# DNS (?) problem ... unknown host

## utabintarbo

I am having a similar problem to the user in  this  thread. But this is happening regardless of static or dynamic IP, or for that matter OS!

I have one gentoo box w/static IP and one Win2000 box w/dynamic IP behind a Netgear router (RT314). Both can ping outside IP's but cannot resolve using DNS. I am using one DNS server supplied by my ISP (64.233.217.2) and one outside DNS server (199.166.24.12). I get a similar result as shown in the aforementioned thread (ping: unknown host www.yahoo.com). 

To even complicate things more... I am sending this from a different gentoo box connected to the same switch as both PC's previously mentioned, and VMWare guests on the Win2000 box resolved with no problems. 

Help!   :Crying or Very sad: 

Bob

----------

## marvin

Please post your /etc/resolv.conf and ifconfig output of all boxes you have and the dns settings of win2000. As ping with ips is working and the vmware guests are working this seems to be related only to dns, unlike the problem in the other thread which was a missing ip adress for eth0. Do you have compared the settings of your gentoo boxes (/etc/conf.d/net and /etc/resolv.conf)? 

Does your router have a firewall? Perhaps it filters the dns packets from/to some of your machines.

----------

## utabintarbo

Thanks for the reply!  :Smile: 

Here is some of the info you asked about:

Output of "ifconfig -a" on affected Gentoo box:

```

eth0      Link encap:Ethernet  HWaddr 00:A0:C9:FB:51:0C  

          inet addr:192.168.0.104  Bcast:192.168.0.255  Mask:255.255.255.0

          inet6 addr: fe80::2a0:c9ff:fefb:510c/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:6655 errors:0 dropped:0 overruns:0 frame:0

          TX packets:438 errors:0 dropped:0 overruns:0 carrier:0

          collisions:9 txqueuelen:100 

          RX bytes:407565 (398.0 Kb)  TX bytes:28368 (27.7 Kb)

          Interrupt:5 Base address:0xfce0 Memory:fedfb000-fedfb038 

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          inet6 addr: ::1/128 Scope:Host

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:18 errors:0 dropped:0 overruns:0 frame:0

          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:1260 (1.2 Kb)  TX bytes:1260 (1.2 Kb)

sit0      Link encap:IPv6-in-IPv4  

          NOARP  MTU:1480  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

```

/etc/resolv.conf:

```

nameserver 199.166.24.12

nameserver 199.166.27.4

nameserver 64.233.217.2

nameserver 64.233.218.139

# search try.wideopenwest.com

```

/etc/conf.d/net:

```

# /etc/conf.d/net:

# $Header: /home/cvsroot/gentoo-src/rc-scripts/etc/conf.d/net,v 1.7 2002/11/18 19:39:22 azarah Exp $

# Global config file for net.* rc-scripts

# This is basically the ifconfig argument without the ifconfig $iface

#

iface_eth0="192.168.0.104 broadcast 192.168.0.255 netmask 255.255.255.0"

#iface_eth1="207.170.82.202 broadcast 207.0.255.255 netmask 255.255.0.0"

# For DHCP set iface_eth? to "dhcp"

# For passing options to dhcpcd use dhcpcd_eth?

#

#iface_eth0="dhcp"

#dhcpcd_eth0="..."

# For adding aliases to a interface

#

#alias_eth0="192.168.0.3 192.168.0.4"

# NB:  The next is only used for aliases.

#

# To add a custom netmask/broadcast address to created aliases,

# uncomment and change accordingly.  Leave commented to assign

# defaults for that interface.

#

#broadcast_eth0="192.168.0.255 192.168.0.255"

#netmask_eth0="255.255.255.0 255.255.255.0"

# For setting the default gateway

#

gateway="eth0/192.168.0.1"

```

/etc/resolv.conf from this box (dns works):

```

nameserver 199.166.24.12

nameserver 199.166.27.4

nameserver 64.233.217.2

nameserver 64.233.218.139

search try.wideopenwest.com

