Dns resolver cache

why do i have connection issues. using wireless connection on my omni 10 win8.1. running hp trouble shooter all the time. to reconnect. i t resolves by purging DNS RESOLVER CACHE. error code 312. nne of my other wireless equipment as this problem such as my hp laptop win 7.

Hi richmcconn2014, I understand you are having connection issues with your Omni 10. I am not sure exactly what the error was you mentioned, but I have found a document which shows you how to flush and reset your resolver Cache.
DNS Resolver Cache - Flush and Reset in Windows
Beyond that, try the steps outlined in this document: Troubleshooting Wireless Network and Internet (Windows 8)
Let me know how it turns out.
TwoPointOh
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the bottom to say “Thanks” for helping!

Similar Messages

Open dns resolver issues on windows server 2008 R2

my client is running a windows 2008 r2 server with dns and dhcp roles. it's not a domain controller, just a workgoup server.
got a notification from my client's isp:
"These attacks have been facilitated through DNS
amplification attacks. AT&T has detected these attacks and has confirmed
that the IP address x.x.x.x allocated to your Internet access account is
accessible from the Internet as an open DNS resolver. "
tried disabling recursion, but then there is no access to the internet.
tried disabling the firewall rule for dns udp, and no access to the internet.
does anyone have any idea how to correct this? do i need to add a public dns server to my dhcp scope for internet access? if i do, then what good is a dns server and it doesn't resolve internet addresses?
Gary

Just to add, I was wondering why you had port 53 opened to your DNS servers. And just to point out, that rule you created is a port translation rule that allows access to your DNS server from the internet, just as if you had created a rule to allow access
to an internal web server for public use, or for allowing webmail (OWA) access from the internet to your internal mail server.
What you did, as Keith said, will stop that, but to further point out, the rules are not really needed again, I would just remove the rules completely. For internet access, such as allowing your users to access websites, your DNS to resolve external names
(whether using Root hints or a Forwarder), just about any firewall will allow that out-of-the-box. In some firewalls, you have to create a rule to the outside untrusted interface to "allow established" meaning when an internal request goes to an outside resource,
such as a website, to allow the response back in.
The only time you want to create rules is either you want to allow inbound traffic with a port translation rule (such as what you originally unknowingly did for TCP & UDP 53) to a web server, OWA, SMTP traffic to a mail server, etc.), otherwise,
leave it out of the box.
As for what the ISP is concerned about regarding DNS amplification attacks, is that they are a fairly recent method for attackers to create a DOS (denial of service). You can read up at a couple of recent discussions about what all that means in
the following threads, with ways to stop or mitigate them.
Best way to reduce or disable DNS amplification for external DNS?,
Sunday, June 16, 2013 6:08 PM
http://social.technet.microsoft.com/Forums/windowsserver/en-US/d087a768-2075-49e4-afec-4fd23b50af0a/best-way-to-reduce-or-disable-dns-amplification-for-external-dns
Protecting Windows DNS Server from being abused for DNS amplification attacks,
Wednesday, April 10, 2013 8:05 AM
http://social.technet.microsoft.com/Forums/windowsserver/en-US/fac86dc7-779d-48eb-a113-9c06c2222af9/protecting-windows-dns-server-from-being-abused-for-dns-amplification-attacks
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.

DNS Resolver not working with JDK 1.5.0_6 and Windows 2003

I have a Windows Server 2003 machine which now has Java JDK 1.5.0_6 installed on it. Somehow the DNS resolver doesn't work - every call to InetAddress.getByName("host") throws an UnknownHostException. I've tried de-installed java and re-installing, but the problem remains. No traffic seems to be generated (i.e. no packets to port 53) when getByName() is called. I don't have any kind of firewall on the Windows Server 2003 machine.
Has anyone ever seen this kind of behaviour / problem before and know of a solution?
Thanks,
Peter

Ok, I finally managed to solve this problem. What was happening was that IPv6 was installed on this computer, and as a result Java was trying to do a DNS lookup using a IPv6 socket and failing. With the help of TracePlus Winsock, I discovered that internall Java's InetAddress.getByName does this:
WSAStartup
socket(INET6)
getaddrinfo
WSACleanup
Two solutions are possible - either set the system preference java.net.preferIPv4Stack to true, or uninstall the IPv6 stack. Since I couldn't find a way to set the system preference in a persistent manner (apart from passing in an argument on the java command line), I uninstalled the IPv6 stack.
Hope this helps someone else.
Peter

Host fingerprint always changing, possibly dns resolve problem?

