114.114.114.114 tcp模式无法解析

[haogege]

问题现象
114dns tcp模式无法解析 udp模式正常
server-tcp 114.114.114.114 无法解析任何域名
server-tcp 114.114.115.115 正常解析
server 114.114.114.114 正常解析
server 114.114.115.115 正常解析

同一台机器，手动用命令可以用tcp 114解析
同一台机器，adguardhome中配置tcp://114.114.114.114可以正常解析

运行环境

1. 固件型号
   debian 12

2. 运营商
   中国移动

3. smartdns来源以及版本
   smartdns 1.2026.06.28-1614 (Release48.2)

4. 涉及的配置(注意去除个人相关信息)
   bind [::]:50053 -no-cache -g 114dnstcp
   bind-tcp [::]:50053 -no-cache -g 114dnstcp

重现步骤

1. 上游DNS配置。
   server-tcp 114.114.114.114 -g 114dnstcp -e

2. 访问的域名。
   www.iqiyi.com

信息收集

1. 将/var/log/smrtdns.log日志作为附件上传(注意去除个人相关信息)。
2. 如进程异常，请将coredump功能开启，上传coredump信息文件，同时上传配套的smartdns进程文件。
   在自定义界面，开启设置->自定义设置->生成coredump配置，重现问题后提交coredump文件
   coredump文件在/tmp目录下

