External DNS cache slow to update?
Hello.
Is there something in OS X 10.5 Server (which all machines use for their DNS server) that caches external DNS requests? I often find, within our network, external DNS cache is slow to be updated.
For example, right now, I just moved servers for a project I'm working on (well, I moved it 12 hours ago) and updated the DNS/zone file for it. When I'm outside our network, tracecroutes of the domain point to the new server. But, when I'm within the network, traceroutes still point to the old server.
The reason I think this has something to do with OS X 10.5 Server is, on the machine I'm sitting at right now, when DNS is set to the IP of the OS X 10.5 Server, external DNS is old (i.e., the traceroute on the domain I've moved still points to the old server). But, if I change the DNS to OpenDNS or Google DNS, the DNS information is new (i.e., the traceroute on the domains I've moved points to the new server).
Now, on the OS X 10.5 Server, I have "Forwarder IP Addresses" set to OpenDNS server. So, should DNS requests, via the OS X 10.5 Server, not make their way via OpenDNS servers? And if so, why is it that, when going through OS X 10.5 Server, I'm still pulling old DNS information?
I've:
- flushed the cache in OS X 10.5 Server (via dscacheutil -flushcache)
- flushed the cache on the 10.8 client machine (via sudo killall -HUP mDNSResponder)
- restarted the machines
Does anyone know what's going on here?
Thanks,
Kristin.
Hi
If it's any consolation both sites mentioned have always been slow to load for me. Regardless of Service Bandwidth, external/internal DNS, Browser, Platform or Location.
Occasionally and for no apparent reason they do load as quickly as other sites. Only to return to their usual 'performance' after a short time. There are other sites that perform the same for me which I can't think of at the moment.
Tony
Similar Messages
-
Internal DNS Caching - Different than External DNS Caching?
Possibly. Just check the TTL of your internal DNS records like this:
Batchfilenslookup -type=soa rackspace.co.uk
Where rackspace.co.uk is the name of one of your internal machines.Oliver Kinne wrote:DNS per se allows you to set the TTL (time to live) of a DNS record. Public DNS entries are set with TTLs of anything between 5 minutes to 72 hours - depending on the records and who set them up.You can set the TTL of DNS records on your Microsoft server - see here: https://support.microsoft.com/en-us/kb/297510So it's up to you how long for DNS entries are cached for internal records.Of course, technically clients can ignore the TTL and cache records for longer or even a shorter amount of time. The TTL is just a "recommendation", but most clients adhere to the TTL given out by the DNS server.Ohhh! Okay, I didn't know that cached DNS records expired. So, basically, my internal DNS server is stating that the TTL on our internal DNS info isa period of time of less than that of external DNS sources such as those that...
-
2008 R2 DNS does not resolve external websites until I clear DNS cache
Do I need to apply this hotfix
http://support.microsoft.com/kb/2508835/en-us
MCSE CertifiedThank you for posting the ipconfig /all, but we can't use it since the relevant data that we need to evaluate has been blocked out. I can understand if you have a strong security policy.
The Conditional Forwarders shouldn't be causing you to not to resolve specific domain names.
How long has this been going on?
What exactly occurs? Does DNS stops totally responding when you test it with nslookup, or are you just testing it with Internet Explorer?
If you have nslookup tests and responses, it may be helpful to see them, but if your security policy prevents you from posting them, I understand.
I'm curious about this part that you posted:
> "And as suggested by microsoft
> earlier,we have blocked few DNS
> Domains by creating conditional
> forwarders , pointing to
> our another domain."
Did you open a ticket with Microsoft support that provided this suggestion? If yes, you can email your support engineer that assisted you.
Or did you post this in this forum or elsewhere that you received this suggestion? If a forum post, do you have a link?
Without specifics, it may be difficult to assist. However, what I can provide are the following hotfixes. The second one you had already installed. I suggest and recommend to install the others.
1. DNS Server service does not use root hints to resolve external names in Windows Server 2008 R2
Post Windows 2008 R2 SP1 HOTFIX available.
APPLIES TO •Windows 2008 R2 Datacenter •Windows 2008 R2 Ent •Windows 2008 R2 Std.
