Looking up... DNS Server problem

[Cheerio]

Its been doing this for months. I assumed it was the router on the way out. However, I got round to trying another router, and the problem remains.

About three times or so a day, my router loses its DNS server and I have to restart the router to pick up the DNS server again.

Symptom is: working normally, then out of the blue the next webpage you enter fails to load and hangs at 'looking up www......

Restarting the router gets things back to normal until the next time.
I have tried two different routers, and tried setting auto discovered DNS, manually entered DNS (Virgin.net) and also using openDNS servers. None of these things stops the problem

When it happens, it happens simultaneously to any PC connected to the router.

I still have wifi connection and ADSL connection when DNS is lost

Any ideas? I just have a sinking feeling at the prospect of calling a help line.

[Spurlash2]

Have you been fiddlin' with the HOSTS file?

If your HOSTS file contains an incorrect or outdated listing, you won't be able to connect. Even if you don't recall adding listings to a HOSTS file, it still might contain listings, because some Internet accelerator utilities edit them without telling you. Open your HOSTS file with Notepad and see if the site you can't connect to is listed there. If it is, delete the entry, and you should be able to connect.

Made any changes to your DNS settings?

Recheck your ISP's DNS settings.

The problem might be related to your DNS cache, so flush it out.

To flush the cache, type ipconfig /flushdns at a command prompt.

Mike-B, Green G, et al, should be along shortly to give a more focussed view - I never get it right:O but learning all the time!

[Mike-Bracknell]

Interesting problem.

So, I would first set your DNS servers delivered by DHCP (in the router) to:

8.8.8.8
8.8.4.4

and see whether you get the same issues with the clients.

Also, ensure the clients are set to use DHCP for the IP address *&* the DNS servers, and as Spurlash says you should ensure the files:

c: \windows\system32\drivers\etc\hosts
c: \windows\system32\drivers\etc\lmhosts

either don't exist, or if they do exist (and you use them) you've cleared them of any spurious entries.

Also, if that doesn't solve things so far, then check whether you have any proxy servers set in your browser settings.

Finally, download Malwarebytes Anti-Malware, update it and do a scan to see if it can find anything infected.

Come back to us with the results, and we'll work on it further if that's not sorted things for you so far.

Cheers,
Mike.

[Cheerio]

Thanks both, will do. Off to Siberia for a few days so if I can't get anything new tomorrow, will report back end of the week.

BTW network is normally:
One XP machine
One Opensuse laptop
One Mac OSX laptop
One HP printer
The computers all drop the DNS simultaneously when it happens.
NAT firewall on, WiFi is WPA and out of range of public areas

[Saab Dastard]

When it happens, it happens simultaneously to any PC connected to the router.

I still have wifi connection and ADSL connection when DNS is lost

Having wifi connection and ADSL connection doesn't mean that you still have an internet connection! Your wireless network my be working fine, and the ADSL lights may be working, but if your router has lost IP connectivity to its upstream device, you don't have an internet connection.

When it happens again, ping 4.2.2.1 - if it works then your internet connection is OK. If not, it's a connection problem, and nothing to do with DNS settings.

A few other things:

Do your PCs have their DNS servers set manually or via DHCP?

Your PCs may have their DNS servers set directly to the ISP DNS servers, a third party DNS (e.g. OpenDNS) or to the router address (it then acts as a DNS forwarder).

Bear in mind that what you set on your PCs - manually or via DHCP - is independent of the DNS server information that your router receives (assuming DHCP) from your ISP.

So if you are setting DNS explicitly on your PCs to any DNS server upstream of your router and you still have internet connectivity, then DNS will still work, even if your router loses its own DNS settings.

My suggestion, to eliminate some variables, would be to switch DHCP for your local LAN off on the router. Set your PCs IP configuration manually, including DNS servers. The DNS servers you set on your PCs should be the ISP's DNS or an external internet DNS server.

Now it doesn't matter what the router does, your PCs are going to connect to a DNS server as long as you have a functioning internet connection.


SD

[Mike-Bracknell]

My suggestion, to eliminate some variables, would be to switch DHCP for your local LAN off on the router. Set your PCs IP configuration manually, including DNS servers. The DNS servers you set on your PCs should be the ISP's DNS or an external internet DNS server.

You wouldn't need to turn off DHCP in that instance, as the action of configuring an IP address on the PC stops it from broadcasting for an address via DHCP (and it's one less step to misconfigure on the router).