[2026-07-15 20:09:56,737][DEBUG][ dns_server.c:438 ] recv query packet from 127.0.0.1, len = 42, type = 0
[2026-07-15 20:09:56,738][DEBUG][ dns_server.c:454 ] request qdcount = 1, ancount = 0, nscount = 0, nrcount = 0, len = 42, id = 50862, tc = 0, rd = 1, ra = 0, rcode = 0
[2026-07-15 20:09:56,738][DEBUG][ dns_server.c:480 ] query www.iqiyi.com from 127.0.0.1, qtype: 1, id: 50862, query-num: 1
[2026-07-15 20:09:56,738][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:56,738][ INFO][ dns_client.c:537 ] request: www.iqiyi.com, qtype: 1, id: 48411, group: 114dnstcp
[2026-07-15 20:09:56,738][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:56,738][ INFO][ dns_client.c:537 ] request: www.iqiyi.com, qtype: 28, id: 19353, group: 114dnstcp
[2026-07-15 20:09:57,476][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 28, id: 19353
[2026-07-15 20:09:57,476][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:57,476][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 1, id: 48411
[2026-07-15 20:09:57,476][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:58,075][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 28, id: 19353
[2026-07-15 20:09:58,075][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:58,075][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 1, id: 48411
[2026-07-15 20:09:58,075][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:58,575][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 28, id: 19353
[2026-07-15 20:09:58,575][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:58,575][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 1, id: 48411
[2026-07-15 20:09:58,575][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:59,074][DEBUG][ query.c:318 ] retry query www.iqiyi.com, type: 28, id: 19353 failed
[2026-07-15 20:09:59,075][DEBUG][ query.c:50 ] result: www.iqiyi.com, qtype: 28, has-result: 0, id 19353
[2026-07-15 20:09:59,075][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 28, rcode: 0, reply: 1
[2026-07-15 20:09:59,075][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 28, rtcode: 2, id: 0
[2026-07-15 20:09:59,075][DEBUG][ dualstack.c:220 ] dualstack result: domain: www.iqiyi.com, ip: , type: 28, ping: -1, rcode: 2
[2026-07-15 20:09:59,075][DEBUG][ query.c:318 ] retry query www.iqiyi.com, type: 1, id: 48411 failed
[2026-07-15 20:09:59,075][DEBUG][ query.c:50 ] result: www.iqiyi.com, qtype: 1, has-result: 0, id 48411
[2026-07-15 20:09:59,075][ INFO][ request.c:85 ] result: www.iqiyi.com, qtype: 1, rtt: -0.1 ms, 0.0.0.0
[2026-07-15 20:09:59,075][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 1, rcode: 0, reply: 1
[2026-07-15 20:09:59,075][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 1, rtcode: 2, id: 50862
[2026-07-15 20:09:59,075][ INFO][ context.c:901 ] result: www.iqiyi.com, client: 127.0.0.1, qtype: 1, id: 50862, group: 114dnstcp, time: 2337ms
[2026-07-15 20:09:59,075][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 1, rcode: 0, reply: 0
[2026-07-15 20:09:59,075][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 1, rtcode: 2, id: 50862
[2026-07-15 20:09:59,075][DEBUG][ dns_server.c:438 ] recv query packet from 127.0.0.1, len = 42, type = 0
[2026-07-15 20:09:59,075][DEBUG][ dns_server.c:454 ] request qdcount = 1, ancount = 0, nscount = 0, nrcount = 0, len = 42, id = 35532, tc = 0, rd = 1, ra = 0, rcode = 0
[2026-07-15 20:09:59,076][DEBUG][ dns_server.c:480 ] query www.iqiyi.com from 127.0.0.1, qtype: 28, id: 35532, query-num: 3
[2026-07-15 20:09:59,076][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:59,076][ INFO][ dns_client.c:537 ] request: www.iqiyi.com, qtype: 28, id: 41521, group: 114dnstcp
[2026-07-15 20:09:59,076][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:59,076][ INFO][ dns_client.c:537 ] request: www.iqiyi.com, qtype: 1, id: 62827, group: 114dnstcp
[2026-07-15 20:09:59,675][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 1, id: 62827
[2026-07-15 20:09:59,675][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:09:59,675][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 28, id: 41521
[2026-07-15 20:09:59,675][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:00,074][DEBUG][ data_server.rs:600 ] insert domain:www.iqiyi.com, type:1
[2026-07-15 20:10:00,074][DEBUG][ data_server.rs:660 ] insert domain list count:1
[2026-07-15 20:10:00,175][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 1, id: 62827
[2026-07-15 20:10:00,175][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:00,175][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 28, id: 41521
[2026-07-15 20:10:00,175][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:00,675][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 1, id: 62827
[2026-07-15 20:10:00,675][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:00,675][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 28, id: 41521
[2026-07-15 20:10:00,675][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:01,275][DEBUG][ query.c:318 ] retry query www.iqiyi.com, type: 1, id: 62827 failed
[2026-07-15 20:10:01,275][DEBUG][ query.c:50 ] result: www.iqiyi.com, qtype: 1, has-result: 0, id 62827
[2026-07-15 20:10:01,275][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 1, rcode: 0, reply: 1
[2026-07-15 20:10:01,275][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 1, rtcode: 2, id: 0
[2026-07-15 20:10:01,275][DEBUG][ dualstack.c:220 ] dualstack result: domain: www.iqiyi.com, ip: , type: 1, ping: -1, rcode: 2
[2026-07-15 20:10:01,275][DEBUG][ query.c:318 ] retry query www.iqiyi.com, type: 28, id: 41521 failed
[2026-07-15 20:10:01,275][DEBUG][ query.c:50 ] result: www.iqiyi.com, qtype: 28, has-result: 0, id 41521
[2026-07-15 20:10:01,275][ INFO][ request.c:89 ] result: www.iqiyi.com, qtype: 28, rtt: -0.1 ms, 0000:0000:0000:0000:0000:0000:0000:0000
[2026-07-15 20:10:01,275][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 28, rcode: 0, reply: 1