Requires a restart.
http://support.microsoft.com/kb/2616776
2. DNS Server service does not resolve some external DNS names after it works for a while in Windows Server 2008 R2
Hotfix release - (released 4/15/2011)
http://support.microsoft.com/kb/2508835
3. Windows 2008 -
DNS queries for external domains are not resolved when you use Conditional Forwarding in Windows Server 2008
Post Windows 2008 SP2 Hotfix available
Requires a restart.
http://support.microsoft.com/kb/2625735/
4. DNS server stops responding to DNS queries from client computers in in Windows Server 2003, in Windows Server 2008 or in Windows Server 2008 R2 - Post Service Pack Hotfix available.
Does not require a restart.
http://support.microsoft.com/kb/2655960
If the above do not help or provide improvements, I highly suggest to contact Microsoft Support for specific assistance. Here's the link if you decide that you need to go with this option:
http://support.microsoft.com/contactus/
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights. -
I'm having trouble with a Web site when I access it on my home computer, yet this same site looks fine on my Mini at work. One section of the index page generates a "can't find server" error, and the site's own logo won't display properly. It is a free hosting site. Sometimes I can upload files to it, other times I get a can't-find-server error when I try.
In answer to my query about this (to which I helpfully attached a screenshot of the incompletely loaded index page and its error messages), the host is telling me that I should "flush my DNS cache," which they say involves going into Terminal and giving the command "ookupd -flushcache" [sic]. (I've already surfed this briefly and the first result confirmed my suspicion that this doofus hasn't mastered copy-and-paste technique and the command actually should be "lookupd- flushcache".)
It's not just that their site doesn't load fully, though. They have some stuff on one of their pages that they encourage users to hotlink on personal Web sites, and I have done that with one of their banners. The banner, which was fine for months, now appears on my page as a broken icon, too, although it, like the site's home page, loads fine on my computer at work.
My first question is, is there any harm in flushing the DNS cache? The OS Daily page where I think they copied this advice from makes it sound like this is something only a Web server would need. If I do it on my home machine, could it cause problems? Could it disable my Internet connectivity?
Second, less urgent question, more for the netgeeks out there: Do you think this is a likely solution to my problem? Especially considering that the problem involves not only their site but an element on an external site linking back to them? I hate to play the sucker for some low-level geek whose main mission is to deflect my query.
Thanks
KathiKathi--
Like BDAqua says, there's nothing to worry about flushing the DNS cache. It's true that most people probably don't need to do it very often, but it's something easy and harmless to try, and it might well fix problems like yours.
One handy feature of Safari, even if you don't use it for anything else, is the "Activity" window. Open it from the "View" menu, and watch as your page loads. You can see exactly which components on the page are loading, which aren't and where they should be coming from. If you double-click an element in that list, Safari will try to open it in a new window. That is sometimes enough to give a clue as to why something isn't working.
You can use Safari's activity list along with the Network Utility from your Utilities folder to try to figure out why you're not getting the page elements. Suppose a graphic is listed as coming from http://www.server1.com/images/logo.jpg, but it's not loading.
First thing I would try in the Network Utility is to see if it will respond to pings. From that example, enter "www.server1.com" on the "Ping" page of the Network Utility and see if it answers back.
To find out if it's a DNS problem, you can use Safari's list to get the addresses of the problem elements, then see if the IP addresses match up on your computer at home to the one at work. If they don't, then it could be stale DNS.
You can use the Network Utility for DNS lookups, but I think they're hard to read, and, since you're already thinking about using the Terminal to flush the DNS cache, you can use nslookup. It's really simple:
<pre class="command">nslookup www.apple.com</pre>
Will give you something like this (the first two lines will likely be different):
Server: 208.67.222.222
Address: 208.67.222.222#53
Non-authoritative answer:
www.apple.com canonical name = www.apple.com.akadns.net.
Name: www.apple.com.akadns.net
Address: 17.251.200.32
If the addresses don't match, or you get a message that it can't find anything for your server, then you know it's a DNS problem. Perhaps they've changed some addresses and your home ISP's DNS servers themselves aren't updating.
You can even use nslookup to see what different DNS servers say about an address. Just add the IP address of a DNS server after the address you want to look up:
<pre class="command">nslookup www.apple.com 208.67.220.220</pre>
Just do a search on the 'net for free DNS servers, and you'll find a bunch to choose from.
charlie -
MacBook painfully slow after updating OS X to 10.9.5!!!!!
My MacBook runs extremely slow since updating to 10.9.5 today! Why is this? While typing this the color wheel came up approximately every two words. Took over ten minutes just to post this!!!
1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.
Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.
There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.
