[dns-operations] DNS over TCP response fragmentation

Tue Oct 3 09:25:50 UTC 2023

Hello,

my name is Jan Petto and I am currently studying computer science at TU 
Darmstadt, Germany. During the research for my thesis, I have found some 
odd behavior regarding DNS over TCP, which neither I nor my supervisor 
can explain. I am hoping somebody here can tell me what I am observing:

For my research, I am sending DNS requests over TCP to many different 
recursive DNS servers all over the world. A significant portion of these 
servers is sending the DNS response in two separate TCP segments, even 
though it would easily fit into one packet. Only after my client has 
acknowledged the first segment, the second part of the response is sent. 
The first TCP segment always contains only one or two bytes, never more.

I know a DNS message sent over TCP is prefixed by a two-byte field 
containing the message length. My first thought was that the first TCP 
segment contains this length field, and the second segment contains the 
DNS message, but then I discovered cases where only one of the two 
length bytes was contained in the first segment. In any case, sending 
the message length as a separate packet does not make much sense to me 
from an application design perspective. Maybe this is some sort of 
attack mitigation?

I have attached a packet capture containing two such examples. You can 
reproduce the behavior with any DNS client, e.g. dig:

# dig example.org +tcp @100.37.202.139

Also attached is a list of public DNS server IP addresses, where I have 
observed this behavior. They were found via scans of the IP address 
space, I have no affiliation with these servers.

I would greatly appreciate any input as to why so many servers are 
sending their responses in such a way.