Hello,
I have a server that i try to connect which key fingerprint changes form time to time, and it stops me to connect (i get wrong password disconnect, although i am using an RSA key). Since its a physical machine lets exclude the part of any traffic shaping by the VPS provider. Also normally when i cant connect i cant see anything on the sshd logs of the machine. So this probably is a dns resolve problem ? Any recommendation or knowledge that you can share with me to help me solve this problem ?

presumbly the previous stats were from the test socket as new stats are just the same
any exchnage problems http://usertools.plus.net/exchanges/mso.php
http://usertools.plus.net/exchanges/?
http://btbusiness.custhelp.com/app/service_status
http://bt.custhelp.com/app/answers/detail/a_id/15036
http://community.plus.net/exchange-information/
If you like a post, or want to say thanks for a helpful answer, please click on the Ratings star on the left-hand side of the post.
If someone answers your question correctly please let other members know by clicking on ’Mark as Accepted Solution’.

Does DNS server cache forwarded request responses?

Hi,
Please excuse my ignorance. I am new to OSX Server and DNS. I setup OSX Server on my Mountain Lion system and configured the DNS server. It forwards requests which it cannot resolve to my service provider's DNS.
I am wondering if the responses to those forwarded requests are cached by the OSX Server so that the next time a request comes through they can be handled locally?
If they are, is there a way I can see what the DNS server has cached?
Thanks.

There are caches all over.
OS X client caches DNS responses.
See the command-line dscacheutil tool for poking around with that.
OS X Server DNS server also caches responses.
The BIND9 rndc tool is used for poking around in the ISC BIND9 DNS server, as is included with OS X Server.
sudo rndc -p 54 dumpdb -all
TCP port 54 is the management port used by default in the OS X Server version I've checked, where other installations of BIND9 will use TCP port 953 for that. To confirm the port, go have a look at the named.conf file for the "control" declaration. That file is usually either in /etc/named.conf, or it can be stored in /library/server/named in some OS X Server versions. Once the rndc command completes, go look in the directory where named.conf resides for the file named named_dump.db. That's a text file with the dump.
If you want to learn the innards of DNS as implemented by recent ISC BIND servers, acquire a copy of Cricket Liu's DNS and BIND book. The 5th edition was current, when last I checked.
Barring cases where the upstream provider offers DNS-based filtering or such, forwarding requests is usually an extra hop in the DNS translations that — unless you're hitting the same domains as other folks on your server — might not pay off. If the translation isn't in the ISP's DNS caches, then the usual series of queries of other root and authoritative DNS servers will ensue; you've added a hop.
If you do want to use a gonzo-scale DNS server as a forwarding server — I'd expect higher-scale and larger caches and likely also higher-availability than what most any other ISP is likely running — then Google DNS servers are available at 8.8.8.8 and 8.8.4.4.
Or just eliminate the forwarding servers.

[SOLVED] Problem with Iptables and DNS-resolving

So I'm changing my iptables default policy from ALLOW to DROP, and are tightening up the rules too.
However, I'm having troubles with allowing DNS-queries, while keeping things as locked down as possible.
/etc/resolv.conf
domain home
nameserver 192.168.1.1
Relevant rules:
# Allow HTTP
$CMD -A OUTPUT -o wlan0 -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -p tcp --dport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT
# Allow HTTPS
$CMD -A OUTPUT -o wlan0 -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -p tcp --dport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
# DNS-related rules
$CMD -A INPUT -i wlan0 -s 192.168.1.1 -p tcp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -s 192.168.1.1 -p udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT
$CMD -A OUTPUT -o wlan0 -d 192.168.1.1 -p tcp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$CMD -A OUTPUT -o wlan0 -d 192.168.1.1 -p udp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
What am I missing here?
Last edited by graph (2012-03-20 18:36:23)