You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.
In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.
You may not be able to understand the script yourself. But variations of the script have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message.
Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.
4. Here's a summary of what you need to do, if you choose to proceed:
☞ Copy a line of text in this window to the Clipboard.
☞ Paste into the window of another application.
☞ Wait for the test to run. It usually takes a few minutes.
☞ Paste the results, which will have been copied automatically, back into a reply on this page.
The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.
5. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' com.clark.\* \*dropbox \*genieo\* \*GoogleDr\* \*k.AutoCAD\* \*k.Maya\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB com.apple.AirPortBaseStationAgent 464843899 51 5120 files );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { print "'${p[41]}'";if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$|'${p[41]}'/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/^root$/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1100) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { print "'${p[41]}'.plist\t'${p[42]}'";if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\\([0-9]+\\)\\(.+\\)/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p);if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|(Bo|PO).+ sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n ...and %s more line(s)\n",l-L);} ' ' s/^ ?n...://p;s/^ ?p...:/-'$'\t''/p;' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" ' BEGIN{FS="= "} /Path/{print $2} ' );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test osascript\ -e );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' "'tell app \"System Events\" to get properties of login items'|tr , \\\n" 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'bad |Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:| VALI|xpma' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Co{mpon,reM},Ex,Inter,iTu*/*P,Keyb,Mail/B,Pr*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -path \\*s/Resources -prune -o -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t /S*/L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'|sort|uniq -c|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" '/S*/*/Ca*/*xpc* >&- ||echo No' );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA Descriptors XPC\ cache );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 35 49 61 51;D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D23 14 1 62 42;D12 34 43 53 44;D12 22 50 32 52;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 37 2 48 43;D13 4 5 32 1;D13 4 3 60 5;D12 26 48 49 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D22 4 4 50 0;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-
Copy the selected text to the Clipboard by pressing the key combination command-C.
8. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.
9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter
exec bash
and press return. Then paste the script again.
10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line
[Process completed]
to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report what happened. No harm will be done.
12. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.
14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed. -
WRT54G and CVE-2008-1447 (DNS cache poisoning vulnerability)
Is the WRTG54 affected by the DNS cache poisoning vulnerability described in CVE-2008-1447 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447)?
If so, can we expect a patch, and when? Are there any steps we can do to protect ourselves from attack in the meanwhile?
Many thanks,
RogerBNo, I have an acceptable external DNS provider.
Both my XP and Debian PCs required software updates for CVE-2008-1447 according to the Microsoft and Debian websites. This suggests that the router may need similar attention, particularly as it resolves hostnames to IP addresses for me on my home network. For all I know, it may even be based on Debian (I know that routers include GPL software which requires Linksys to publish several megabytes of GPL code).
To rephrase my question, does the firmware on the WRT54G include programs such as BIND9, which are affected by CVE-2008-1447? If so, when can we expect an update for the firmware which includes fixes for any such programs?
As a follow on question, if the firmware does require updating, are there any settings that I can change, or actions that I can avoid, to ensure my home network remains safe from a DNS cache poisoning attack in the meantime?
Many thanks,
RogerB -
My mac become more slower after update to Mountainlion
My mac become more slower after update to Mountainlion
What shoudl I do? can you guys help me? BTW I have update my RAM to 8G
Thank youWhat is your Mac?
What did you update from? 10.6 or 10.7?
If from 10.6 or your machine was at 10.5 at one time, it might be too old/slow for 10.8, you might want to revert to 10.6 again.
How to revert your Mac to Snow Leopard
What do you notice is slower than before? Like Internet or booting or loading programs or UI feel or what exactly?
If it's the Internet, then check this out
WiFi, Internet problems, possible solutions
WiFi security issues, at home and WiFi hotspots
Now a fresh install of OS X usually does wonders, this would mean you will need to take acurate account of your installed programs, passwords, export bookmarks and backup all your data to a external storage drive. Keep the boot drive data below 50% filled ideally, (not much for you apprantly, just reduce 50GB of data)
Most commonly used backup methods
Write down your AppleID and password to reinstall 10.8
When your sure, then hold command r boot into Recovery, use Disk Utility to Erase (middle selection) the Macintosh HD partition and wait, it's going to map off fialing sectors. When done quit and reinstall 10.8 fresh and install programs and files from backup into the same named accounts.
https://support.apple.com/kb/HT4718
That should make things zippy again. Also a #12 OnyX cache cleaning routine
Step by Step to fix your Mac
Another method is this, it's a defragging/performance speed up step, you won't have to reset everything up again from scracth like a fresh install method does. But it requires paid software and a external drive, but makes a excellent bootable backup in the process that can save your behind one day.
