[WXC/VFX] Intermittant DNS Failures?

Forums › One NZ (including Farmside) › [WXC/VFX] Intermittant DNS Failures?

1 | 2 | 3

4066 posts

Uber Geek
+1 received by user: 206

Trusted

Snowflake

#234974 13-Jul-2009 22:48

BlakJak:
Your comments will probably provide the catalyst to get around to the firmware upgrade i've been planning to put onto my DG834 for quite some time... maybe this weekend...

For the record the Router hands out 'itself' as the DNS server, and must do the proxy/resolver thing. Again, have had plenty of success with this model until relatively recently.

has this problem been occurring after a recent firmware upgrade?

has the network usage changed lately -
* downloading torrents (lots of sessions)?
* using pass-through VPN (VPN application layer gateway)?
* using pass through SIP (SIP ALG)?
* new machine/device using UPNP?

I tend to disable the ALG's that I don't use (SIP, multi-VPN) and pretty much always disable UPNP on my routers. If i have DNS problems then i'll disable proxy DNS too.

cheers
regs

Sales Engineer
Snowflake
www.snowflake.com

about.me/nzregs
Twitter: @nzregs

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#234978 13-Jul-2009 23:01

Hi regs. No, have not actually applied the update yet; i'm still running the OEM version.
There's some use of torrents but not a heck of a lot (i'm not a leech by any means) and though there's probably 7 or 8 unique hosts on my network, only 2 or 3 of them are ever (significantly) active at once... i'm comfortable that i'm not exceeding any sorta session limit, usage patterns here havn't changed significantly in the last few years.

To cover the other points; I do use a VPN but not all the time, perhaps 3 times a week; I use SIP but rarely (one or two times a month); I didn't really think about UPNP but I just had a look - it's enabled and it's picked up 2 devices on my network... one's my WinXP Tablet (which i'm using right now) - unsure of the other straight away.

With that in mind, i'll give it a coupla days to settle post tonights changes, then I think i'll turn UPNP off and see what happens...

Cheers for the headsup!

No signature to see here, move along...

bradi

137 posts

Master Geek
Inactive user

#236721 18-Jul-2009 18:31

BlakJak: Anyone else noticing that Xnet seems to occaisionally just 'fail' DNS lookups?

I've also been experiencing "strange" DNS results, is this now resolved by the new DNS server.

Currently using Orcon's DNS with no problems. Thanks Orcon :)

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#236730 18-Jul-2009 19:06

Heh. Sigh.

My gut feeling is that several days after having statically assigned my DNS servers, the performance I'm seeing is similar to prior. Havnt had it actually error on me yet, which could speak to any number of potential issues fixed server-side.

Still monitoring. For clarity, hasnt faulted on any of my systems (static DNS or not) at this point. Still don't believe setting Static DNS has in itself made any change to my user experience (I still tend to discount the theory that my DSL router has anything to do with it).

Still monitoring, though i'm away on holiday in a few days for ~3 weeks and won't be testing much. :-)

No signature to see here, move along...

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#236744 18-Jul-2009 19:57

Oh irony, it just did it! - at the time was using my lappy (all settings via DHCP).. about a minute ago. Was immediately able to hit 'try again' and the lookup worked fine.

No signature to see here, move along...

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#236948 19-Jul-2009 19:53

did it again about 5-10 minutes ago.

This one has DHCP assigned DNS as well, though (my Eee.)

No signature to see here, move along...

AliExpress

Shop now on AliExpress (affiliate link).

rhy7s

673 posts

Ultimate Geek
+1 received by user: 147

#236958 19-Jul-2009 20:40

When it happens again, could you confirm that a bookmarked IP address still gets through fine? Maybe have a ping or traceroute ready to run to try and see where the lookup's getting hung up. I don't see a mention of whether you notice it in multiple browsers either, maybe try to quickly paste the failing address into another browser to double-check. In Firefox you could flush the local cache with DNS FLusher. It sounds like your glitch is a pretty ephemeral event, you might need to keep a batch file or script running to get a log of when it occurs.

richms

29098 posts

Uber Geek
+1 received by user: 10209

Trusted

Lifetime subscriber

#237010 19-Jul-2009 23:11

Same thing happening at mums today, still cant play a youtube and it was one she wanted to watch.

Browsing is crap on xnet too - faster to RDP home and browse on that virtually.

She is almost had enough when getting broken images in google reader and similar which is a pain since you cant just reload and get the same article since its just been marked as read.

We are getting an orcon unbundled connection in on another pair shortly to try - not happy with their toll prices but if it means that the little net she uses is bareable then its worth it IMO.

Richard rich.ms

Niel

3267 posts

Uber Geek
+1 received by user: 80

Trusted

#237057 20-Jul-2009 06:42

Yesterday I also had lots of issues with international sites, but got time-outs rather than DNS failures. Normally no problems. Saturday morning 2:30 I was even able to watch a You Tube video with almost no buffering. Yesterday was the last day of school holidays, expect things to be better today.

