Spark DNS Issues - Amazing - Broadband Service Alert

Forums › Spark New Zealand (including Skinny and BigPipe) › Spark DNS Issues - Amazing - Broadband Service Alert

1 | 2 | 3 | 4 | 5 | 6 | 7 | ... | 21

18 posts

Geek
Inactive user

#1122935 6-Sep-2014 09:16

I too have been experiencing the same issues as above. I just started using Google's public DNS servers and it appears to have fixed the problem for me.

primary: 8.8.8.8
secondary: 8.8.4.4

https://developers.google.com/speed/public-dns/docs/using

I'll just keep using it until I hear that the issues have been rectified.

EDIT: I'm using the Huawei E5776s

einsteinsboi

49 posts

Geek

#1122941 6-Sep-2014 09:36

I'm using telnet now and following the instructions here http://community.plus.net/library/dns/how-to-change-the-default-dns-servers-in-a-thomson-speedtouch-router/

Issue is that when I try to delete the existing DNS servers it won't let me but I can add a DNS server, however it shows up as S rather than D? And it doesn't show up on the web interface. Will have a look at your blog now Rhys. Thanks

gujal

13 posts

Geek

#1122945 6-Sep-2014 09:45

Looks like an issue with the Consumer DNS Servers of Spark/Xtra. They have always been flaky, they don't even resolve www.geekzone.co.nz frequently since the troubles began yesterday
ns1.xtra.co.nz 122.56.237.1
ns2.xtra.co.nz 210.55.111.1

They have a set of older consumer DNS servers. These seem to be working fine but Spark advise against using these as they are scheduled for decommissioning.

alien.xtra.co.nz 202.27.184.3
terminator.xtra.co.nz 202.27.184.5

They also have a set of Business customer DNS Servers. These are quite nice to use rather than Google's DNS Servers which are in US and have to go over Southern Cross cable for something simple as DNS lookup
ns1.netgate.net.nz 202.37.245.17
ns2.netgate.net.nz 202.37.245.20

If you are using any router other than Thomson/Technicolor, just change the DNS to the Business DNS Servers

If you are on Thomson/Technicolor, follow these instructions

First connect to the router over telnet
telnet <ip addr>
Username is "Administrator" (case sensitive without quotes)
Password is blank (just press enter key at the password prompt)
The enter the following commands

ADSL Routers 

dns server forward dnsset flush
dns server forward dnsset add set=0 dns=202.37.245.17 metric=0 intf=Internet
dns server forward dnsset add set=0 dns=202.37.245.20 metric=0 intf=Internet
dns server forward dnsset list
saveall

The last command is only if you want the change permanent, if you dont use it, the next time you reboot the router, it will use the default dns servers dished out by Spark

VDSL Routers

dns server forward dnsset flush
dns server forward dnsset add set=0 dns=202.37.245.17 metric=0 intf=PPPoE
dns server forward dnsset add set=0 dns=202.37.245.20 metric=0 intf=PPPoE
dns server forward dnsset list
saveall

Ping

59 posts

Master Geek

#1122947 6-Sep-2014 09:52

Thank you gujal,

I've just moved my parents over to the new spark business DNS servers until it gets resolved - Works like a charm.

einsteinsboi

49 posts

Geek

#1122954 6-Sep-2014 10:11

First let me just say I'm learning heaps from this thread and from having to google the different things, so yay :)

Second, using the dnsset commands doesn't work for me, I get the error "Unknown Command"

What I did manage to do was use

dns server route add dns=8.8.8.8 Intf=Internet metric=10

This added the dns 8.8.8.8

But I am not able to delete the existing primary or secondary DNS, I get the error "Failed to delete"

So when I telnet dns server route list I get the following:

DNS Server Entries:
DNS Server Source Label Metric Intf State Domain
D 122.56.237.1 10 Internet UP *
D 210.55.111.1 10 Internet UP *
S 8.8.8.8 10 Internet UP *

The internet seems to be working fine at the moment so I don't know if it's a momentary up time or if the small change I made worked.

Any thoughts?

Again I'm using a Thomson TG585v7 :)

Thank you all for sharing.

insane

3240 posts

Uber Geek

ID Verified

Trusted

#1122956 6-Sep-2014 10:15

I've heard what is believed to the cause of the issue, sounds like a tricky one to fix...

Can anyone remember what the black-box DNS platform they use is called? Namebench used to detect it but doesn't anymore.

old3eyes

9120 posts

Uber Geek

Subscriber

#1122957 6-Sep-2014 10:17

Looks like they're still having issues . Even local websites are having problems..

