Phantom DNS server

G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

Hi NG,

We have noticed that several of our PC's suddenly seem to lose their
ability to browse the net, connect to our Exchange server etc. Basic
troubleshooting showed that although the actual connectivity was
there, name resolution seemed to be causing the problem, i.e. we could
ping internally/externally by IP address but not by name.

Checking the IPCONFIG showed that these machines, which are all set to
DHCP, seemed to be picking up a phantom DNS server as opposed to the
correct one, e.g. 192.168.1.12 as opposed to 192.168.1.1

Rebooting the machines resolves the problem.

When we try to ping the phantom DNS server, we do not get a reply.
That address itself is excluded from our DHCP range and is not
currently being used, so i have no idea why these workstations are
picking this same address all the time.

Has anyone experienced this before, or have any pointers?? All other
settings in IPCONFIG are correct, and we have not made any changes to
our infrastructure/architecture recently.

Many TIA.

Regards
Dilan
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

In news:4df8d57a.0408260441.3946cd3a@posting.google.com,
Dilan Weerasinghe <dilanw77@hotmail.com> wrote their comments
Then Kevin replied below:
> Hi NG,
>
> We have noticed that several of our PC's suddenly seem to
> lose their ability to browse the net, connect to our
> Exchange server etc. Basic troubleshooting showed that
> although the actual connectivity was there, name
> resolution seemed to be causing the problem, i.e. we
> could ping internally/externally by IP address but not by
> name.
>
> Checking the IPCONFIG showed that these machines, which
> are all set to DHCP, seemed to be picking up a phantom
> DNS server as opposed to the correct one, e.g.
> 192.168.1.12 as opposed to 192.168.1.1
>
> Rebooting the machines resolves the problem.
>
> When we try to ping the phantom DNS server, we do not get
> a reply. That address itself is excluded from our DHCP
> range and is not currently being used, so i have no idea
> why these workstations are picking this same address all
> the time.
>
> Has anyone experienced this before, or have any
> pointers?? All other settings in IPCONFIG are correct,
> and we have not made any changes to our
> infrastructure/architecture recently.

It is possible for your clients to get the DNS address from a Group policy,
it would not show in the ipconfig /all but when running nslookup you will
get it.
You're saying that there is no machine at 192.168.1.12?
And that the DHCP server is publishing the address of the local DNS server
192.168.1.1 and not the IP of the router?
Are you using DHCP on the server or the router? (if you have a router)



--
Best regards,
Kevin D4 Dad Goodknecht Sr. [MVP]
Hope This Helps
================================================
--
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
================================================
http://www.lonestaramerica.com/
================================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
================================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
================================================
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

"Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in message news:<u7FbX92iEHA.2052@TK2MSFTNGP15.phx.gbl>...
> In news:4df8d57a.0408260441.3946cd3a@posting.google.com,
> Dilan Weerasinghe <dilanw77@hotmail.com> wrote their comments
> Then Kevin replied below:
> > Hi NG,
> >
> > We have noticed that several of our PC's suddenly seem to
> > lose their ability to browse the net, connect to our
> > Exchange server etc. Basic troubleshooting showed that
> > although the actual connectivity was there, name
> > resolution seemed to be causing the problem, i.e. we
> > could ping internally/externally by IP address but not by
> > name.
> >
> > Checking the IPCONFIG showed that these machines, which
> > are all set to DHCP, seemed to be picking up a phantom
> > DNS server as opposed to the correct one, e.g.
> > 192.168.1.12 as opposed to 192.168.1.1
> >
> > Rebooting the machines resolves the problem.
> >
> > When we try to ping the phantom DNS server, we do not get
> > a reply. That address itself is excluded from our DHCP
> > range and is not currently being used, so i have no idea
> > why these workstations are picking this same address all
> > the time.
> >
> > Has anyone experienced this before, or have any
> > pointers?? All other settings in IPCONFIG are correct,
> > and we have not made any changes to our
> > infrastructure/architecture recently.
>
> It is possible for your clients to get the DNS address from a Group policy,
> it would not show in the ipconfig /all but when running nslookup you will
> get it.
> You're saying that there is no machine at 192.168.1.12?
> And that the DHCP server is publishing the address of the local DNS server
> 192.168.1.1 and not the IP of the router?
> Are you using DHCP on the server or the router? (if you have a router)
>
>
>
Thanks for the reply.

No, there is no machine at all on 192.168.1.12, and the DHCP server is
configured correctly to give a DNS server address of 192.168.1.1.
We are using a DHCP server that has a different address altogether.

The strange thing is that this switch happens whilst a user is logged
on and has been for a while...not on machine start up or logon.

Any ideas?