Kind regards,
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ipsize-dns-fragmented.pcapng
Type: application/x-pcapng
Size: 3476 bytes
Desc: not available
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20231003/4753655a/attachment.bin>
-------------- next part --------------
196.178.99.42
196.178.97.74
196.178.100.75
196.178.97.33
186.96.181.137
2a00:1a48:7805:112:52f4:c70e:ff08:410b
196.178.97.19
146.234.4.9
94.113.255.203
85.97.108.112
213.89.54.107
96.244.44.210
146.234.6.22
50.195.74.209
109.238.128.2
94.199.109.83
80.50.143.70
128.92.181.234
85.105.101.244
94.121.14.48
94.190.57.64
196.178.97.22
68.129.212.234
65.212.192.190
199.16.96.117
146.234.4.76
62.154.249.210
210.183.167.70
71.13.93.234
94.199.109.118
213.47.151.33
84.248.207.134
74.115.78.103
46.127.32.30
85.99.121.187
219.249.252.199
65.204.37.126
12.26.58.58
84.238.110.212
68.161.180.132
1.231.78.168
84.250.22.253
47.46.242.45
1.254.12.156
96.39.117.49
221.140.146.234
221.141.114.252
84.251.33.239
158.193.168.87
219.240.29.214
97.68.237.221
65.204.37.125
65.220.42.38
47.22.26.100
207.229.159.102
73.206.222.60
162.246.127.108
47.7.35.32
84.202.177.92
211.229.85.122
85.100.126.39
84.250.31.50
8.40.199.130
71.13.8.253
65.204.37.121
68.132.214.202
85.105.243.3
213.81.205.219
211.244.46.28
85.105.127.19
219.240.41.167
97.94.37.153
117.123.213.235
73.47.162.91
67.203.65.119
213.95.17.117
84.238.101.91
37.186.246.227
73.204.89.144
71.8.217.101
190.196.237.181
68.204.213.178
63.145.195.171
210.181.78.148
210.123.59.52
178.174.156.158
136.25.188.10
97.90.69.137
71.37.163.73
68.188.125.109
201.6.108.239
80.50.102.198
46.105.240.201
114.108.101.221
96.39.85.241
221.143.78.43
1.251.73.59
76.136.193.229
219.248.220.60
97.95.243.248
177.135.246.125
96.35.180.153
96.38.247.157
69.195.19.126
77.26.206.123
221.143.145.6
1.234.251.218
155.4.142.2
98.121.86.8
85.105.227.211
63.158.233.242
80.67.102.78
85.97.203.192
65.204.37.123
1.236.228.56
1.228.40.81
219.248.62.20
181.80.221.28
1.250.177.66
47.17.84.151
85.198.220.79
184.74.4.90
201.6.157.195
221.142.156.120
2a00:19a0:3:73:0:d9c6:73a7:1
1.229.138.117
71.14.129.11
199.88.54.147
135.26.231.217
121.1.101.20
1.236.135.117
211.245.1.186
47.23.39.75
1.234.72.194
71.78.111.122
71.15.61.49
69.36.56.194
210.97.122.146
189.1.130.178
1.248.180.17
74.142.250.122
186.103.169.13
1.241.255.209
124.43.16.128
219.251.80.2
219.250.233.64
2a00:19a0:3:73:0:d9c6:73a8:1
211.250.7.187
219.251.64.249
152.179.195.50
47.180.183.29
219.254.58.51
203.232.126.117
219.254.55.117
61.80.243.144
219.255.19.117
219.241.23.181
84.238.118.126
131.148.23.33
24.142.130.69
146.234.12.61
219.251.65.136
65.204.37.120
47.22.167.70
89.36.12.46
210.181.125.174
1.237.63.49
219.250.166.235
219.248.22.70
196.178.97.28
74.62.223.150
134.249.122.58
1.243.175.200
210.103.56.198
221.143.39.141
2600:8803:2400:2:b675:eff:fef8:9184
47.23.129.29
189.120.98.146
66.214.36.201
61.85.73.87
96.39.19.209
1.243.177.174
221.138.56.206
219.240.64.67
73.84.59.219
23.92.4.192
2a00:19a0:3:73:0:d9c6:73b1:1
181.47.46.133
95.209.148.48
1.237.70.173
61.85.1.84
219.251.80.203
85.230.180.208
85.105.234.248
219.250.155.177
210.96.2.24
1.240.209.144
2a00:19a0:3:73:0:d9c6:732c:1
47.47.63.77
210.183.180.18
210.224.86.126
84.33.37.139
82.222.24.4
203.229.17.12
202.152.112.223
