 <<>> -t ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2693
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 12

;; QUESTION SECTION:
;.                              IN      NS

;; ANSWER SECTION:
.                       80586   IN      NS      g.root-servers.net.
.                       80586   IN      NS      a.root-servers.net.
.                       80586   IN      NS      l.root-servers.net.
.                       80586   IN      NS      d.root-servers.net.
.                       80586   IN      NS      c.root-servers.net.
.                       80586   IN      NS      e.root-servers.net.
.                       80586   IN      NS      j.root-servers.net.
.                       80586   IN      NS      f.root-servers.net.
.                       80586   IN      NS      i.root-servers.net.
.                       80586   IN      NS      h.root-servers.net.
.                       80586   IN      NS      b.root-servers.net.
.                       80586   IN      NS      m.root-servers.net.
.                       80586   IN      NS      k.root-servers.net.

;; ADDITIONAL SECTION:
g.root-servers.net.     39306   IN      A       192.112.36.4
a.root-servers.net.     39306   IN      A       198.41.0.4
l.root-servers.net.     39306   IN      A       199.7.83.42
d.root-servers.net.     39306   IN      A       128.8.10.90
c.root-servers.net.     39306   IN      A       192.33.4.12
e.root-servers.net.     39306   IN      A       192.203.230.10
j.root-servers.net.     39306   IN      A       192.58.128.30
f.root-servers.net.     39306   IN      A       192.5.5.241
i.root-servers.net.     39306   IN      A       192.36.148.17
b.root-servers.net.     39306   IN      A       192.228.79.201
m.root-servers.net.     39306   IN      A       202.12.27.33
k.root-servers.net.     39306   IN      A       193.0.14.129

;; Query time: 4 msec
;; SERVER: 10.202.200.215#53(10.202.200.215)
;; WHEN: Tue Aug 16 20:40:27 2011
;; MSG SIZE  rcvd: 433

2) Ask g.root Who looks after au

8:40pm zzz:~ > dig -t ns @192.112.36.4 au

; <<>> DiG 9.6.1-P1 <<>> -t ns @192.112.36.4 au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50738
;; flags: qr rd ra; QUERY: 1, ANSWER: 12, AUTHORITY: 0, ADDITIONAL: 8

;; QUESTION SECTION:
;au.                            IN      NS

;; ANSWER SECTION:
au.                     56687   IN      NS      l.au.
au.                     56687   IN      NS      s.au.
au.                     56687   IN      NS      b.au.
au.                     56687   IN      NS      o.au.
au.                     56687   IN      NS      h.au.
au.                     56687   IN      NS      v.au.
au.                     56687   IN      NS      m.au.
au.                     56687   IN      NS      r.au.
au.                     56687   IN      NS      a.au.
au.                     56687   IN      NS      p.au.
au.                     56687   IN      NS      u.au.
au.                     56687   IN      NS      n.au.

;; ADDITIONAL SECTION:
h.au.                   152509  IN      A       202.65.13.73
m.au.                   143033  IN      A       156.154.101.18
n.au.                   155207  IN      A       156.154.102.18
p.au.                   153729  IN      A       156.154.104.18
a.au.                   152509  IN      A       58.65.254.73
b.au.                   152509  IN      A       58.65.253.73
l.au.                   155310  IN      A       156.154.100.18
u.au.                   152509  IN      A       211.29.133.32

;; Query time: 5 msec
;; SERVER: 192.112.36.4#53(192.112.36.4)
;; WHEN: Tue Aug 16 20:41:14 2011
;; MSG SIZE  rcvd: 340

3) ask h.au who looks after net.au (you get back the same set of servers)

8:41pm zzz:~ > dig -t ns @202.65.13.73 net.au

; <<>> DiG 9.6.1-P1 <<>> -t ns @202.65.13.73 net.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14286
;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 0, ADDITIONAL: 10

;; QUESTION SECTION:
;net.au.                                IN      NS

;; ANSWER SECTION:
net.au.                 86400   IN      NS      h.au.
net.au.                 86400   IN      NS      m.au.
net.au.                 86400   IN      NS      p.au.
net.au.                 86400   IN      NS      o.au.
net.au.                 86400   IN      NS      i.au.
net.au.                 86400   IN      NS      l.au.
net.au.                 86400   IN      NS      n.au.
net.au.                 86400   IN      NS      k.au.
net.au.                 86400   IN      NS      q.au.
net.au.                 86400   IN      NS      j.au.
net.au.                 86400   IN      NS      g.au.