How to properly defrag a Mac's hard drive -
10.6.4 Server on Mini Server - DNS Problems - Slow, EDNS log messages
Like a few of other people here, I'm having a hard time getting DNS to work smoothly on my new Mac Mini Server, now running Snow Leopard Server 10.6.4. I'd been running Leopard Server on a previous machine with much smoother DNS (though the Server Admin config didn't work, that's another story).
Resolution takes a very, very long time and eventually I'll get messages in the log saying 'success resolving 'xxxxxx' after reducing the advertised EDNS UDP packet size to 512 octets'.
I've searched everywhere and there seem to be two reasons why this is happening:
1. The DNS server is stopping responding on TCP, and is only responding on UDP;
2. Some other portion of my network (maybe the router) doesn't like UDP packets bigger than 512 octets.
For the first - is there any way I can fix this within OS X Server? There is no problem in the network since the router itself (running Linux) can resolve via TCP (using the forwarder addresses that are set up in my OS X Server config) instantly, and any clients that I switch from using the internal OS X Server (for DNS resolution) to use an external resolver work immediately too. I'm not sure why the daemon on OS X Server stops listening on TCP port 53 and only accepts UDP - and then only forwards on queries via EDNS via UDP - which is where I seem to have a problem.
Secondly - can I disable EDNS somehow and just do plain old DNS?
Some of the threads point to routers that don't like UDP packets over 512 octets, some point to firewalls and adaptive code that closes off ports when an app tries too many times, etc. I've opened ALL firewalls - turned off the OS X Server firewall, turned off the SPI firewall in the router (it's a Netgear DG834 with the DGTeam custom firmware), and I'm as far as I can go without buying a new router.
If the only answer is 'OS X Server needs a better router' then I'd appreciate what router I should buy - this situation is becoming untenable since the DNS resolution performance of my entire network is unpredictable, and I don't want to have to reboot the Server on a regular basis when there are loads of clients and their home directories sitting on it, since OS X Client gets twitchy when your home folder vanishes off the network…
I'm happy hacking config files - but can't seem to see anything in the DNS config that would allow me to either turn off EDNS or restrict the packet size to 512 octets (there's a comment in the config file that the directive is ignored for this one, fat lot of help that is). As to why the server itself stops listening to TCP port 53…. I have no idea and I can't find a solution with a search.
So in the absence of solutions - can anyone help me with a workaround? The only 'answered' question in this domain was 'answered' with the OP finding a workaround in their router firmware that changed the DNS cache packet size. I can't find anything like this in my router config, so I can't use this workaround. Are there any workarounds I can apply to my OS X Server, that don't rely on my router?
Yes, I know the router isn't that special, but it's a small business network. Advice on an upgrade would be welcome but doesn't solve the problem for me now. I'm based in the UK, if anyone also in the UK can recommend a suitable small-business NAT router I can use then I'd find that helpful, but I don't want to be told to purchase an enterprise-class router, turn off NAT and be recommended a store in the USA as it won't be that helpful
Ideally there'd be a way to tweak the DNS server on OS X to not bother with EDNS, or to stick to 512 octet sized packets (can I do this globally for all UDP from my server?), or to keep working on TCP…
Anyone know? The machine hosts client homes internally and serves mail, web and DNS externally. It's not a high-traffic system and it sits at the end of a business-grade ADSL line. I'm not being DoS'd - this behaviour seems random as to when it strikes. I try to restart the named daemon on the server when it strikes, but I need to be on the network to make that happen….
Solutions appear to be out, but I'd really appreciate a workaround. Many thanks in advance!Hi Rob,
Not much of a MAC person myself however this support matrix might help:
http://www.adobe.com/products/coldfusion/coldfusion7/pdfs/cfmx7_systemsupportmatrix.pdf
Seeing your getting a few Java errors perhaps the JVM in CF7 1.4.2_09 is too early for MAC OS 10.6.4?
HTH, Carl. -
How can I clear the DNS cache?
When I configure my webserver and change the records, I have to wait the time configured in the ttl of the specific record. I know, that I can change the ttl to a lower value, but the default value is 3 hours, so i have to wait until the time's up.