138.59.177.89
2001:559:8451::1
201.6.111.12
1.224.93.120
153.230.202.70
219.250.166.77
1.228.222.187
219.248.235.39
219.240.242.171
208.29.185.192
83.99.165.47
178.176.245.92
208.29.185.196
210.104.171.63
85.105.47.187
210.117.20.16
221.143.84.224
221.157.145.248
201.69.254.97
97.86.80.189
199.83.119.73
199.0.193.48
76.180.91.108
1.251.162.114
97.87.88.121
190.196.224.206
85.98.209.48
47.50.157.169
1.228.136.6
221.140.55.15
190.128.118.169
1.246.55.22
24.157.45.170
61.81.58.212
74.143.157.25
85.98.45.245
86.60.145.82
86.60.184.118
92.154.38.19
2001:559:800c:1900::1536
221.143.33.18
221.141.147.207
219.255.107.86
190.196.234.252
219.251.80.86
12.28.27.174
1.236.220.97
1.228.222.181
221.142.206.222
134.195.116.204
210.106.122.195
190.181.23.34
210.117.32.167
186.190.232.58
196.178.99.16
12.215.32.133
1.235.249.112
47.49.15.17
1.239.153.248
221.143.248.81
1.243.15.85
135.26.231.43
219.254.58.105
219.251.86.192
219.254.58.38
219.255.227.47
76.170.200.166
221.140.194.151
1.228.191.208
221.140.57.9
2001:579:d120:7:6238:e0ff:fe6f:5d7f
95.209.148.254
219.255.19.84
201.18.5.153
221.140.74.68
188.231.144.6
65.204.37.116
65.201.145.197
219.251.203.125
61.47.240.210
219.251.171.91
219.255.107.157
221.142.156.35
177.135.246.161
1.228.33.45
1.224.176.85
213.81.198.252
201.76.161.162
219.240.89.194
76.155.209.84
219.248.235.48
47.50.180.149
94.79.137.62
221.157.53.232
74.143.80.153
211.243.117.184
1.254.89.44
221.142.142.16
1.224.182.233
62.150.238.171
1.254.237.248
210.181.78.193
47.14.67.232
47.50.186.17
209.73.95.29
1.249.49.167
85.97.201.156
219.251.80.50
219.254.207.193
74.142.203.217
138.36.1.131
74.143.22.13
221.141.240.148
80.79.241.180
2a00:19a0:3:73:0:d9c6:73a6:1
201.21.206.81
219.254.83.168
201.6.121.81
185.90.150.2
219.251.253.164
92.27.111.120
131.108.100.216
61.80.244.144
209.73.92.67
47.47.79.193
1.229.13.175
153.225.33.158
221.142.251.45
1.234.72.238
221.142.9.34
1.237.46.38
47.49.156.9
126.207.74.45
97.89.209.157
221.142.206.156
211.245.70.49
219.248.237.116
223.131.125.199
1.239.141.157
219.251.253.69
201.7.1.228
219.250.166.53
1.243.204.252
47.50.218.41
181.39.10.131
12.3.202.230
219.251.253.221
209.73.85.1
219.250.181.48
219.250.166.225
158.75.69.5
219.251.80.127
201.6.102.193
219.248.24.171
24.153.133.217
201.2.196.60
93.43.7.68
124.43.16.247
1.243.177.149
219.251.168.239
85.105.185.89
1.234.251.240
1.228.182.10
5.79.229.225
1.224.156.101
197.91.157.63
219.251.80.83
219.251.80.179
1.231.34.66
221.139.159.81
219.250.233.72
219.251.43.11
69.204.50.204
1.231.155.51
221.138.163.158
190.143.245.84
163.123.2.223
219.254.253.145
122.16.53.205
94.121.14.233
134.119.188.105
85.105.30.152
95.209.148.47
1.228.229.106
219.254.141.69
179.253.13.29
163.53.180.141
211.228.55.182
212.220.204.109
221.141.241.110
66.207.84.163
221.140.55.41
153.233.252.12
41.90.112.194
193.168.153.182
201.93.178.74
152.170.61.77
164.132.28.106
189.122.38.104
1.224.79.136
85.105.89.23
221.143.235.49
124.46.160.39
219.254.21.174
152.170.117.55
174.56.1.217
69.38.175.206
116.34.82.177
134.119.188.109
201.18.146.94
199.227.108.101
201.2.196.53
1.229.208.121
94.70.135.161
168.235.72.175
201.18.68.210
152.231.92.158
162.247.149.172
124.46.160.12
186.122.36.11
96.35.199.85
136.143.205.147
68.174.32.22
190.190.83.48
124.46.160.62
176.178.183.177
189.4.63.229