```

ipconfig /all from Win2000 box (no resolution )  :Sad:  :

```

Windows 2000 IP Configuration

   Host Name . . . . . . . . . . . . : ntwks2

   Primary DNS Suffix  . . . . . . . : 

   Node Type . . . . . . . . . . . . : Hybrid

   IP Routing Enabled. . . . . . . . : No

   WINS Proxy Enabled. . . . . . . . : No

   DNS Suffix Search List. . . . . . : try.wideopenwest.com

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : try.wideopenwest.com

   Description . . . . . . . . . . . : Realtek RTL8139(A) PCI Fast Ethernet Adapter

   Physical Address. . . . . . . . . : 00-50-BF-3A-2F-63

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

   IP Address. . . . . . . . . . . . : 192.168.0.4

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . : 192.168.0.1

   DHCP Server . . . . . . . . . . . : 192.168.0.1

   DNS Servers . . . . . . . . . . . : 199.166.24.12

                                       64.233.218.139

   Lease Obtained. . . . . . . . . . : Friday, February 20, 2004 4:32:21 PM

   Lease Expires . . . . . . . . . . : Monday, February 23, 2004 4:32:21 PM

Ethernet adapter VMware Virtual Ethernet Adapter (basic host-only support for VMnet1):

   Connection-specific DNS Suffix  . : 

   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter (basic host-only support for VMnet1)

   Physical Address. . . . . . . . . : 00-50-56-C0-00-01

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

   IP Address. . . . . . . . . . . . : 192.168.17.1

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . : 

   DHCP Server . . . . . . . . . . . : 192.168.17.254

   DNS Servers . . . . . . . . . . . : 

   Lease Obtained. . . . . . . . . . : Sunday, February 22, 2004 12:02:47 AM

   Lease Expires . . . . . . . . . . : Sunday, February 22, 2004 12:32:47 AM

Ethernet adapter VMware Virtual Ethernet Adapter (Network Address Translation (NAT) for VMnet8):

   Connection-specific DNS Suffix  . : 

   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter (Network Address Translation (NAT) for VMnet8)

   Physical Address. . . . . . . . . : 00-50-56-C0-00-08

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

   IP Address. . . . . . . . . . . . : 192.168.245.1

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . : 

   DHCP Server . . . . . . . . . . . : 192.168.245.254

   DNS Servers . . . . . . . . . . . : 

   Lease Obtained. . . . . . . . . . : Sunday, February 22, 2004 12:02:46 AM

   Lease Expires . . . . . . . . . . : Sunday, February 22, 2004 12:32:46 AM

```

As to the router, I don't have any firewall stuff turned on (what little there is...  :Rolling Eyes:  ), and this just started happening recently (last Wednesday). Weird.  :Evil or Very Mad: 

Thanks for your help!

Bob

----------

## marvin

Please try pinging again on all machines but not with www.yahoo.com, because yahoo.com is a bit unreliably as it seems. I'm also getting "ping: unknown host www.yahoo.com" sometimes and sometimes it works.

Your config looks ok so I don't know what the problem is. But you say it started happening last Wednesday, so what did you do to your affected gentoo box and the Win2000 box last Wednesday? Did you update anything glibc related, this might be the problem because ping uses glibc for resolving hostnames? (look in /var/log/emerge.log or enter "genlop -l" if you have it installed)

Or did you change any setting of the router? If your Win2000 box could do pings before this is more probable because you certainly didn't break two machines at the same time.

You can also compare the /etc/nsswitch.conf files of your different machines. This file tells the dns-resolver where to look (in hosts-file or dns).

Then you could also enter "strace ping www.cnn.com" on a machine where it works and on a machine where it doesn't work and then compare the outputs. Perhaps that gives an idea what is the problem.