[2026-07-15 20:10:01,275][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 28, rtcode: 2, id: 35532
[2026-07-15 20:10:01,276][ INFO][ context.c:901 ] result: www.iqiyi.com, client: 127.0.0.1, qtype: 28, id: 35532, group: 114dnstcp, time: 2200ms
[2026-07-15 20:10:01,276][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 28, rcode: 0, reply: 0
[2026-07-15 20:10:01,276][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 28, rtcode: 2, id: 35532
[2026-07-15 20:10:01,276][DEBUG][ dns_server.c:438 ] recv query packet from 127.0.0.1, len = 42, type = 0
[2026-07-15 20:10:01,276][DEBUG][ dns_server.c:454 ] request qdcount = 1, ancount = 0, nscount = 0, nrcount = 0, len = 42, id = 51699, tc = 0, rd = 1, ra = 0, rcode = 0
[2026-07-15 20:10:01,276][DEBUG][ dns_server.c:480 ] query www.iqiyi.com from 127.0.0.1, qtype: 2, id: 51699, query-num: 3
[2026-07-15 20:10:01,277][DEBUG][ request.c:1115] unsupported qtype: 2, domain: www.iqiyi.com
[2026-07-15 20:10:01,277][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:01,277][ INFO][ dns_client.c:537 ] request: www.iqiyi.com, qtype: 2, id: 57335, group: 114dnstcp
[2026-07-15 20:10:01,875][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 2, id: 57335
[2026-07-15 20:10:01,875][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:02,275][DEBUG][ data_server.rs:600 ] insert domain:www.iqiyi.com, type:28
[2026-07-15 20:10:02,275][DEBUG][ data_server.rs:660 ] insert domain list count:1
[2026-07-15 20:10:02,375][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 2, id: 57335
[2026-07-15 20:10:02,375][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:02,975][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 2, id: 57335
[2026-07-15 20:10:02,975][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:03,475][DEBUG][ query.c:318 ] retry query www.iqiyi.com, type: 2, id: 57335 failed
[2026-07-15 20:10:03,475][DEBUG][ query.c:50 ] result: www.iqiyi.com, qtype: 2, has-result: 0, id 57335
[2026-07-15 20:10:03,475][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 2, rcode: 0, reply: 1
[2026-07-15 20:10:03,475][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 2, rtcode: 2, id: 51699
[2026-07-15 20:10:03,475][ INFO][ context.c:901 ] result: www.iqiyi.com, client: 127.0.0.1, qtype: 2, id: 51699, group: 114dnstcp, time: 2198ms
[2026-07-15 20:10:03,476][DEBUG][ dns_server.c:438 ] recv query packet from 127.0.0.1, len = 42, type = 0
[2026-07-15 20:10:03,476][DEBUG][ dns_server.c:454 ] request qdcount = 1, ancount = 0, nscount = 0, nrcount = 0, len = 42, id = 53819, tc = 0, rd = 1, ra = 0, rcode = 0
[2026-07-15 20:10:03,476][DEBUG][ dns_server.c:480 ] query www.iqiyi.com from 127.0.0.1, qtype: 15, id: 53819, query-num: 2
[2026-07-15 20:10:03,476][DEBUG][ request.c:1115] unsupported qtype: 15, domain: www.iqiyi.com
[2026-07-15 20:10:03,476][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:03,476][ INFO][ dns_client.c:537 ] request: www.iqiyi.com, qtype: 15, id: 4643, group: 114dnstcp
[2026-07-15 20:10:04,476][DEBUG][ data_server.rs:600 ] insert domain:www.iqiyi.com, type:2
[2026-07-15 20:10:04,476][DEBUG][ data_server.rs:660 ] insert domain list count:1
[2026-07-15 20:10:04,476][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 15, id: 4643
[2026-07-15 20:10:04,476][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:05,075][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 15, id: 4643
[2026-07-15 20:10:05,075][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:05,575][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 15, id: 4643
[2026-07-15 20:10:05,575][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:06,075][DEBUG][ query.c:318 ] retry query www.iqiyi.com, type: 15, id: 4643 failed
[2026-07-15 20:10:06,075][DEBUG][ query.c:50 ] result: www.iqiyi.com, qtype: 15, has-result: 0, id 4643
[2026-07-15 20:10:06,075][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 15, rcode: 0, reply: 1
[2026-07-15 20:10:06,075][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 15, rtcode: 2, id: 53819
[2026-07-15 20:10:06,075][ INFO][ context.c:901 ] result: www.iqiyi.com, client: 127.0.0.1, qtype: 15, id: 53819, group: 114dnstcp, time: 2599ms
[2026-07-15 20:10:06,075][DEBUG][ dns_server.c:438 ] recv query packet from 127.0.0.1, len = 42, type = 0
[2026-07-15 20:10:06,075][DEBUG][ dns_server.c:454 ] request qdcount = 1, ancount = 0, nscount = 0, nrcount = 0, len = 42, id = 29826, tc = 0, rd = 1, ra = 0, rcode = 0
[2026-07-15 20:10:06,075][DEBUG][ dns_server.c:480 ] query www.iqiyi.com from 127.0.0.1, qtype: 16, id: 29826, query-num: 2
[2026-07-15 20:10:06,076][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:06,076][ INFO][ dns_client.c:537 ] request: www.iqiyi.com, qtype: 16, id: 58193, group: 114dnstcp
[2026-07-15 20:10:06,675][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 16, id: 58193
[2026-07-15 20:10:06,675][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:07,076][DEBUG][ data_server.rs:600 ] insert domain:www.iqiyi.com, type:15
[2026-07-15 20:10:07,076][DEBUG][ data_server.rs:660 ] insert domain list count:1
[2026-07-15 20:10:07,175][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 16, id: 58193
[2026-07-15 20:10:07,175][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:07,675][DEBUG][ query.c:321 ] retry query www.iqiyi.com, type: 16, id: 58193
[2026-07-15 20:10:07,675][DEBUG][ dns_client.c:415 ] send query to server 114.114.114.114:53, type:1
[2026-07-15 20:10:08,175][DEBUG][ query.c:318 ] retry query www.iqiyi.com, type: 16, id: 58193 failed
[2026-07-15 20:10:08,175][DEBUG][ query.c:50 ] result: www.iqiyi.com, qtype: 16, has-result: 0, id 58193
[2026-07-15 20:10:08,175][DEBUG][ context.c:846 ] reply www.iqiyi.com qtype: 16, rcode: 0, reply: 1
[2026-07-15 20:10:08,175][ INFO][ context.c:414 ] result: www.iqiyi.com, qtype: 16, rtcode: 2, id: 29826
[2026-07-15 20:10:08,175][ INFO][ context.c:901 ] result: www.iqiyi.com, client: 127.0.0.1, qtype: 16, id: 29826, group: 114dnstcp, time: 2099ms