Dilan
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

In news:4df8d57a.0408261146.354d51da@posting.google.com,
Dilan Weerasinghe <dilanw77@hotmail.com> made a post then I commented below
> "Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in
> message news:<u7FbX92iEHA.2052@TK2MSFTNGP15.phx.gbl>...
>> In news:4df8d57a.0408260441.3946cd3a@posting.google.com,
>> Dilan Weerasinghe <dilanw77@hotmail.com> wrote their comments
>> Then Kevin replied below:
>>> Hi NG,
>>>
>>> We have noticed that several of our PC's suddenly seem to
>>> lose their ability to browse the net, connect to our
>>> Exchange server etc. Basic troubleshooting showed that
>>> although the actual connectivity was there, name
>>> resolution seemed to be causing the problem, i.e. we
>>> could ping internally/externally by IP address but not by
>>> name.
>>>
>>> Checking the IPCONFIG showed that these machines, which
>>> are all set to DHCP, seemed to be picking up a phantom
>>> DNS server as opposed to the correct one, e.g.
>>> 192.168.1.12 as opposed to 192.168.1.1
>>>
>>> Rebooting the machines resolves the problem.
>>>
>>> When we try to ping the phantom DNS server, we do not get
>>> a reply. That address itself is excluded from our DHCP
>>> range and is not currently being used, so i have no idea
>>> why these workstations are picking this same address all
>>> the time.
>>>
>>> Has anyone experienced this before, or have any
>>> pointers?? All other settings in IPCONFIG are correct,
>>> and we have not made any changes to our
>>> infrastructure/architecture recently.
>>
>> It is possible for your clients to get the DNS address from a Group
>> policy, it would not show in the ipconfig /all but when running
>> nslookup you will get it.
>> You're saying that there is no machine at 192.168.1.12?
>> And that the DHCP server is publishing the address of the local DNS
>> server 192.168.1.1 and not the IP of the router?
>> Are you using DHCP on the server or the router? (if you have a
>> router)
>>
>>
>>
> Thanks for the reply.
>
> No, there is no machine at all on 192.168.1.12, and the DHCP server is
> configured correctly to give a DNS server address of 192.168.1.1.
> We are using a DHCP server that has a different address altogether.
>
> The strange thing is that this switch happens whilst a user is logged
> on and has been for a while...not on machine start up or logon.
>
> Any ideas?
>
> Dilan

I think we're going to need more info to help you out on this one.

Is 192.168.1.1 your router? If it is, is it a Windows machine or a 3rd party
router?

If you disable DHCP on the 192.168.1.1 machine, and then do an ipconfig
/release and then an ipconfig /renew, what DHCP server shows up in the
ipconfig /all?

Honestly, if 192.168.1.1 is not a Windows machine, it would be to your
advantage, and to AD and DNS' advantage, to use a Windows machine for DHCP
and DNS, since the two services and APIs are tied together for proper
dynamic registration performance and reliability.

If this is a Windows DHCP, did you set the Scope Option 006 and Server
Option 006?

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.
--
=================================
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

"Ace Fekay [MVP]" <PleaseSubstituteMyActualFirstName&LastNameHere@hotmail.com> wrote in message news:<OJwdojDjEHA.3712@TK2MSFTNGP15.phx.gbl>...
> In news:4df8d57a.0408261146.354d51da@posting.google.com,
> Dilan Weerasinghe <dilanw77@hotmail.com> made a post then I commented below
> > "Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in
> > message news:<u7FbX92iEHA.2052@TK2MSFTNGP15.phx.gbl>...
> >> In news:4df8d57a.0408260441.3946cd3a@posting.google.com,
> >> Dilan Weerasinghe <dilanw77@hotmail.com> wrote their comments
> >> Then Kevin replied below:
> >>> Hi NG,
> >>>
> >>> We have noticed that several of our PC's suddenly seem to
> >>> lose their ability to browse the net, connect to our
> >>> Exchange server etc. Basic troubleshooting showed that
> >>> although the actual connectivity was there, name
> >>> resolution seemed to be causing the problem, i.e. we
> >>> could ping internally/externally by IP address but not by
> >>> name.
> >>>
> >>> Checking the IPCONFIG showed that these machines, which
> >>> are all set to DHCP, seemed to be picking up a phantom
> >>> DNS server as opposed to the correct one, e.g.
> >>> 192.168.1.12 as opposed to 192.168.1.1
> >>>
> >>> Rebooting the machines resolves the problem.
> >>>
> >>> When we try to ping the phantom DNS server, we do not get
> >>> a reply. That address itself is excluded from our DHCP
> >>> range and is not currently being used, so i have no idea
> >>> why these workstations are picking this same address all
> >>> the time.
> >>>
> >>> Has anyone experienced this before, or have any
> >>> pointers?? All other settings in IPCONFIG are correct,
> >>> and we have not made any changes to our
> >>> infrastructure/architecture recently.
> >>
> >> It is possible for your clients to get the DNS address from a Group
> >> policy, it would not show in the ipconfig /all but when running
> >> nslookup you will get it.
> >> You're saying that there is no machine at 192.168.1.12?
> >> And that the DHCP server is publishing the address of the local DNS
> >> server 192.168.1.1 and not the IP of the router?
> >> Are you using DHCP on the server or the router? (if you have a
> >> router)
> >>
> >>
> >>
> > Thanks for the reply.
> >
> > No, there is no machine at all on 192.168.1.12, and the DHCP server is
> > configured correctly to give a DNS server address of 192.168.1.1.
> > We are using a DHCP server that has a different address altogether.
> >
> > The strange thing is that this switch happens whilst a user is logged
> > on and has been for a while...not on machine start up or logon.
> >
> > Any ideas?
> >
> > Dilan
>
> I think we're going to need more info to help you out on this one.
>
> Is 192.168.1.1 your router? If it is, is it a Windows machine or a 3rd party
> router?
>
> If you disable DHCP on the 192.168.1.1 machine, and then do an ipconfig
> /release and then an ipconfig /renew, what DHCP server shows up in the
> ipconfig /all?
>
> Honestly, if 192.168.1.1 is not a Windows machine, it would be to your
> advantage, and to AD and DNS' advantage, to use a Windows machine for DHCP
> and DNS, since the two services and APIs are tied together for proper
> dynamic registration performance and reliability.
>
> If this is a Windows DHCP, did you set the Scope Option 006 and Server
> Option 006?
>
> --
> Regards,
> Ace
>
> Please direct all replies ONLY to the Microsoft public newsgroups
> so all can benefit.
>
> This posting is provided "AS-IS" with no warranties or guarantees
> and confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
> Microsoft Windows MVP - Windows Server - Directory Services
>
> Security Is Like An Onion, It Has Layers
> HAM AND EGGS: A day's work for a chicken;
> A lifetime commitment for a pig.

