nslookup communications error: end of file

BriggsDane 166

I am running a nslookup on my domain for SRV records and I am getting a communications error: end of file. Not exactly sure what that error means or how to go about fixing the issue.

Active Directory Integrated DNS

nslookup -type=SRV _ldap._tcp.internal.domain.com
;; Truncated, retrying in TCP mode.
;; communications error: end of file

;; communications error: end of file

BriggsDane 166 Reputation points

2020-10-02T19:09:52.097+00:00

II also receive this error as well.

nslookup -q=SRV _ldap._tcp.internal.domain
Server: DNS Server
Address: ...

*** DNS Server can't find _ldap._tcp.internal.domain: Format error

I have 2 datacenters, One is experiencing this error but the other is not. Per my Network Engineer TCP\UDP 53 is open.
BriggsDane 166 Reputation points

2020-10-07T14:28:29.277+00:00

I believe this is a network issue however I am unable to narrow down the exact issue. I am leaning towards this being an issue with packet size. I have 50+ DCs throughout my environment so a nslookup response for all SRV records can be a fairly large response.

From a test server I set the Primary DNS to a DC in one datacenter and nslookup -type=SRV _ldap._tcp.dc._msdcs.domain functions as expected. I change the Primary DNS on the same server to a different DC in the other datacenter nslookup fails with a format error.

I logged into a DC that I am getting format errors and ran nslookup to itself and received the expected response so the DC is not the issue.

I've enabled verbose DNS Debugging on DCs in both datacenters. I see the DNS query for nslookup hit both DCs but the responses are different. The non-functioning DC responds with a lot of missing information and missing SRV records.

DNS Debugging log
Functioning DC = 1775 lines
Non-Functioning = 685 lines
BriggsDane 166 Reputation points

2020-10-07T14:29:07.513+00:00

I've also verified that port 53 TCP/UDP is open to Domain Controllers in both datacenters
BriggsDane 166 Reputation points

2020-10-07T14:29:39.213+00:00

Additionally I ran nslookup -debug -type=SRV _ldap._tcp.dc._msdcs.domain and I got the following

truncated answer

Got answer:
HEADER:
opcode = UPDATE, id = 21584, rcode = FORMERR
header flags: query, auth. answer, truncation, want recursion
questions = 11824, answers = 8244, authority records = 12336, additional = 8258

QUESTIONS:
Invalid Name at offset 12!

*** DC1.domain can't find _ldap._tcp.dc._msdcs.domain : Format error
Gloria Gu 3,896 Reputation points

2020-10-09T07:17:30.507+00:00

@BriggsDane Hi,

Since the command" nslookup -type=SRV _ldap._tcp.dc._msdcs.domain" is correct, the format error makes no sense in the normal situation.
Can you please check whether the DC with problem have its SRV record exists in DNS server under this path?

What's more, please run command 'Dcdiag' to perform a domain controller health Check and post the screenshoot.
dcdiag-check-domain-controller-health
BriggsDane 166 Reputation points

2020-10-09T14:07:55.907+00:00

The DC is fine. SRV record is there and DCDIAG comes back normal. I think that the Network/Firewall team is doing something to malform the packet. I'm trying to figure out what they are doing that would cause this issue. I see the question come in with DNS debugging but it looks fine. I've compared the DNS debug to the functioning and the question looks identical
Gloria Gu 3,896 Reputation points

2020-10-13T07:18:17.897+00:00

@BriggsDane Hi,

As you mentioned, "I think that the Network/Firewall team is doing something to malform the packet. " Have you ever tried to disable the firewall temporarily on the DC with problem to test the result?
BriggsDane 166 Reputation points

2020-10-13T14:09:32.667+00:00

I have no access to the network firewall. I did set the Domain Controller's primary DNS as itself and was successfully able to use nslookup command. I didn't know if anyone had seen similar issues with the Network/Firewall settings that I can take to the Network\Firewall teams.

Either way, Thank you very much for your assistance.
Gloria Gu 3,896 Reputation points

2020-10-14T01:20:42.993+00:00

You're welcome~

Accepted answer

Gloria Gu 3,896 Reputation points

2020-10-05T08:08:23.033+00:00

Hi,

Thank you for posting in Q&A!

"ORA-03113 ERROR MESSAGE END-OF-FILE ON COMMUNICATION CHANNEL" This error can often fall into two large categories: errors caused by syntax error and misappropriation and connection errors between servers.

(1) As described in the offical doc how-to-verify-that-srv-dns-records-have-been-created-for-a-domain-cont, Active Directory creates its SRV records in the following folders, where Domain_Name is the name of your domain:
Forward Lookup Zones/Domain_Name/_msdcs/dc/_sites/Default-First-Site-Name/_tcp

To use Nslookup to verify the SRV records, type this command: nslookup -type=SRV _ldap._tcp.dc._msdcs.domain name
I've tried this command in my environment and it works successfully.

(2)If this command fail to work, you should check your network connection. To do this, check by Control Panel> Network and Internet> Network connections> Diagnose this connection& pinging via the IP address and the DNS name and other general network problem methods.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

nslookup communications error: end of file

0 additional answers

Your answer