[PikuZheng]

所以从这台debian直接用tcp测114能通吗（比如用kdig
我猜一个被防火墙阻挡，或者移动劫持（移动挺愿意干这种事的

[haogege]

我又继续测试，114dns 两个ip，用tcp模式在smartdns下都不成功，用adguardhome 还有kdig命令，都可以成功，然后我问了ai，给了我测试方法

root@dn2800:~# sudo nping --tcp -p 53 --source-port 12345 --data "aabb0100000100000000000005626169647503636f6d0000010001" -c 4 114.114.114.114

Starting Nping 0.7.93 ( https://nmap.org/nping ) at 2026-07-23 09:01 CST

SENT (0.0598s) TCP 172.24.172.100:12345 > 114.114.114.114:53 S ttl=64 id=61878 iplen=67 seq=2894232031 win=1480

SENT (1.0602s) TCP 172.24.172.100:12345 > 114.114.114.114:53 S ttl=64 id=61878 iplen=67 seq=2894232031 win=1480

SENT (2.0615s) TCP 172.24.172.100:12345 > 114.114.114.114:53 S ttl=64 id=61878 iplen=67 seq=2894232031 win=1480

SENT (3.0628s) TCP 172.24.172.100:12345 > 114.114.114.114:53 S ttl=64 id=61878 iplen=67 seq=2894232031 win=1480

Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A

Raw packets sent: 4 (268B) | Rcvd: 0 (0B) | Lost: 4 (100.00%)