I checked the DNS records with dig (from dnsutils). dig also shows the remaining seconds until the next refresh (dns server request). And here's my question: How can I refresh it manually? (tried a lot from the internet, but nothing helped)
Thank you guys!
Last edited by gummiflummi (2014-12-16 20:41:53)brebs wrote:Woah right there. Why do you need to *change* the records? Shouldn't happen often.
Other than the answer stated (to test DNS settings), you might want to change records for a (self-hosted) DynDNS service. If you want a device to updated its DNS entries while being connected to a shaky cellular network, those changes might occur frequently with changing IPs.
To the original poster: You should always set the TTL to a reasonable setting. If you didn't change the record for the last two years, then maybe a TTL of several hours (or even a day) might be OK. If you want to be able to react more quickly to emergency situations, set it lower. For a DynDNS service, TTLs below a minute might be appropriate.
If you want to test your DNS Server, you can always query it directly (bypassing your ISP's DNS servers) with a command like this (where 1.2.3.4 is the IP of your nameserver):
dig @1.2.3.4 your.entry.example.com
This will usually show you the new settings right after changing. -
I have a customer running SBS2011 Standard. We've had problems with slow DNS resolute for a very long time. When users on their workstations go to a web site in IE, it usually takes a couple of seconds to load the site. The best example
of the problem is on Yahoo!. When users click a link there, IE will spin for a while and then time out. If they click on the link again, it usually loads the second time.
We recently switched internet providers and I was hoping that might resolve the issue, but it has not. The server is up-to-date as of a month or so ago and I've run BPA and the only issue there is with WSUS Group Policy objects, which I don't care
about. I wouldn't think this would be related to that. There are no errors in the DNS logs. This server was originally a clean install of a new domain, not a migration.
I have Forwarders configured and have tried using the DNS servers of the old ISP, the new ISP and OpenDNS. No improvement with any of those changes. On the Monitoring tab of the DNS server properites, "A simple query against this DNS server"
and "A recursive query to other DNS server" both fail every time. If I get rid of the Forwarders, those queries still fail and DNS resolute at the clients is still slow.
I know there was a DNS issue that was reported by the BPA a while ago and I fixed that. I think it was a registry setting that needed to be adjusted, but I can't recall the details right now.
I ran DCDIAG last night and was receiving messages about running Chkdsk to fix errors. I was hopeful that that would fix something, but I'm no longer getting that message. Now, the only errors in DCDIAG are SystemLog errors about not being able
to contact a machine that has been off the network for a while.
Restarting the server or just the DNS server has never helped.
My server has a PTR record in the reverse lookup zone and a static A record in the Forward Lookup Zone.
When I run NSLookup, it only responds with
Default Server: UnKnown
Address: fe80::9fcf:d19d:a86e:46cd
On another SBS server that I have, it has all of this information:
x.x.2.0.3.x.8.6.x.x.x.2.0.d.f.d.0.0.0.0.0.0.0.0.0.0.0.0.0.8.x.x.ip6.arpa
primary name server = localhost
responsible mail addr = nobody.invalid
serial = 1
refresh = 600 (10 mins)
retry = 1200 (20 mins)
expire = 604800 (7 days)
default TTL = 10800 (3 hours)
Default Server: UnKnown
Address: fe80::dfd0:2dca:68f3:2cf
Is that a helpful clue? Where do I start with troubleshooting and/or checking settings?
Any help would be appreciated.
Thank,
MikeI would certainly change the router, just to rule it out.
Have you run the SBS BPA and fixed any issues it highlights?
If pointing a client directly to an external DNS, improves, but does not fully resolve, i would be inclined to say the Server is 'ok' and that it may be the router at fault.
It has been too long since i looked at a ProSafe router, but there may well be some firewall settings you can tweak.
Robert Pearman SBS MVP
itauthority.co.uk |
Title(Required)
Facebook |
Twitter |
Linked in |
Google+ -
External DNS not resolving SBS2011
Hi,
Hoping someone can help me out here. We have an SBS server that is no longer forwarding external DNS queries. We setup a secondary DNS server onsite so users would still be able to access web resources, but our primary DC only resolve
internal DNS. We have checked the forwarders on the servers (same on both), and one server resolves the forwarders, the other can't.
I have triedrestarting the DNS service, flushing DNS cache and a server restart. I've also checked forwarders and root hints, but can't see anything wrong in the configuration. Both servers have NIC set with the other DNS server as primary and itself
as secondary.