You can never have enough Volvos!

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#237117 20-Jul-2009 10:40

rhy7s: When it happens again, could you confirm that a bookmarked IP address still gets through fine? Maybe have a ping or traceroute ready to run to try and see where the lookup's getting hung up. I don't see a mention of whether you notice it in multiple browsers either, maybe try to quickly paste the failing address into another browser to double-check. In Firefox you could flush the local cache with DNS FLusher. It sounds like your glitch is a pretty ephemeral event, you might need to keep a batch file or script running to get a log of when it occurs.

Traceroute to where?

There was no cached entry for the site in this case as id not visited GZ before trying the URL.
Immediately it failed, I opened a shell and ran a dig +trace which gave me a valid answer.
The fault is generally so brief, its hard to catch with anything useful like a troubleshooting tool.

Don't get me started regarding Youtube...

No signature to see here, move along...

Regs

4066 posts

Uber Geek
+1 received by user: 206

Trusted

Snowflake

#237197 20-Jul-2009 16:34

rhy7s: In Firefox you could flush the local cache with DNS FLusher.

on most windows machines there is a command line command that can do this too:

"ipconfig /flushdns"

Sales Engineer
Snowflake
www.snowflake.com

about.me/nzregs
Twitter: @nzregs

New World

Shop on-line at New World now for your groceries (affiliate link).

bradi

137 posts

Master Geek
Inactive user

#244901 10-Aug-2009 18:35

Well this just got weirder...

I was looking up some "best practice" configs and found a link to the nsa.gov website, clicked the link and "Problem loading page".

Turns out that I can't resolve the DNS???!

Been using the root DNS servers since Xnet's started giving me problems.

===

Default Server: pdc-1.home.megacityone.net.nz
Address: 192.168.1.3

> www.nsa.gov.
Server: pdc-1.home.megacityone.net.nz
Address: 192.168.1.3

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to pdc-1.home.megacityone.net.nz timed-out
> www.google.com.
Server: pdc-1.home.megacityone.net.nz
Address: 192.168.1.3

Non-authoritative answer:
Name:    www.l.google.com
Addresses: 74.125.19.103
          74.125.19.106
          74.125.19.147
          74.125.19.99
          74.125.19.104
          74.125.19.105
Aliases: www.google.com

> server 58.28.5.2
Default Server: ip-58-28-5-2.wxnz.net
Address: 58.28.5.2

> www.nsa.gov.
Server: ip-58-28-5-2.wxnz.net
Address: 58.28.5.2

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to ip-58-28-5-2.wxnz.net timed-out

===

Can anyone confirm that Xnet's DNS can resolve www.nsa.gov. ?

Niel

3267 posts

Uber Geek
+1 received by user: 80

Trusted

#244931 10-Aug-2009 19:44

I can't resolve www.nsa.gov either.

You can never have enough Volvos!

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#244953 10-Aug-2009 20:56

Some slightly more detailed troubleshooting material; the first using my own DNS server and the second directed at ns1.xnet.co.nz.

blakjak@skyhawk:~$ dig nsa.gov SOA +trace

; > DiG 9.3.4-P1.2 > nsa.gov SOA +trace
;; global options: printcmd
. 175068 IN NS D.ROOT-SERVERS.NET.
. 175068 IN NS E.ROOT-SERVERS.NET.
. 175068 IN NS F.ROOT-SERVERS.NET.
. 175068 IN NS G.ROOT-SERVERS.NET.
. 175068 IN NS H.ROOT-SERVERS.NET.
. 175068 IN NS I.ROOT-SERVERS.NET.
. 175068 IN NS J.ROOT-SERVERS.NET.
. 175068 IN NS K.ROOT-SERVERS.NET.
. 175068 IN NS L.ROOT-SERVERS.NET.
. 175068 IN NS M.ROOT-SERVERS.NET.
. 175068 IN NS A.ROOT-SERVERS.NET.
. 175068 IN NS B.ROOT-SERVERS.NET.
. 175068 IN NS C.ROOT-SERVERS.NET.
;; Received 272 bytes from 127.0.0.1#53(127.0.0.1) in 4 ms

gov. 172800 IN NS A.GOV.ZONEEDIT.COM.
gov. 172800 IN NS C.GOV.ZONEEDIT.COM.
gov. 172800 IN NS D.GOV.ZONEEDIT.COM.
gov. 172800 IN NS E.GOV.ZONEEDIT.COM.
gov. 172800 IN NS G.GOV.ZONEEDIT.COM.
gov. 172800 IN NS B.GOV.ZONEEDIT.COM.
gov. 172800 IN NS F.GOV.ZONEEDIT.COM.
;; Received 265 bytes from 128.8.10.90#53(D.ROOT-SERVERS.NET) in 208 ms