[Spurlash2]

As the PFY on this, I'm going for M-B's Proxy server as the possible cause.:ok:

[Mike-Bracknell]

Having wifi connection and ADSL connection doesn't mean that you still have an internet connection! Your wireless network my be working fine, and the ADSL lights may be working, but if your router has lost IP connectivity to its upstream device, you don't have an internet connection.
There is that too. :ok:

[Mike-Bracknell]

As the PFY on this, I'm going for M-B's Proxy server as the possible cause.:ok:

I miss my BOFH t-shirt.

[mixture]

Mike at work.....

http://www.ibiblio.org/Dave/Dr-Fun/df200008/df20000808.jpg

[Saab Dastard]

Proxy server as the possible cause

So multiple PCs all change their proxy configuration at the exact same instant?

I am a firm believer in Occam's razor!

It's got to be the router or upstream of the router to affect all PCs at the same time.

SD

[riverrock83]

Yeah - sounds to me like either the router is losing connection to the internet although it could still be at everything else is losing connection to the router.

When giving out IP addresses, the DHCP server in the router normally gives each client an ip address with a lease of at least 24 hours, saving each client (PC etc) from asking for another one constantly. Normally all the clients will use the router as the DNS server too.

When this happens - can all of the PCs / laptops still talk to each other? Does each operating system report a connection problem or can they just not access the internet? Can they still print?

If they can still print, then the problem is between the router and the outside world.

I've had issues with adsl filters appearing to wear out over time causing periodic connection drops, with the router unable to re-connect until restarted (someone told me that they replaced their's regularly because they got dirty - but thats another story :ugh: ). Also with a tree rubbing against a phone line - although in this case the router just seemed to be constantly re-connecting (you could also hear the interference on the line...).

HTH

[Cheerio]

I must admit, I think it is upstream of the router. The local network is unaffected by this everything continues OK on my side of the router. Also, I never seem to wake up in the morning to find the problem. (router on 24 hrs) It seems always to be triggered during random browsing. (Oh and now I think about it, it seems to be the Linux machine that is doing the browsing at the time DNS is lost - but this is probably coincidental as this is the one that gets by far the heaviest use. ) But I don't think this machine is the cause, it has had a clean install recently. And just to stress - it occurs simultaneously to all machines. Any existing connection on any machine at the time (eg youtube stream or a download in progress) is not broken and continues unaffected, it is only new lookups that fail. Therefore, I think that the connection is good.
It doesn't seem to drop DNS unless a DNS server request is made. If the router is OK when you stop, even if it is days later, it will be OK when you return. It seems to be making DNS requests that trigger the problem. It also seems to happen mostly between tea-time and bed-time GMT. All the networked machines are set to DNS from DHCP.

I'm waiting for it to happen today so I can try a ping first.
I'm right out in the country, so line quality could well be suspect. But I'm puzzled that it only loses DNS and the connection itself doesn't drop?

BTW the router is a D-Link G604-T (and the spare is the same) I might try to lay my hands on a newer model and give that a shot.

Cheers

[green granite]

When it does try typing 98.158.194.181 into the address bar and see if it connects you to PPRuNe.

[Mike-Bracknell]

It seems always to be triggered during random browsing. (Oh and now I think about it, it seems to be the Linux machine that is doing the browsing at the time DNS is lost

<snip>

BTW the router is a D-Link G604-T (and the spare is the same) I might try to lay my hands on a newer model and give that a shot.

Cheers

This brings up a new possibility. You might be using a DNS proxy in the router that's killed by the specific DNS request packets from the Linux box. To rule this out, ensure you hardcode a DNS setting on an affected client machine once it breaks. I'd assume a firmware update would fix this if it's proven to be the cause (although investing in a better make of router would be a FAR better idea)

A quick Google gives a LOT of problems with that specific router and DNS relay under Linux.

e.g. D-Link DSL-G604T and DNS - D-Link - DSL Hardware (http://forums.whirlpool.net.au/archive/482782)

It appears disabling IPv6 on the Linux box is a possible workaround.

(however, the real fix is to junk anything and everything from D-Link and go with a better router - e.g. a Draytek Vigor 2820n)

[Cheerio]

Thanks for that, it sounds very possible. I'll still go through the troubleshooting steps, but a new router is a good idea. Its old now anyway, and I'll take your advice.

[Cheerio]

Well it happened. I was able to ping 4.2.2.1 OK, I was able to reach PPRuNe by using the IP address, so the next thing to try is to enter manual DNS direct on one of the PC's , so next time I'll see if that one is unaffected.
I have IPv6 disabled on the Llinux machine already BTW.
There is definitely a new router in my near future!