sys-cmd dig

sys-cmd dig sends a query to a DNS server from the route table selected in WEB-CLI and shows the response together with its sections: the records that return, the TTL durations, whether the response came from the authoritative server and the duration of the query. It is the command that gives the most detailed information in name resolution problems.

Command Summary

TR7 WEB-CLI · sys-cmd dig

# type dig and press Tab: a free parameter

admin@TR7LBWAF01> sys-cmd dig

<dig-parameter-1>

 

admin@TR7LBWAF01> sys-cmd dig @<server> <name> <record-type> <options>

admin@TR7LBWAF01>  

Everything written after the word dig is passed to the tool as it is. There is no mandatory field; the name to be queried, the optional server, the record type and the options that begin with + are written according to the tool's own syntax.

How It Works

Subject	Behavior
Context	The query is sent from within the selected v-device and route table; a DNS server that cannot be reached from that route table does not respond.
The query server	If a server is not written with @, the default resolver on the device is used.
Duration	It closes by itself when the response arrives or when the waiting time expires.
Pipe	The output can be filtered with | or written to a file with to-file.
Recording	Every run is written to the user logs.

Frequently Used Parameters

Parameter	What it does	What is written after it
@<server>	Selects the DNS server to which the query will be sent	The IP address or the name of the server, adjacent to @ (e.g. @10.0.7.53)
The record type	Determines which record will be requested; if it is not written, A is queried	A · AAAA · CNAME · MX · NS · TXT · SOA · SRV
+short	Writes only the values in the response	—
+trace	Follows the resolution step by step starting from the root servers	—
+norecurse	Requests from the server only the response that it knows itself	—
+tcp	Sends the query with TCP instead of UDP	—
-x	Makes a reverse query	An IP address
-p	Selects a port of the server other than the default	A port number

The table summarizes frequently used parameters; the full list and behavior depend on the version of the tool on the device.

Examples

TR7 WEB-CLI · A) The address that GTM returns

# send the query directly to the DNS address of GTM

admin@TR7LBWAF01> sys-cmd dig @<gtm-dns-address> app.example.com A +short

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) The authoritative servers of the domain name

admin@TR7LBWAF01> sys-cmd dig @10.0.7.53 example.com NS

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) The certificate validation record

# before a certificate request with DNS validation, is the TXT record published

admin@TR7LBWAF01> sys-cmd dig _acme-challenge.example.com TXT +short

admin@TR7LBWAF01>  

TR7 WEB-CLI · D) The resolution chain

admin@TR7LBWAF01> sys-cmd dig app.example.com A +trace

admin@TR7LBWAF01>  

TR7 WEB-CLI · E) The reverse record and a query with TCP

admin@TR7LBWAF01> sys-cmd dig -x 10.0.7.20 +short

admin@TR7LBWAF01> sys-cmd dig @10.0.7.53 app.example.com A +tcp

admin@TR7LBWAF01>  

Things to Know

• An authoritative response. If the flags: line in the response header contains aa, the response came directly from the authoritative server; if not, it may have come from a cache. In GTM tests, in order to skip the cache layer, the query is sent to the DNS address of GTM with @.
• There is no response. The connection timed out message may show that the server cannot be reached from the selected route table; first the access to the server is verified with ping, then the context with route-table show.
• For a short check nslookup can also be used.