nsa.gov. 86400 IN NS DSUX-GH1-UEA03.nsa.gov.
nsa.gov. 86400 IN NS ROMULUS.NCSC.MIL.
nsa.gov. 86400 IN NS DSUX-GH1-UEA01.nsa.gov.
;; Received 145 bytes from 216.55.155.29#53(A.GOV.ZONEEDIT.COM) in 150 ms

nsa.gov. 86400 IN SOA dsux-gh1-uea01.nsa.gov. hostmaster.nsa.gov. 2009060801 28800 7200 604800 21600
nsa.gov. 86400 IN NS romulus.ncsc.mil.
nsa.gov. 86400 IN NS dsux-gh1-uea01.nsa.gov.
nsa.gov. 86400 IN NS dsux-gh1-uea03.nsa.gov.
;; Received 192 bytes from 63.239.67.7#53(DSUX-GH1-UEA03.nsa.gov) in 237 ms

blakjak@phoenix:~$ dig nsa.gov SOA @ns1.xnet.co.nz +trace

; > DiG 9.3.4-P1.2 > nsa.gov SOA @ns1.xnet.co.nz +trace
; (2 servers found)
;; global options: printcmd
. 68261 IN NS F.ROOT-SERVERS.NET.
. 68261 IN NS G.ROOT-SERVERS.NET.
. 68261 IN NS H.ROOT-SERVERS.NET.
. 68261 IN NS I.ROOT-SERVERS.NET.
. 68261 IN NS J.ROOT-SERVERS.NET.
. 68261 IN NS K.ROOT-SERVERS.NET.
. 68261 IN NS L.ROOT-SERVERS.NET.
. 68261 IN NS M.ROOT-SERVERS.NET.
. 68261 IN NS A.ROOT-SERVERS.NET.
. 68261 IN NS B.ROOT-SERVERS.NET.
. 68261 IN NS C.ROOT-SERVERS.NET.
. 68261 IN NS D.ROOT-SERVERS.NET.
. 68261 IN NS E.ROOT-SERVERS.NET.
;; Received 504 bytes from 58.28.4.2#53(58.28.4.2) in 76 ms

gov. 172800 IN NS B.GOV.ZONEEDIT.COM.
gov. 172800 IN NS G.GOV.ZONEEDIT.COM.
gov. 172800 IN NS D.GOV.ZONEEDIT.COM.
gov. 172800 IN NS C.GOV.ZONEEDIT.COM.
gov. 172800 IN NS E.GOV.ZONEEDIT.COM.
gov. 172800 IN NS A.GOV.ZONEEDIT.COM.
gov. 172800 IN NS F.GOV.ZONEEDIT.COM.
;; Received 265 bytes from 192.5.5.241#53(F.ROOT-SERVERS.NET) in 57 ms

nsa.gov. 86400 IN NS ROMULUS.NCSC.MIL.
nsa.gov. 86400 IN NS DSUX-GH1-UEA01.nsa.gov.
nsa.gov. 86400 IN NS DSUX-GH1-UEA03.nsa.gov.
;; Received 145 bytes from 206.51.224.229#53(B.GOV.ZONEEDIT.COM) in 525 ms

dig: couldn't get address for 'DSUX-GH1-UEA01.nsa.gov': failure

I can resolve the address for DSUX-GH1-UEA01.nsa.gov via my colo fine, as you can see; it fails via Xnet.
The NS I can find for nsa.gov from DNS (whois is no good) are:

blakjak@skyhawk:~$ host DSUX-GH1-UEA01.nsa.gov
DSUX-GH1-UEA01.nsa.gov has address 63.239.67.5
blakjak@skyhawk:~$ host DSUX-GH1-UEA02.nsa.gov
DSUX-GH1-UEA02.nsa.gov has address 63.239.67.6
blakjak@skyhawk:~$ host DSUX-GH1-UEA03.nsa.gov
DSUX-GH1-UEA03.nsa.gov has address 63.239.67.7
blakjak@skyhawk:~$

None respond to ping from my colo, but they do respond to direct DNS queries from there. I guess theyre firewalling ping.

Based on the fact I can't talk to them from Xnet i'd guess that the NSA have some sort of filter in place blocking Xnet. Means it's not Xnets fault.
(Traceroute looks very similar from both locations I test; asianetcom through qwest and then no further responses).

Xnet need to contact the NSA to push this one. In the meantime you need to look at third party DNS to get around the fault. I'd be suprised if this one's Xnets problem (directly; possible there's a deliberate response to some sort of DoS or other...).

HTH
BJ.

No signature to see here, move along...

nakedmolerat

4631 posts

Uber Geek
+1 received by user: 874

Trusted

Lifetime subscriber

#244964 10-Aug-2009 21:14

rhy7s: OpenDNS.com

dawnraid: Hey BlakJak, take a chill pill. I see your reasons as to why you are so opposed to a third party DNS provider as being far from logical. Heck its only resolving ip's nothing to get worried about for security, also a few extra milliseconds latency is not even worth get your knickers in a knot. We all know Xnet sometimes has crappy services, live with it or do something about it.

1 | 2 | 3