Can't change DNS server from 127.0.0.2 to anything else

Status
Not open for further replies.
Feb 27, 2018
2
0
10
Multiple times per week, my router requires a reboot for some of my devices to access the internet. It happens more times that I would like, so I went about trying to find the issue. Most of the time, the troubleshooting specifies a DNS failure.

When I went to investigate on my PC about its DNS settings, I found that it was set to 127.0.0.2. I know this to be a loopback address, but it wasn't preventing me from accessing the internet. Anytime I try to set it to "automatic DNS" or specify a different DNS server, such as Google's 8.8.8.8, it would have trouble connecting until the DNS server switched to 127.0.0.2 on its own.

In other threads here, and in other places on the internet, I was seeing people describe a similar issue but without internet access. Solutions revolved around malware, so I did several customized, full scans of my PC and did not find any malware. I am not interested in trying to update my motherboard drivers, as nothing seems to actually be broken.

When I did a Wireshark capture of some internet traffic, and I filtered by DNS protocol, my PC seems to be contacting Google's DNS server 8.8.8.8 even though it is listing 127.0.0.2 in the IPv4 preferences of my network adapter. Ultimately, I'm fine with it working, I just want to try to understand how/why it works, and potentially cut down the number of times I have to restart my router!

Has anyone else run into this before? Why would my PC display a DNS server of the loopback address 127.0.0.2, but actually be using DNS server 8.8.8.8?

---------------------------------------------
EDIT: Just FYI, I am using automatic DHCP configuration, but with some DHCP reservations. I don't have any static DNS servers set on my router. Also, I haven't done the DNS check posted in one of the sticky posts yet, but I'll be doing that as soon as I get the chance.

---------------------------------------------
EDIT 2: I ran the DNS Benchmark program from the sticky post. It noticed that there was only one nameserver accessible by my PC - that is the one with the IP address of 127.0.0.2. Obviously, since its a loopback address, the Benchmark program identified it as a nameserver that was on my local network. The thing is: I don't know about any nameserver on my local network. How would I go about finding a nameserver on my local network (just me in my apartment) that I don't know about?
 
Solution
Having a name / DNS server running on your PC without your knowledge means - you know what. Something has installed (bogus) name server on your PC, and forwarding DNS queries to your existing DNS server (and somewhere else).

From elevated command prompt, execute "netstat -b -q -n ", and see what executable is listening on the 127.0.0.2, port 53. Use Microsoft' AutoRuns utility to see whats get started.
Having a name / DNS server running on your PC without your knowledge means - you know what. Something has installed (bogus) name server on your PC, and forwarding DNS queries to your existing DNS server (and somewhere else).

From elevated command prompt, execute "netstat -b -q -n ", and see what executable is listening on the 127.0.0.2, port 53. Use Microsoft' AutoRuns utility to see whats get started.
 
  • Like
Reactions: AbangBlues
Solution
Feb 27, 2018
2
0
10


You got it! Thanks for the help. Running that command showed me the remnants of a program from years ago that used to monitor web traffic. I guess not all the files got uninstalled.
 
Status
Not open for further replies.