47.46.177.33
122.23.0.89
85.221.235.142
2a00:ea8:100:f::73
163.53.180.51
165.84.164.108
190.196.225.238
94.70.199.49
155.0.179.29
134.119.188.123
134.119.188.122
124.46.160.19
85.105.74.245
134.119.188.110
217.182.234.187
47.23.92.70
190.196.225.254
134.119.188.120
71.26.220.61
86.57.207.30
86.60.199.23
128.127.66.206
201.17.130.47
97.94.217.194
152.170.63.21
134.119.188.108
189.112.44.180
134.119.188.125
47.46.175.185
190.196.237.162
190.196.224.222
170.187.201.167
134.119.188.103
89.216.103.160
124.46.160.61
97.69.225.21
126.143.24.74
74.62.85.165
126.143.30.246
134.119.188.118
190.196.224.172
134.119.188.121
163.53.180.50
76.243.124.202
124.46.160.48
192.171.210.33
72.139.71.98
89.35.117.208
136.25.170.47
195.210.2.229
97.89.92.153
139.60.81.166
89.33.238.200
89.33.239.224
126.143.33.150
201.16.208.139
74.62.175.3
124.46.160.34
201.6.103.129
126.143.22.222
72.137.169.66
190.196.224.242
201.18.144.129
201.7.1.17
94.203.238.82
126.143.2.50
97.77.106.4
186.96.253.149
194.206.119.99
176.178.182.37
124.46.160.59
126.143.25.78
212.220.210.230
85.99.245.24
42.82.38.246
199.19.62.213
96.36.248.12
141.105.61.104
192.36.182.144
85.98.10.171
213.91.171.189
126.143.10.54
126.143.21.118
213.186.143.119
82.209.228.117
210.123.8.237
190.193.64.16
199.233.236.76
199.241.30.225
2804:2264:8000:0:fa7f:a5ff:fe07:fce6
95.211.209.41
85.105.178.9
153.230.171.177
77.62.163.7
164.132.189.37
199.244.50.239
23.96.94.187
162.222.23.242
190.196.224.139
8.41.42.210
158.51.80.141
2a01:d0:ffff:50a::f3e7
65.255.197.147
94.205.212.142
190.196.225.43
190.196.239.231
104.240.239.213
96.35.212.17
194.213.21.188
208.138.27.230
89.42.238.234
190.196.225.92
153.228.153.12
2.50.190.192
192.160.248.46
94.201.105.155
98.126.207.68
47.88.4.199
210.186.176.198
177.220.188.100
2.50.168.71
109.28.235.166
211.243.210.211
62.156.151.181
125.1.51.53
86.57.234.16
2800:160:1168:1::14
146.234.4.77
198.31.32.13
153.246.191.15
102.50.248.57
192.169.7.39
217.178.113.52
199.68.191.78
153.231.79.18
148.69.179.183
94.205.212.140
210.186.176.95
2.50.30.100
212.205.243.1
217.165.114.137
102.50.245.142
72.130.78.198
162.247.150.182
217.178.113.51
72.0.242.64
94.204.104.203
208.131.164.11
212.205.210.41
116.49.147.248
124.159.92.54
85.105.128.48
68.170.92.184
210.186.176.115
74.133.228.111
94.202.53.34
80.70.233.234
211.238.78.2
181.28.131.24
185.72.149.1
74.62.198.28
185.67.2.242
103.49.59.110
88.37.226.84
200.228.168.3
94.200.134.58
190.149.255.185
88.37.226.82
194.206.119.100
153.246.9.160
189.14.192.30
212.220.110.82
213.172.5.100
94.201.105.185
162.212.232.14
94.206.205.35
76.179.67.50
100.38.149.212
47.44.72.167
68.185.109.132
162.254.207.3
81.4.160.179
116.49.234.249
65.255.197.146
212.71.238.118
208.138.28.42
126.34.147.146
76.8.202.50
40.122.75.101
213.92.197.135
76.173.80.21
124.47.199.231
197.255.217.218
199.241.31.83
181.29.205.166
150.129.62.145
201.73.96.34
197.246.171.19
177.130.49.107
40.122.150.136
153.231.6.202
3.144.47.60
52.237.75.71
192.240.114.34
85.105.7.71
106.51.76.42
192.240.114.36
97.78.86.62
134.119.188.106
114.30.135.195
162.247.146.115
67.209.206.71
103.49.57.162
85.26.248.144
103.35.142.23
104.244.77.67
103.49.59.253
192.240.114.35
64.183.93.234
198.136.51.251
5.89.30.10
103.35.142.113
103.49.58.31
124.47.220.163
193.185.161.72
104.243.228.225