Gcool wrote:I'm assuming you just want to allow that box to surf the net?
Yepyep. Sorry for not mentioning that.
192.168.1.1 is my router, and when I'm disabling the firewall, everything is working perfectly. This is with 192.168.1.1 as nameserver in /etc/resolv.conf.
I tried changing my rules to your rules, but I still can't get it to work.
The following is the output while I'm connecting to www.xkcd.com using elinks:
Output of tcpdump -n '(port 80 or 443 or 53)'
without iptables running: pastebin.com
with iptables running: pastebin.com
It seems to me that DNS is working properly, and that iptables is blocking port 80, right?
Last edited by graph (2012-03-20 08:20:44)

EA4500 Open DNS RESOLVER

Since 2 month now, my ISP (internet service provider)
close my internet conenction and say that i have an opendns resolver isue with my router
they cant help me with it so i called linksys support line
and my router have 1 year old and i need to pay for the support
so i said no ill find my bug alone without paying 30 $
can someone help me wit hmy issue
my isp said that its mybe an dns relay issue but i cant find it

Reload the router firmware and reset to factory defaults. Then reconfigure the router.
Please remember to Kudo those that help you.
Linksys
Communities Technical Support

DNS resolving when it shouldn't be able to

I have an AEBS set up to share a single IP via a PPPoE DSL connection. I have a Mac OS X Server whose network ethernet connection is manually configured with a static (internal) IP, router IP is set to the AEBS and DNS is set to 127.0.0.1
On that same server I have the DNS service running with no forwarding IP addresses. If I log in on that server and open Safari, I can browse the Internet. That is, the server is able to resolve URLs even though its DNS server should not be able to.
Why is this? Is some other behind-the-scenes magic working here? Bonjour?
It's great when a workstation has these kind of smarts, but for a server, more granular control is needed. What am I missing?

Sounds like your DNS server is recursive.
There are three modes the DNS server can operate in. In all modes it will answer queries for domains it is authoritative for - the difference comes in how it responds to other domain/hostname lookups
In standalone mode it can only answer queries for domains it is authoritative for. Any other domain/hostname lookup returns no result
In Forwarding mode it answers queries for other domains by forwarding the request to an upstream DNS server (typically your ISP, but it doesn't have to be).
In recursive mode it queries the internet root servers to find the authoritative host for the given domain, then goes and queries that server directly to service the request.
Off hand I don't recall the defaults, but it's likely that BIND is configured to be recursive for localhost queries (i.e. queries from the machine itself) and that's why you're getting a response - it's querying the root servers and going to find the answer.
Server Admin has options for controlling recursive and forwarding. Turn them all off if you only want to resolve the local domains (although that clearly limits the usefulness of the machine, but I guess you already know that).

Dns resolve some website slowly

Dns is resolving a lot of website quickly, but there are some websites like cnn.com , bbc.com take around 15 second to resolve the host name , I used nslookup then ping cnn.com and bbc.com and then take time also . I have 2 dns , and I have 3 dns for
isp and when I changed my dns and put any of isp dns I can open any website so fast, before all websites were opening fine but now I have that issue, and I check all configuration and connectivity all work great, OS Win server 2008 r2 and clients
win 7 and xp.

check the workload of your DNS
how many users in your environment?
http://technet.microsoft.com/en-us/library/cc778608(v=ws.10).aspx
Monitoring DNS server performance
Every second counts..make use of it. Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
IT Stuff Quick Bytes

List of DNS Negative Cache

Hi Folks
I'm having problems with what I believe to be intermittent negative responses for a host from DNS servers that we forward external queries to and those negative responses being cached.
Because of the intermittent nature of the problem every time it is reported I have not been able to carry out a query on the downstream DNS servers that has not produced a positive result.
I would like to know if it is possible to see if negative responses for this specific host are being cached on our DNS servers.
Thanks in advance
Kevin