I tried running an nslookup which works when both DNS servers are polled, but fails on the SBS server if it tries to poll itself or an external DNS server.
Anyone have any ideas?
Thanks
LukeHere is the results from my dcdiag test:
dcdiag /test:dns
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
Home Server = SERVER01
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\SERVER01
Starting test: Connectivity
......................... SERVER01 passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\SERVER01
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... SERVER01 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : domain
Running enterprise tests on : domain.com.au
Starting test: DNS
Test results for domain controllers:
DC: SERVER01.domain.com.au
Domain: domain.com.au
TEST: Forwarders/Root hints (Forw)
Error: All forwarders in the forwarder list are invalid.
Error: Both root hints and forwarders are not configured or
broken. Please make sure at least one of them works.
Summary of test results for DNS servers used by the above domain
controllers:
DNS server: 128.63.2.53 (h.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.63.2.53
DNS server: 128.8.10.90 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.8.10.90
DNS server: 139.130.4.4 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 139.130.4.4
DNS server: 139.134.5.51 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 139.134.5.51
DNS server: 192.112.36.4 (g.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.112.36.4
DNS server: 192.203.230.10 (e.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.203.230.10
DNS server: 192.33.4.12 (c.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.33.4.12
DNS server: 192.36.148.17 (i.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.36.148.17
DNS server: 192.5.5.241 (f.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.5.5.241
DNS server: 193.0.14.129 (k.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 193.0.14.129
DNS server: 198.41.0.10 (j.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.41.0.10
DNS server: 198.41.0.4 (a.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.41.0.4
DNS server: 202.12.27.33 (m.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 202.12.27.33
DNS server: 203.50.2.71 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 203.50.2.71
DNS server: 203.8.183.1 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 203.8.183.1
DNS server: 208.67.220.220 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 208.67.220.220
DNS server: 208.67.222.222 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 208.67.222.222
DNS server: 209.244.0.3 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 209.244.0.3
DNS server: 209.244.0.4 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 209.244.0.4
DNS server: 210.23.129.34 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 210.23.129.34
DNS server: 220.233.0.1 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 220.233.0.1
DNS server: 220.233.0.2 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 220.233.0.2
DNS server: 4.2.2.1 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 4.2.2.1
DNS server: 4.2.2.2 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 4.2.2.2
DNS server: 61.8.0.113 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 61.8.0.113
Summary of DNS test results:
Auth Basc Forw Del Dyn RReg Ext
Domain: domain.com.au
SERVER01 PASS PASS FAIL PASS PASS PASS n/a
......................... domain.com.au failed test DNS
Hope this helps.
Thanks
Luke -
WRT54G....Can I set DHCP to use the router for DNS instead of external DNS?
Hi folks. I cant' get my router to have DHCP tell my PCs that the router should be the DNS server instead of the external servers it is using. I am using Comcast Cable internet. It sets the external DNS servers for every PC that connects to it and I have problems finding my PCs on my network by NetBIOS name because the external DNS servers obviously don't store my local PCs. How can I set the router up to set DHCP to use the router for DNS?
If you cannot set the DNS server in the configuration page for the DHCP server in your router then your router does not support this.
This won't solve your problem though. The DNS server on the router is a simply forwarder. It simply forwards the DNS requests from your computer to the ISP's DNS servers. The DNS server does not accept dynamic updates to a private zone inside your LAN. And DNS is pretty much unrelated to the standard windows workgroup browsing which does the actual name resolution inside your LAN. That name resolution even works without a router inside your network. Basically all windows computers in your network periodically broadcast their name to the network. One windows computers is elected "master browser" which collects all these names and provides the name resolution service for all computers in the workgroup.
If this does not work it is most likely a windows configuration problem. It could be a software firewall on the computers which blocks traffic. It could be that the computers are not setup for file/printer sharing and thus have the computer browser disabled. It could be that your computers have a WINS server configured which does not exist. There are probably more causes. The better source to ask this question would probably a Microsoft support group. They deal with these kinds of issues more often and maybe a MVP may be able to point you into the right direction or give some links to step-by-step instructions... -
W2003 DNS cache snooping vulnerability for PCI-DSS compliance.
Hi everyone.
How can I solve this security vulnerability reported by Nessus(security software) with W2003's DNS ?