40.122.133.169
41.33.215.89
162.250.114.113
103.49.58.119
92.154.51.178
106.51.85.179
217.178.36.225
103.49.57.239
106.51.126.193
134.119.188.126
189.8.82.132
150.147.38.6
40.122.213.18
134.119.188.107
1.32.99.14
2605:8900:3000:1001:a:0:8f:1
103.49.56.249
212.205.243.161
190.144.33.116
2605:8900:3000:1001:a:0:8c:1
103.49.58.162
196.178.97.117
40.122.167.150
192.160.246.57
194.190.30.184
103.49.59.215
152.44.112.181
2605:8900:3000:1001:a:0:90:1
134.119.188.104
96.239.56.53
71.76.171.4
40.122.164.104
103.49.56.232
40.122.209.200
103.49.58.43
2600:3c00::f03c:91ff:fedb:9953
46.45.144.184
134.119.188.119
103.49.57.21
2605:8900:3000:1001:a:0:93:1
153.225.120.125
103.49.58.140
202.124.224.163
23.91.218.38
201.21.208.136
46.45.144.188
2605:8900:3000:1001:a:0:8e:1
106.51.129.231
201.73.17.20
188.247.40.233
103.49.57.102
150.129.120.160
37.150.124.150
150.129.120.198
150.129.120.147
146.234.4.56
122.25.52.60
193.185.161.73
150.129.120.191
152.169.162.236
41.141.250.233
103.49.57.54
103.49.58.236
72.142.160.85
195.250.65.54
194.147.144.252
203.227.215.80
126.131.133.245
2a00:19a0:3:72:0:d9c6:727a:1
184.83.103.90
202.157.68.194
210.124.149.209
54.92.108.243
2400:8901::f03c:91ff:fef1:a07e
141.164.96.6
163.53.86.206
2600:3c00::f03c:91ff:fe55:b20a
95.209.161.102
182.50.68.222
106.51.39.10
181.28.73.131
43.206.226.8
65.214.70.39
41.140.245.226
196.92.1.233
150.129.120.212
106.51.132.130
155.0.181.2
168.243.205.205
203.227.216.18
2a00:19a0:3:72:0:d9c6:7210:1
77.106.161.166
150.129.63.23
177.222.254.75
197.95.196.78
117.4.33.40
190.145.38.2
47.49.229.233
2a00:19a0:3:72:0:d9c6:7211:1
213.91.150.178
150.129.120.240
203.8.30.134
41.140.244.87
150.129.120.247
164.132.212.38
128.65.186.84
85.105.192.57
203.253.253.36
94.70.210.177
96.35.215.25
12.205.173.60
202.149.204.199
94.74.128.2
190.194.148.212
203.8.30.145
202.149.204.253
213.89.210.76
179.228.172.51
82.200.198.30
202.149.205.63
213.89.223.230
202.149.205.21
192.190.162.137
177.130.49.1
202.149.205.210
202.149.204.54
202.149.205.118
24.143.77.166
177.203.53.104
198.153.111.212
190.136.20.104
150.129.120.254
86.57.193.74
190.196.225.140
202.149.205.39
103.234.94.225
202.149.205.74
202.149.205.238
184.83.60.187
62.141.27.206
71.13.181.13
201.17.131.148
84.250.253.113
217.182.234.181
94.70.205.225
212.205.210.42
210.181.78.143
124.32.164.119
92.124.145.79
96.35.193.229
202.62.95.150
202.149.204.99
139.0.18.82
73.46.233.199
190.196.225.106
197.246.11.217
103.226.226.54
221.138.30.45
122.222.113.252
84.238.114.95
118.163.84.48
164.132.212.37
202.149.205.59
200.236.7.141
202.62.95.18
210.59.236.121
122.26.142.48
150.129.120.186
210.242.211.149
118.163.60.84
122.166.167.216
52.166.182.150
150.129.62.170
213.142.213.238
136.232.49.174
202.149.205.73
216.54.23.36
117.2.105.36
179.254.6.101
164.132.212.39
177.222.249.124
196.178.97.66
112.196.183.8
84.47.134.203
83.149.31.108
150.129.120.181
135.129.129.180
112.196.183.252
201.3.242.101
150.129.120.234
2605:ea00:1:1:1:1:7424:e21c
2605:ea00:1:1:1:1:76a6:a13a
150.129.120.244
74.62.51.228
85.105.243.21
190.196.224.192
212.205.228.92
111.118.152.44
172.254.155.36
95.209.148.61
128.65.54.99
177.130.52.78
189.10.61.145
77.18.151.179
196.178.100.22
61.62.214.57
201.17.130.95
202.149.205.117
168.228.6.94
103.49.57.39
65.38.241.8
124.36.45.235