Nping done: 1 IP address pinged in 4.09 seconds

root@dn2800:~# sudo nping --tcp -p 53 --source-port 12345 --data "aabb0100000100000000000005626169647503636f6d0000010001" -c 4 180.184.2.2

Starting Nping 0.7.93 ( https://nmap.org/nping ) at 2026-07-23 09:01 CST

SENT (0.0436s) TCP 172.24.172.100:12345 > 180.184.2.2:53 S ttl=64 id=41607 iplen=67 seq=2553878276 win=1480

RCVD (0.0748s) TCP 180.184.2.2:53 > 172.24.172.100:12345 SA ttl=50 id=0 iplen=44 seq=1917402231 win=42340 <mss 1400>

SENT (1.0440s) TCP 172.24.172.100:12345 > 180.184.2.2:53 S ttl=64 id=41607 iplen=67 seq=2553878276 win=1480

RCVD (1.0743s) TCP 180.184.2.2:53 > 172.24.172.100:12345 SA ttl=50 id=0 iplen=44 seq=1933023288 win=42340 <mss 1400>

SENT (2.0453s) TCP 172.24.172.100:12345 > 180.184.2.2:53 S ttl=64 id=41607 iplen=67 seq=2553878276 win=1480

RCVD (2.0757s) TCP 180.184.2.2:53 > 172.24.172.100:12345 SA ttl=50 id=0 iplen=44 seq=1948668007 win=42340 <mss 1400>

SENT (3.0468s) TCP 172.24.172.100:12345 > 180.184.2.2:53 S ttl=64 id=41607 iplen=67 seq=2553878276 win=1480

RCVD (3.0774s) TCP 180.184.2.2:53 > 172.24.172.100:12345 SA ttl=50 id=0 iplen=44 seq=1964319705 win=42340 <mss 1400>

Max rtt: 31.074ms | Min rtt: 30.162ms | Avg rtt: 30.492ms

Raw packets sent: 4 (268B) | Rcvd: 4 (200B) | Lost: 0 (0.00%)

Nping done: 1 IP address pinged in 3.11 seconds

root@dn2800:~#

AI的回复

为什么这次 114 丢包 100%，而 180 通了？
关键看日志里的这个标志：S（代表 SYN 握手包）。

Plaintext
SENT ... TCP 172.24.172.100:12345 > 114.114.114.114:53 S ... iplen=67

1. 协议违规：在 SYN 阶段硬塞 Data Payload
   你发的是 SYN 包（发起 TCP 三次握手的第一个包）。

但同时你加上了 --data，硬生生在 SYN 包里塞上了 DNS 数据（iplen=67，正常 SYN 包只有 40~50 字节）。

114 的防火墙严格遵循标准 TCP 协议：标准的 TCP 三次握手在 SYN 阶段是不应该携带应用层数据的（除非专门协商了 Fast Open）。114 > 看到这种“带 Payload 的 SYN 恶搞包”，直接当作非法/畸形攻击包丢弃（Drop），所以 100% 丢包。

2. 为什么 180.184.2.2（火山引擎/字节 DNS）却通了？
   180 的防火墙策略比较宽松（或者开启了类似的 Fast Open / 容错机制）。

即使你发的是带数据的畸形 SYN 包，它依然照常回了 SA（SYN-ACK），把你当作普通握手处理了，并丢弃了里面的 Payload。

协议特性的根本区别：TCP vs UDP
这就是 UDP 和 TCP 最大的不同，也是 Nping 参数使用的核心误区：

UDP 是无连接协议： 没有三次握手，第一个包就是数据包，必须带上 DNS Payload，114 才能识别并回复（所以之前的 UDP 测试需要 --data）。

TCP 是面向连接协议： 必须先完成 SYN -> SYN-ACK -> ACK 三次握手建立连接，然后才能发数据。

正确的 TCP 测试姿势
如果你要测 TCP 53 端口的链路质量：

1. 纯粹测 TCP 端口连通性 & 延迟（去掉 --data）
   只需要发送纯粹的 SYN 握手包，让对方内核回复 SYN-ACK 即可（这也就是你最开始测得最成功的那次）：