DNS Server Cache Snooping Remote Information Disclosure
Synopsis:
The remote DNS server is vulnerable to cache snooping attacks.
Description:
The remote DNS server responds to queries for third-party domains that do not have the recursion bit set. This may allow a remote attacker to determine which domains have recently been resolved via this name server, and therefore which hosts have been recently
visited. For instance, if an attacker was interested in whether your company utilizes the online services of a particular financial institution, they would be able to use this attack to build a statistical model regarding company usage of that financial institution.
Of course, the attack can also be used to find B2B partners, web-surfing patterns, external mail servers, and more. Note: If this is an internal DNS server not accessable to outside networks, attacks would be limited to the internal network. This may include
employees, consultants and potentially users on a guest network or WiFi connection if supported.
Risk factor:
Medium
CVSS Base Score:5.0
CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
See also:
http://www.rootsecure.net/content/downloads/pdf/dns_cache_snooping.pdf
Solution:
Contact the vendor of the DNS software for a fix.
Plugin output:
Nessus sent a non-recursive query for example.com and received 1 answer : 192.0.43.10
I have been searching for a solution at the web...but I was unabled to find one..that could let me to use "recursion" at our DNS server.
We have an internal DNS server for Active Directory, with a forwarding to resolve external internet domains as is a requirement by our application..but now the only way to fix this is to disable "recursion" and we are working with external IP address instead
of internet DNS names..but this is not a good solution for us.
I found something about spliting DNS functions, but my point is that we have all the servers internal and DMZ, inside the same AD domain..so we need to use the same DNS server AD integrated, notwithstanding we must resolve external DNS records for our application...How
can I do this without getting the same vulnerability again ? I don´t know how to do it disabling "recursion"..If I disable recursion I will be unable to resolve external DNS names.
Any suggestion will be really appreciated!!
thx!!That's basically for your internet facing DNS. I wouldn't worry about it too much for internal DNS, since that's only hosting your internal AD zone.
Other than setting the "Secure cache against polution" setting, you can also opt to disable caching of all records so each and every query is a fresh query. This actually fixes CNAME vs A record TTL mismatch issues, too, not that you're probably seeing them
or not, but just wanted to add that:
Description of DNS registry entries in Windows 2000 Server, part 2 of 3 (applies to 2003, 2008 & 2008 R2)
http://support.microsoft.com/kb/813964
Cannot resolve names in certain top level domains like .co.uk.
http://blogs.technet.com/b/sbs/archive/2009/01/29/cannot-resolve-names-in-certain-top-level-domains-like-co-uk.aspx
============
To turn off or disable local cache: (WIndows 2000 notes, but they apply to all current OS's)
Set the MaxCacheTtl to 0 in the registry or use Dnscmd
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS\Parameters
Value: MaxCacheTtl
Type: DWORD
Default: NoKey (Cache for up to one day)
Function: Set maximum caching TTL.
MaxCacheTtl
Type: DWORD
Default value: 0x15180 (86,400 seconds = 1 day)
Function: Determines how long the DNS server can save a record of a
recursive name query.
You can use the MaxCacheTtl registry entry to specify how long the DNS
server can save a record of a recursive name query.
If the value of the MaxCacheTtl entry is 0x0, the DNS server does not save
any records.
The DNS server saves the records of recursive name queries in a memory cache
so that it can respond quickly to new queries for the same name. Records are
deleted from the cache periodically to keep the cache content current. The
interval when the records remain in the cache typically is determined by the
value of the Time to Live (TTL) field in the record. The MaxCacheTtl entry
establishes the maximum time that records can remain in the cache. The DNS
server deletes records from the cache when the value of this entry expires,
even if the value of the TTL field in the record is greater.
Change method
To change the value of the MaxCacheTtl entry, use Dnscmd.exe, a tool that is
included with the Windows 2000 Support Tools. The change is effective
immediately so that you do not have to restart the DNS server.
Start method
DNS reads its registry entries only when it starts. If you change the value
of the MaxCacheTtl entry by editing the registry, the changes are not
effective until you restart the DNS server.
Note the following items: . Windows 2000 does not add the MaxCacheTtl entry
to the registry. You can add it by editing the registry or by using a
program that edits the registry.
The MaxCacheTtl entry does not affect Windows Internet Name Service
(WINS) data that is saved in the DNS memory cache. WINS data is saved until
the Cache Timeout Value on the WINS record expires. To view or change the
Cache Timeout Value on the WINS record, use the DNS snap-in. Right-click a
zone name, click Properties, click the WINS tab, and then click Advanced.