;; ADDITIONAL SECTION:
j.au.                   152383  IN      A       202.65.13.72
h.au.                   152466  IN      A       202.65.13.73
l.au.                   155267  IN      A       156.154.100.18
k.au.                   152383  IN      A       202.65.12.71
i.au.                   152383  IN      A       202.65.12.72
m.au.                   142990  IN      A       156.154.101.18
p.au.                   153686  IN      A       156.154.104.18
n.au.                   155164  IN      A       156.154.102.18
q.au.                   152383  IN      A       156.154.105.18
g.au.                   152383  IN      A       202.65.12.73

;; Query time: 11 msec
;; SERVER: 202.65.13.73#53(202.65.13.73)
;; WHEN: Tue Aug 16 20:41:58 2011
;; MSG SIZE  rcvd: 360

4) ask h.au who looks after vispinabox.net.au

8:41pm zzz:~ > dig -t ns @202.65.13.73 vispinabox.net.au

; <<>> DiG 9.6.1-P1 <<>> -t ns @202.65.13.73 vispinabox.net.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51744
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;vispinabox.net.au.             IN      NS

;; ANSWER SECTION:
vispinabox.net.au.      14400   IN      NS      ns1.primeinternet.com.au.
vispinabox.net.au.      14400   IN      NS      ns2.primeinternet.com.au.

;; Query time: 183 msec
;; SERVER: 202.65.13.73#53(202.65.13.73)
;; WHEN: Tue Aug 16 20:42:59 2011
;; MSG SIZE  rcvd: 89

4) ask ns1.prime for the SOA record for this domain but we are missing the ip address so lets ask h.au for the A record for ns1.prime and then ask for the SOA

8:43pm zzz:~ > dig -t a @202.65.13.73 ns1.primeinternet.com.au.

; <<>> DiG 9.6.1-P1 <<>> -t a @202.65.13.73 ns1.primeinternet.com.au.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45835
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

;; QUESTION SECTION:
;ns1.primeinternet.com.au.      IN      A

;; ANSWER SECTION:
ns1.primeinternet.com.au. 14324 IN      A       203.89.234.119

;; AUTHORITY SECTION:
primeinternet.com.au.   14324   IN      NS      ns1.primeinternet.com.au.
primeinternet.com.au.   14324   IN      NS      ns2.primeinternet.com.au.

;; ADDITIONAL SECTION:
ns2.primeinternet.com.au. 14324 IN      A       72.51.39.224

;; Query time: 7 msec
;; SERVER: 202.65.13.73#53(202.65.13.73)
;; WHEN: Tue Aug 16 20:44:15 2011
;; MSG SIZE  rcvd: 106

(Look at this... if we repeat step 3 the A records are now cached and returned back)

8:44pm zzz:~ > dig -t ns @202.65.13.73 vispinabox.net.au

; <<>> DiG 9.6.1-P1 <<>> -t ns @202.65.13.73 vispinabox.net.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20208
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;vispinabox.net.au.             IN      NS

;; ANSWER SECTION:
vispinabox.net.au.      14276   IN      NS      ns2.primeinternet.com.au.
vispinabox.net.au.      14276   IN      NS      ns1.primeinternet.com.au.

;; ADDITIONAL SECTION:
ns1.primeinternet.com.au. 14275 IN      A       203.89.234.119
ns2.primeinternet.com.au. 14275 IN      A       72.51.39.224

;; Query time: 4 msec
;; SERVER: 202.65.13.73#53(202.65.13.73)
;; WHEN: Tue Aug 16 20:45:04 2011
;; MSG SIZE  rcvd: 121


8:45pm zzz:~ > dig -t soa @203.89.234.119 vispinabox.net.au

; <<>> DiG 9.6.1-P1 <<>> -t soa @203.89.234.119 vispinabox.net.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23138
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;vispinabox.net.au.             IN      SOA

;; ANSWER SECTION:
vispinabox.net.au.      14400   IN      SOA     ns1.primeinternet.com.au. support.onetelecom.com.au. 1267748488 10800

3600 604800 10800

;; AUTHORITY SECTION:
vispinabox.net.au.      14208   IN      NS      ns2.primeinternet.com.au.
vispinabox.net.au.      14208   IN      NS      ns1.primeinternet.com.au.

;; ADDITIONAL SECTION:
ns1.primeinternet.com.au. 14207 IN      A       203.89.234.119
ns2.primeinternet.com.au. 14207 IN      A       72.51.39.224

;; Query time: 26 msec
;; SERVER: 203.89.234.119#53(203.89.234.119)
;; WHEN: Tue Aug 16 20:46:11 2011
;; MSG SIZE  rcvd: 176


5) ask ns1.prime who looks after www.vispinabox.net.au and we find thats it a CNAME (ie alias)

8:47pm zzz:~ > dig -t ns @203.89.234.119 www.vispinabox.net.au

; <<>> DiG 9.6.1-P1 <<>> -t ns @203.89.234.119 www.vispinabox.net.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40247
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;www.vispinabox.net.au.         IN      NS

;; ANSWER SECTION:
www.vispinabox.net.au.  14400   IN      CNAME   vispinabox.net.au.
vispinabox.net.au.      14108   IN      NS      ns1.primeinternet.com.au.
vispinabox.net.au.      14108   IN      NS      ns2.primeinternet.com.au.