Getting emails from Outlook.com are also an issue.

Oh well it's Saturday. Time to go and do something else..

Regards,

Old3eyes

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

GregV

928 posts

Ultimate Geek

#1122964 6-Sep-2014 10:29

Their latest update blames malware on client PCs.
"What has happened?

We are experiencing a high volume of traffic affecting our customers’ ability to browse on broadband and mobile data.

Why has this happened?

The root cause is likely to be a handful of customers on our network whose computers are affected by malware, generating high levels of traffic destined for overseas sites. It’s highly likely that these customers are not even aware that this is happening."

gujal

13 posts

Geek

#1122966 6-Sep-2014 10:39

einsteinsboi: First let me just say I'm learning heaps from this thread and from having to google the different things, so yay :)

Second, using the dnsset commands doesn't work for me, I get the error "Unknown Command"

Again I'm using a Thomson TG585v7 :)

Thank you all for sharing.

Whoa, that is an ancient router!
Anyway the commands for that one are


dns server route flush
dns server route add dns=202.37.245.17 metric=0 intf=Internet
dns server route add dns=202.37.245.20 metric=0 intf=Internet
dns server route list
saveall

einsteinsboi

49 posts

Geek

#1122968 6-Sep-2014 10:41

And their instructions on how to fix it suggest using the same DNS servers that aren't working anyway:

http://helpbusiness.spark.co.nz/app/answers/detail/a_id/3701/related/1

Talkiet

4793 posts

Uber Geek

Trusted

#1122970 6-Sep-2014 10:45

As many have worked out (and I just got off a technical audio about the issue), this is a DNS amplification attack and we have had people working all night trying to mitigate the issue as best we can.

In the interim, the suggestion here to change your DNS servers to 8.8.8.8 and 8.8.4.4 is appropriate.

This should restore browsing. Please remember to check back to see when the issue is resolved - the performance of some sites with the above alternate DNS servers will not be as good as with our DNS servers (When they are fully available again)

At the moment, the workaround on the Spark status page is wrong. I am having it changed.

Sorry about this everyone

Neil G

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

einsteinsboi

49 posts

Geek

#1122971 6-Sep-2014 10:45

gujal:
Whoa, that is an ancient router!
Anyway the commands for that one are
dns server route flush
dns server route add dns=202.37.245.17 metric=0 intf=Internet
dns server route add dns=202.37.245.20 metric=0 intf=Internet
dns server route list
saveall

Hehe thanks. Yeah I was able to add dns as mentioned in my post before, just not able to delete the existing primary and secondary ones.

EDIT: Using dns server route flush worked a treat :) Now using the servers above with no dramas, thank you :)

dwl

371 posts

Ultimate Geek

#1122974 6-Sep-2014 11:01

einsteinsboi: So when I telnet dns server route list I get the following:

DNS Server Entries:
DNS Server Source Label Metric Intf State Domain
D 122.56.237.1 10 Internet UP *
D 210.55.111.1 10 Internet UP *
S 8.8.8.8 10 Internet UP *

The internet seems to be working fine at the moment so I don't know if it's a momentary up time or if the small change I made worked.

Any thoughts?

EDIT: removed bit on same answer as posted above.

While 8.8.8.8 i great for checking, I would not recommend for on-going use. The other Spark addresses in the post above should be used as the CDNs (especially Akamai which now has a larger amount of your daily content) may only deliver from local caches with local ISP DNS (noting that OpenDNS seems better than Google at working out your ISP Akamai locations).

Noting the duration of the outage, I hope it is only a small group affected (I'm off a Porirua exchange). At least with LAN wide working settings rather than on the PC I don't have to explain why I have Internet and others can't !

code15

198 posts

Master Geek

#1122982 6-Sep-2014 11:21

This may be completely naive..

But if a "handful" of customers with malware are taking down sparks entire internet service, why don't they just kick these customers off the network until they are able to contact them and remove the malware?

pohutukawa

197 posts

Master Geek

#1122983 6-Sep-2014 11:21

kngjse: I too have been experiencing the same issues as above. I just started using Google's public DNS servers and it appears to have fixed the problem for me.

primary: 8.8.8.8
secondary: 8.8.4.4

https://developers.google.com/speed/public-dns/docs/using

I'll just keep using it until I hear that the issues have been rectified.

EDIT: I'm using the Huawei E5776s

Yep that's what we're doing. Spark DNS seems like it has been extinguished.

1 | 2 | 3 | 4 | 5 | 6 | 7 | ... | 21