===============================
Ace
Ace Fekay
MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007 & Exchange 2010, Exchange 2010 Enterprise Administrator, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights. -
I just moved my music to an external HDD and am now updating. It is taking forever -- about 1/2 hour for 24 songs. Surely this should not be happening? My notebook is a Pentium 1.6GHz; my external drive is Iomega 80GB. My IPod is new 30GB color screen. Updates used to happen in a flash on same equipment but the notebook's internal drive.
thxHow do I tell? I called up properties, but it just told me the drive name (Hitachi DK23FA-40). If it helps, this is an Iomega 80GB drive I bought in HK about 1 year ago.
However, now that you say that I remember this is passing through an HP/Targus USB Hub that my HK dealer gave me as a freebie when I bought the notebook. That's probably slowing it down -- 3 sets of cables, not one. Think that's the problem? I'll try that next time. -
Slow internet / update download error
Hi,
I'm trying to help fix my dad's Imac G5 2.1 Ghz (OS X 10.4.2), but am having a real hard time in doing so. Please help me!
The problem lies in the connection with the internet and it has been going on for some time now. Problems:
- some webpages will load half way and then loading will stop
- safari crashes on some webpages (youtube), does not load images on others (bbc.com)
- when downloading an os x update the following error appears: a networking error has occured: timed out (-1001)
- some pages do work normal, for instance Apple.com
This is the list of things I have tried so far:
- completely new reinstall of OS X 10.4.2 from the original discs
- creating a new network location and adding certain DNS codes
- turning the computer and router on and of
The Imac is connected through Airport, as are a number of other computers on our home network. My own Macbook Pro runs on it perfectly.
I'm totally clueless, would like to help my dad on this 2nd christmas day.does not load images on others (bbc.com)
I'm not sure this has anything to do with it, but I find it curious anyway...
www.bbc.co.uk/212.58.253.68 is from United Kingdom(UK)
wwwimg.bbc.co.uk/212.58.253.67 is from United Kingdom(UK)
www.newsbbc.co.uk/195.198.203.66 is from Sweden(SE)
newsimg.bbc.co.uk/74.203.241.33 is from United States(US)
I'd open Network Utility, Ping tab, and ping each of those names or numbers & see if there's any Packet losses.
creating a new network location and adding certain DNS codes.
Are these the ones you tried?
208.67.222.222
208.67.220.220
Also, have you turned off IPv6 ?
Open Terminal & try this command...
Terminal commands to Flush DNS Cache Tiger to 10.5.1...
lookupd -flushcache
Last but not least, I think you should get Applejack...
http://www.versiontracker.com/dyn/moreinfo/macosx/19596
After installing, reboot holding down CMD+s, (+s), then when the DOS like prompt shows, type in...
applejack AUTO
Then let it do all 5 of it's things.
At least it'll eliminate some questions if it doesn't fix it.
The 5 things it does are...
Correct any Disk problems.
Repair Permissions.
Clear out Cache Files.
Repair/check several plist files.
Dump the VM files for a fresh start.
Maybe you are looking for
-
Nokia c5-03 problems!please help
hello everyone, please somebody can provide me some valuable suggestions for these problems i m having with my newly bought nokia c5-03, i will be gratefull 2 u all. prob 1:GPS is not working ,it always gives error "WAITING FOR GPS". prob 2:some game
-
I am trying to gain an understanding of how I would implement one of the new BADIs in ECC 6.0 (badis implmented through and enhancement spot , get badi, call badi concept). I am not looking for information on how to implement a classic badi through
-
New MacMini - connect to my beamer via miniDVI to DVI to Video ?!
Hi, i baught some days ago a new macmini and today after long discussions in an apple-shop adapters from miniDVI to DVI and DVI to Video (S-Video option) to connect it to my already installed beamer for DVD and SAT-Receiver BUT it does NOT work - no
-
On the back of each page of delivery note i have to print terms and conditions, I followed the below following steps: 1.Created 2 Pages FRONT and BACK. 2.Set page property of FRONT page as Duplex and next page as BACK. 3.Set page property of BACK
-
My Ipod touch has been stolen. The tracker shows it to be in a front garden of a road nearby. But it is not there. How accurate is the tracker deviceand should I report it to the police please?