;; ADDITIONAL SECTION:
ns1.primeinternet.com.au. 14107 IN      A       203.89.234.119
ns2.primeinternet.com.au. 14107 IN      A       72.51.39.224

;; Query time: 23 msec
;; SERVER: 203.89.234.119#53(203.89.234.119)
;; WHEN: Tue Aug 16 20:47:51 2011
;; MSG SIZE  rcvd: 139

6) so lets get the A record for this domain

8:47pm zzz:~ > dig -t a @203.89.234.119 www.vispinabox.net.au

; <<>> DiG 9.6.1-P1 <<>> -t a @203.89.234.119 www.vispinabox.net.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32852
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.vispinabox.net.au.         IN      A

;; ANSWER SECTION:
www.vispinabox.net.au.  14327   IN      CNAME   vispinabox.net.au.
vispinabox.net.au.      14395   IN      A       124.254.72.115

;; AUTHORITY SECTION:
vispinabox.net.au.      14035   IN      NS      ns2.primeinternet.com.au.
vispinabox.net.au.      14035   IN      NS      ns1.primeinternet.com.au.

;; ADDITIONAL SECTION:
ns1.primeinternet.com.au. 14034 IN      A       203.89.234.119
ns2.primeinternet.com.au. 14034 IN      A       72.51.39.224

;; Query time: 5 msec
;; SERVER: 203.89.234.119#53(203.89.234.119)
;; WHEN: Tue Aug 16 20:49:05 2011
;; MSG SIZE  rcvd: 155


===========================================
The simplest way to do this is as follows but where's the fun then?

9:39pm zzz:~ > dig +trace rscott.org

; <<>> DiG 9.6.1-P1 <<>> +trace rscott.org
;; global options: +cmd
.                       86022   IN      NS      j.root-servers.net.
.                       86022   IN      NS      k.root-servers.net.
.                       86022   IN      NS      l.root-servers.net.
.                       86022   IN      NS      i.root-servers.net.
.                       86022   IN      NS      b.root-servers.net.
.                       86022   IN      NS      g.root-servers.net.
.                       86022   IN      NS      h.root-servers.net.
.                       86022   IN      NS      m.root-servers.net.
.                       86022   IN      NS      e.root-servers.net.
.                       86022   IN      NS      a.root-servers.net.
.                       86022   IN      NS      c.root-servers.net.
.                       86022   IN      NS      d.root-servers.net.
.                       86022   IN      NS      f.root-servers.net.
;; Received 449 bytes from 10.202.200.215#53(10.202.200.215) in 1 ms

rscott.org.             1205    IN      A       66.96.144.175
rscott.org.             1205    IN      NS      ns14.zoneedit.com.
rscott.org.             1205    IN      NS      ns7.zoneedit.com.
;; Received 93 bytes from 192.5.5.241#53(f.root-servers.net) in 5 ms

9:58pm zzz:~ > dig +trace www.vispinabox.net.au

; <<>> DiG 9.6.1-P1 <<>> +trace www.vispinabox.net.au
;; global options: +cmd
.                       86000   IN      NS      k.root-servers.net.
.                       86000   IN      NS      l.root-servers.net.
.                       86000   IN      NS      i.root-servers.net.
.                       86000   IN      NS      b.root-servers.net.
.                       86000   IN      NS      g.root-servers.net.
.                       86000   IN      NS      h.root-servers.net.
.                       86000   IN      NS      m.root-servers.net.
.                       86000   IN      NS      e.root-servers.net.
.                       86000   IN      NS      a.root-servers.net.
.                       86000   IN      NS      c.root-servers.net.
.                       86000   IN      NS      d.root-servers.net.
.                       86000   IN      NS      f.root-servers.net.
.                       86000   IN      NS      j.root-servers.net.
;; Received 449 bytes from 10.202.200.215#53(10.202.200.215) in 1 ms

www.vispinabox.net.au.  10127   IN      CNAME   vispinabox.net.au.
vispinabox.net.au.      10195   IN      A       124.254.72.115
vispinabox.net.au.      9835    IN      NS      ns1.primeinternet.com.au.
vispinabox.net.au.      9835    IN      NS      ns2.primeinternet.com.au.
;; Received 155 bytes from 128.63.2.53#53(h.root-servers.net) in 5 ms