----------

## utabintarbo

Tried pinging several addresses including thos you mentioned to no avail. Same result.   :Evil or Very Mad: 

The only odd thing last Wed. was my cable modem had a hiccup which required me to shutdown/restart. 5 of 7 PC's (3 diff. OS's) came up without a problem. Just these 2 are being temperamental!?!?!

Can't do the "strace" thing: not on either of the 2 affected boxen.  :Sad: 

/etc/nsswitch.conf  of all linux boxes are identical.

This is beginning to creep me out!  :Shocked:  Any other ideas?

Bob

----------

## marvin

 *Quote:*   

> The only odd thing last Wed. was my cable modem had a hiccup which required me to shutdown/restart. 5 of 7 PC's (3 diff. OS's) came up without a problem. Just these 2 are being temperamental!?!?! 

 

You can try resetting your cable modem and/or router, perhaps there is something wrong with it. (Unplug the cable modem and leave it without power for at least 30 sec. to clear the internal memory.)

 *Quote:*   

> Can't do the "strace" thing: not on either of the 2 affected boxen.

 

You might have to "emerge dev-util/strace", or why is strace is not working? (Download the source with another box and copy it to /usr/portage/distfiles if emerge complains that it can't download things.)

You can also try tcpdump (net-analyzer/tcpdump) while doing a ping, which shows you which packets are send and received.

For me the output looks like this (192.168.0.2 is my local ip, 194.25.2.129 is the nameserver):

```

xi ~ # tcpdump -l -n

tcpdump: listening on eth0

09:07:14.189111 192.168.0.2.32788 > 194.25.2.129.53:  47315+ A? www.heise.de. (30) (DF)

09:07:14.259778 194.25.2.129.53 > 192.168.0.2.32788:  47315 1/0/0 A 193.99.144.71 (46) (DF)

09:07:14.260197 192.168.0.2 > 193.99.144.71: icmp: echo request (DF)

09:07:14.328698 193.99.144.71 > 192.168.0.2: icmp: echo reply (DF)

09:07:14.329049 192.168.0.2.32788 > 194.25.2.129.53:  47316+ PTR? 71.144.99.193.in-addr.arpa. (44) (DF)

09:07:14.400429 194.25.2.129.53 > 192.168.0.2.32788:  47316 1/0/0 (70) (DF)

09:07:15.260784 192.168.0.2 > 193.99.144.71: icmp: echo request (DF)

09:07:15.330500 193.99.144.71 > 192.168.0.2: icmp: echo reply (DF)

09:07:15.330797 192.168.0.2.32788 > 194.25.2.129.53:  47317+ PTR? 71.144.99.193.in-addr.arpa. (44) (DF)

09:07:15.401974 194.25.2.129.53 > 192.168.0.2.32788:  47317 1/0/0 (70) (DF)

09:07:16.261627 192.168.0.2 > 193.99.144.71: icmp: echo request (DF)

09:07:16.330382 193.99.144.71 > 192.168.0.2: icmp: echo reply (DF)

09:07:16.331098 192.168.0.2.32788 > 194.25.2.129.53:  47318+ PTR? 71.144.99.193.in-addr.arpa. (44) (DF)

09:07:16.400721 194.25.2.129.53 > 192.168.0.2.32788:  47318 1/0/0 (70) (DF)

```

while doing this in another shell:

```

$ ping www.heise.de

```

You could do this on a working box and see which nameserver answers your request, and on a box which doesn't work and see if there is no request send or if there is no answer to the request.

If I ping a non-existent server I get:

```
xi ~ # tcpdump -l -n

tcpdump: listening on eth0

09:18:13.081041 192.168.0.2.32788 > 194.25.2.129.53:  27864+ A? wasda.2311qwq.de. (34) (DF)

09:18:13.185075 194.25.2.129.53 > 192.168.0.2.32788:  27864 NXDomain 0/1/0 (86) (DF)

09:18:13.185326 192.168.0.2.32788 > 194.25.2.129.53:  27865+ A? wasda.2311qwq.de. (34) (DF)

09:18:13.265583 194.25.2.129.53 > 192.168.0.2.32788:  27865 NXDomain 0/1/0 (86) (DF)

```

Another thing I see right now is that your affected gentoo box has ipv6, can you turn this off somehow?