Bash
sudo nping --tcp -p 53 --source-port 12345 -c 4 114.114.114.114
2. 测完整的 TCP DNS 业务响应（使用 dig / dog）
如果想走完真正的 TCP 握手 + 发送 DNS 数据的全过程，直接用标准的 DNS 工具加 +tcp 标记是最规范的：

Bash
dig +tcp @114.114.114.114 baidu.com
总结： 你的 TCP 网络路径完全正常，只是 114 的防火墙太规范了，拒绝接受在 TCP 握手第一步（SYN）就“带货”的畸形数据包。去掉 --data 参数，TCP 测试就会立刻恢复正常的 ~20ms 延迟。

我又按照要求给了参数

root@dn2800:~# sudo nping --tcp -p 53 --source-port 12345 -c 4 114.114.114.114

Starting Nping 0.7.93 ( https://nmap.org/nping ) at 2026-07-23 09:03 CST

SENT (0.0553s) TCP 172.24.172.100:12345 > 114.114.114.114:53 S ttl=64 id=38169 iplen=40 seq=1377120382 win=1480

RCVD (0.0837s) TCP 114.114.114.114:53 > 172.24.172.100:12345 SA ttl=153 id=0 iplen=40 seq=2809567920 win=1480

SENT (1.0559s) TCP 172.24.172.100:12345 > 114.114.114.114:53 S ttl=64 id=38169 iplen=40 seq=1377120382 win=1480

RCVD (1.0837s) TCP 114.114.114.114:53 > 172.24.172.100:12345 SA ttl=153 id=0 iplen=40 seq=645372592 win=1480

SENT (2.0578s) TCP 172.24.172.100:12345 > 114.114.114.114:53 S ttl=64 id=38169 iplen=40 seq=1377120382 win=1480

RCVD (2.0858s) TCP 114.114.114.114:53 > 172.24.172.100:12345 SA ttl=153 id=0 iplen=40 seq=641194672 win=1480

SENT (3.0600s) TCP 172.24.172.100:12345 > 114.114.114.114:53 S ttl=64 id=38169 iplen=40 seq=1377120382 win=1480

RCVD (3.0882s) TCP 114.114.114.114:53 > 172.24.172.100:12345 SA ttl=153 id=0 iplen=40 seq=2805340848 win=1480

Max rtt: 28.187ms | Min rtt: 27.628ms | Avg rtt: 27.956ms

Raw packets sent: 4 (160B) | Rcvd: 4 (200B) | Lost: 0 (0.00%)

Nping done: 1 IP address pinged in 3.12 seconds

AI的回复

这下彻底闭环了！去掉 --data 之后，TCP 53 端口测试立刻回归完美表现：

丢失率： 0.00%（4 发 4 收）

平均延迟： 27.956 ms（极为稳定，最大最小相差不到 0.6ms）

回包特征： RCVD ... SA ttl=153 —— 直接由外网 114 节点回传的标准 TCP 握手响应包。

终极总结与实测复盘
经过这几轮排查，你现在对网络测试和 DNS 协议有了非常精准的掌握。整个过程可以总结为一套测 114 及公共 DNS 的标准规范：

2. TCP 53 测试规范
   要加： --source-port 12345（避开源端口冲突）

绝对不能加： --data（TCP 是面向连接的，在 SYN 阶段加数据属于协议违规，会被 114 防火墙直接丢弃）

实测结果： 纯 TCP 握手延迟固定在 28ms 左右。

总结，smartdns在判断tcp dns是否连通的条件，没有完全遵循tcp三次握手协议，而114完全遵循，认为是垃圾数据而丢弃了。而其他dns做了容错

[PikuZheng]

这测试很有价值，但它只能说明114 dns没有遵循RFC7413

不过smartdns的处理也有问题。。。它没检查连接是否成功或进行重新连接