You can possibly use DNSCMD, but I'm not sure if it will display negatively cached data. Have you tried using ipconfig /displaydns on the client to see what it negatively cached? And I'm not sure that will work. I can't reproduce the problem, since
none of my customers have this issue.
Keep in mind, [quoted from http://tools.ietf.org/html/rfc2308]:
"Negative caching was an optional part of the DNS specification and
   deals with the caching of the non-existence of an RRset [RFC2181] or
   domain name."
"[...] however had a fundamental flaw in that it did not allow a name
   server to hand out those cached responses to other resolvers [...]"
So my feeling is there are non-existing records in some of your DNS servers, or incorrect SOA records, or lame delegations. If your organization is that large, and DNS was not designed properly (all DNS servers in an org must have the same exact reference
to all records or issues will results, especially with AD), then I can see this may occur. So in reality, once you determined what data is negatively cached, the best way is to use DIG or nslookup testing directly against your forwarders for the records
that you believe are negative lookiong for NXDOMAIN responses (which are the records that have been negatively cached).
It may have been possible that Negative Caching was set on *some* of your Windows DNS servers, but not all. That will definitely cause problems. That's done by setting the
NegativeCacheTime to something really much higher than the default 300 seconds (15 minutes). If you are an admin and have access to those machines, you can take a look at that setting in the registry remotely.
Configuring Caching and Negative Caching
http://technet.microsoft.com/en-us/library/cc959309.aspx
Here was a thread that asked the same thing, but no resolution:
Windows DNS Server Negative Cache
"So how do I display what info is in the negative cache? From the command line…"
http://blog.joeware.net/2006/08/12/522/
Further, if your org is using ISA or TMG, and they've set negative caching on those servers, then DNS has nothing to do with it! Check this article out:
ISA: Configuring Negative Caching.
http://www.isaserver.org/tutorials/Configuring_Negative_Caching.html
Ace Fekay
MVP, MCT, MCITP EA, MCTS Windows 2008/R2, Exchange 2007 & Exchange 2010, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This post is provided AS-IS with no warranties or guarantees and confers no rights.

Cannot DNS resolve across networks using host name only (not fqdn)

Evening all,
I currently run domain network (MS Server 08 - dhcp) on my firewall interface1 and WiFi network on interface2 (dhcp provided by router itself). On my Wifi dhcp I am advertising as DNS server that of the domain, but wifi clients can resolve only FQDN domain
client names not host names ("domainclient.domain.local" - not "domainclient").
If on my wifi client I change NIC properties -> IPV4->Advance->DNS-> append these suffixes, and put the domain.local, then it works but need to be able to work without manual changes to each client.
Any ideas?
Many thanks,
Argyris

Hi,
Additional, please confirm your DHCP option have configure the correct WINS server.
The related KB:
Understanding DNS Client Settings
http://technet.microsoft.com/en-us/library/cc754152.aspx
Configuring TCP/IP networking
http://msdn.microsoft.com/en-us/library/dd163570.aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

DNS resolving a name... for a minute!

We are having problems with office.microsoft.com ceasing to resolve through our NW6.5 SP8 within a few minutes of named loading. I can unload and load named again and office.microsoft.com will resolve fine... for a few minutes and then it stops resolving again. All other microsoft.com domains seem to be resolving fine.
I'm completely baffled. Any ideas?

Originally Posted by osbornerd
We are having problems with office.microsoft.com ceasing to resolve through our NW6.5 SP8 within a few minutes of named loading. I can unload and load named again and office.microsoft.com will resolve fine... for a few minutes and then it stops resolving again. All other microsoft.com domains seem to be resolving fine.
I'm completely baffled. Any ideas?
Are the other microsoft.com zones running on the same server? Is the daemon dying? If all zones are on the same box, and you are only having issues with the one zone, I would backup the db and jnl files (SYS:\ETC\DNS I think) and then delete the ones for this zone and reload named. That will force named to recreate the db files from edirectory.

DNS resolving to external IP when ping.

Hi expert folks...have a question....when pinging to some of the client with in the LAN it resolve to external public IP instead of private IP ...i had checked and confirmed the client that that clients configured to DNS server IP with in the LAN.No external
DNS been configured...this doesn't not occur all the time with all clients...its happened some time with some clients...after few minutes when we re-ping or after refresh it is back to normal private IP.....Could please advice what could be the possibility
of this..?