----------

## utabintarbo

Here's a sampling from tcpdump:

```

16:25:50.402915 192.168.0.4.4968 > 64.233.218.139.53:  6488+ A? www.symantec.com. (34)

16:25:52.405761 192.168.0.4.4968 > 64.233.218.139.53:  6488+ A? www.symantec.com. (34)

16:25:54.408755 192.168.0.4.4968 > 199.166.24.12.53:  6488+ A? www.symantec.com. (34)

16:25:54.408990 192.168.0.4.4968 > 64.233.218.139.53:  6488+ A? www.symantec.com. (34)

16:25:54.467473 199.166.24.12.53 > 192.168.0.4.4968:  6488- 0/13/13 (469)

...

16:25:58.464303 192.168.0.4.4968 > 64.233.218.139.53:  6488+ A? www.symantec.com

16:26:06.465694 192.168.0.4.4968 > 64.233.218.139.53:  6489+[|domain]

16:26:07.467050 192.168.0.4.4968 > 64.233.218.139.53:  6489+[|domain]

16:26:09.469901 192.168.0.4.4968 > 64.233.218.139.53:  6489+[|domain]

16:26:11.472730 192.168.0.4.4968 > 199.166.24.12.53:  6489+[|domain]

16:26:11.472791 192.168.0.4.4968 > 64.233.218.139.53:  6489+[|domain]

16:26:11.525680 199.166.24.12.53 > 192.168.0.4.4968:  6489- 0/13/13 (490)

```

192.168.0.4 is the Win2K box with issues. What is "6488- 0/13/13 (469)"?

I am ready to wipe both boxes and start over!  :Sad: 

Help!

Bob

----------

## marvin

Your win2000 box sends requests to the nameservers 64.233.218.139 and 199.166.24.12. It doesn't get any answer at all from the first one but sometimes there is an answer from 199.166.24.12.

The output of tcpdump is described in "man tcpdump". Occording to this the meaning of "6488- 0/13/13 (469)" is that it is the answer to request 6488 and there were 0 answer records, 13 name server records and 13 additional records in the answer. The number in brackets is the size of the packet.

The differences to my output are the "-" after the request id in the answer and the "(DF)" in the request. From "man tcpdump":

 *Quote:*   

> Other flag characters that might appear are `-' (recursion available, RA, not set)

 

This could by a problem, because the nameserver will probably not make a recursive lookup and thus give you the 13 dns root servers as answer. I don't know how to change this.   :Confused: 

"(DF)" means "don't fragment", but this would perhaps not happen anyway because the packet is rather small, so it is probably no problem.

It would be good to have tcpdump output of one of your working boxes too, to see the differences. Otherwise my best bet is to change the nameservers, as 64.233.218.139 doesn't give any answer and the answer of 199.166.24.12 is not of much use. You could try "traceroute <ip-of-your-ns>" with all the nameservers on a working box, to see which nameservers are reachable. Then do the same thing on a box which is not working to see if it is a routing problem, that causes the query not to reach the nameserver.

(You might have to "emerge net-analyzer/traceroute", to do this.)

 *utabintarbo wrote:*   

> 
> 
> I am ready to wipe both boxes and start over! 
> 
> 

 

Well, I don't know if that would help.  :Sad: 

 *utabintarbo wrote:*   

> 
> 
> Help!
> 
> 

 

What do you think I'm trying to do here?  :Smile: 

A workaround of this problem would be to emerge and setup net-dns/dnsmasq (which is a dns proxy) on one of the working boxes and change the nameserver settings of all boxes that don't work to the box where dnsmasq is installed. Perhaps your router also works as dns-proxy. If that is the case you can use the (internal) ip of your router as dns and it should also work.

----------