Hi...Thanks for your guidance ...I had verified the configuration you mentioned on your post... DNS search suffix order was fine so i haven't made any changes on that ...also TTL time remains as default...i found that some clients have external
DNS on their DNS configuration list ...I had removed those........still i wonder even if external DNS configured it should be only in action ,when primary and secondary internal DNS cannot resolve .Also another interesting this i noticed ,when the address
resolved to external DNS the TTL is 65 and when it resolve to internally TTL 128 for all clients.I guess it jumping to external DNS bypassing internal DNS servers.So far i haven't experience same issue again that's why I cannot provide the outcome of
nslookup...appreciate your help and guidance.
The root cause was the external DNS servers on your clients. The DNS client side resolver service algorithm, looks at the first entry, and ONLY if it does not answer, which results in a NULL or NACK response, will it go to the second entry. If it does answer,
even if the answer is an "I don't know," the client will take that as an answer and look no further. This algorithm, in case you're wondering, which many do, is not just the way Microsoft operating systems work. It's based on the IETF RFC industry standards
that all manufacturers must adhere to.
The proper way to configure all machines, especially in an AD environment, is to only use your internal DNS servers on every machine, nothing else, including the router as a DNS address (you would be surprised how many do use that because the ISP told them
it's ok), and in your DNS server properties, you can optionally configure a forwarder to your ISPs. That's the only place any external DNS servers can exist internally, in a Forwarder or Stub.
More on the resolver service:
This blog discusses:
WINS NetBIOS, Browser Service, Disabling NetBIOS, & Direct Hosted SMB (DirectSMB). Troubleshooting the browser service.
Client side resolution process chart.
The DNS Client Side Resolver algorithm.
If one DC or DNS goes down, does a client logon to another DC or use the other DNS server in the NIC?
DNS Forwarders Algorithm and multiple DNS addresses (if you've configured more than one forwarders or more than one IP in the NIC's DNS list)
Client side resolution process chart
Published by Ace Fekay, MCT, MVP DS on Nov 29, 2009 at 10:28 PM 1764 1
http://msmvps.com/blogs/acefekay/archive/2009/11/29/dns-wins-netbios-amp-the-client-side-resolver-browser-service-disabling-netbios-direct-hosted-smb-directsmb-if-one-dc-is-down-does-a-client-logon-to-another-dc-and-dns-forwarders-algorithm.aspx
DNS Clients and Timeouts (Part 1 & Part 2), karammasri [MSFT] Dec 2011 6:18 AM
http://blogs.technet.com/b/stdqry/archive/2011/12/02/dns-clients-and-timeouts-part-1.aspx
http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

DNS resolving magically...

I'm not sure if this is the right forum spot for this, but thought someone else should see this.... I have two NICs setup on a "bridge" pc to bridge two domains together, a Dev domain and a Prod domain. Both nics have a single DNS server
pointing to 8.8.8.8 for googles DNS (no internal DNS), BUT some how, a ping command to an internal server, resolves to a Dev or a Prod IP automagically... Any idea how these are resolving without local DNS servers configured on the NICs?

correct, but they are basically duplicates of eachother, and therefore don't have access to eachother. But have a "bridge" terminal server built, that's not a member of either domain, that has two nics, and the ability to connect
to both domains. both nics using googles dns (8.8.8.8) yet somehow, internal DNS addresses are still resolving...

DNS resolving issues

Hello.
I'm having a lot of issues when resolving DNS names on Linux.
I've 2 computers, one is running Windows XP SP2, the other is running Arch Linux. I connect to the internet using the Windows machine, and I have ICS turned on so I can connect through my linux box as well.
Whenever I connect to a host of any sort through the linux box, I often recieve "Unknown Host" messages. If I refresh several times then it works.
My linux box has dual boot with Windows XP SP2. If I use Windows on this machine, I'm having no DNS issues at all.
So I believe the problem is with the way my Arch is configured.
This is the relevant part from my /etc/rc.conf:
lo="lo 127.0.0.1"
#eth0="dhcp"
eth0="eth0 192.168.0.2 netmask 255.255.255.0 broadcast 192.168.0.255"
INTERFACES=(lo eth0)
# Routes to start at boot-up (in this order)
# Declare each route then list in ROUTES
# - prefix an entry in ROUTES with a ! to disable it
gateway="default gw 192.168.0.1"
ROUTES=(gateway)
Can anyone help me rid of this annoying problem?

This is what it says:
nameserver 192.168.0.1
search mshome.net
192.168.0.1 is the IP address of the Windows machine.
MSHOME is the name of the workgroup my Windows machine is in.

Dns resolver cache

Similar Messages

Maybe you are looking for