Ace,

To clarify;

Our network is configured as following -

DHCP server: 192.168.1.1
DNS Servers: 192.168.1.1/ 192.168.1.2

(All above addresses are static)

All workstations are set to DHCP, and I've checked the scope options
on the DHCP server itself as regards DNS, and it points to the correct
addresses.

Our router is on a completely different address.

The problem is that, randomly, users seem to lose their internet
connection. As I mentioned before, the actual connectivity is there
but the fault lies with name resolution as we can ping
externally/internally by IP address but not by name. Checking the
IPCONFIG shows that the faulty machines are picking up 192.168.1.10 as
their DNS server, although all other settings are correct.
Rebooting the machines solves the problem until it happens again.
I understand that we could set the workstations to statically point at
the correct DNS servers, however this is a workaround, not a solution
and I'd like to find out what's causing this.
The faulty machines always pick up x.10 as the DNS server.
x.10 itself is excluded from our DHCP range for distribution, and is
also not currently being used, so I have no idea why they are picking
this address up as a DNS server.

Many thanks for your help
Dilan
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

In news:4df8d57a.0408310134.1f869ca7@posting.google.com,
Dilan Weerasinghe <dilanw77@hotmail.com> wrote their comments
Then Kevin replied below:
> "Ace Fekay [MVP]"
> <PleaseSubstituteMyActualFirstName&LastNameHere@hotmail.com>
> wrote in message
> news:<OJwdojDjEHA.3712@TK2MSFTNGP15.phx.gbl>...
>> In news:4df8d57a.0408261146.354d51da@posting.google.com,
>> Dilan Weerasinghe <dilanw77@hotmail.com> made a post
>> then I commented below
>>> "Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US>
>>> wrote in message
>>> news:<u7FbX92iEHA.2052@TK2MSFTNGP15.phx.gbl>...
>>>> In
>>>> news:4df8d57a.0408260441.3946cd3a@posting.google.com,
>>>> Dilan Weerasinghe <dilanw77@hotmail.com> wrote their
>>>> comments
>>>> Then Kevin replied below:
>>>>> Hi NG,
>>>>>
>>>>> We have noticed that several of our PC's suddenly
>>>>> seem to lose their ability to browse the net, connect
>>>>> to our Exchange server etc. Basic troubleshooting
>>>>> showed that although the actual connectivity was
>>>>> there, name resolution seemed to be causing the
>>>>> problem, i.e. we could ping internally/externally by
>>>>> IP address but not by name.
>>>>>
>>>>> Checking the IPCONFIG showed that these machines,
>>>>> which are all set to DHCP, seemed to be picking up a
>>>>> phantom DNS server as opposed to the correct one, e.g.
>>>>> 192.168.1.12 as opposed to 192.168.1.1
>>>>>
>>>>> Rebooting the machines resolves the problem.
>>>>>
>>>>> When we try to ping the phantom DNS server, we do not
>>>>> get a reply. That address itself is excluded from our
>>>>> DHCP range and is not currently being used, so i have
>>>>> no idea why these workstations are picking this same
>>>>> address all the time.
>>>>>
>>>>> Has anyone experienced this before, or have any
>>>>> pointers?? All other settings in IPCONFIG are correct,
>>>>> and we have not made any changes to our
>>>>> infrastructure/architecture recently.
>>>>
>>>> It is possible for your clients to get the DNS address
>>>> from a Group policy, it would not show in the ipconfig
>>>> /all but when running nslookup you will get it.
>>>> You're saying that there is no machine at 192.168.1.12?
>>>> And that the DHCP server is publishing the address of
>>>> the local DNS server 192.168.1.1 and not the IP of the
>>>> router?
>>>> Are you using DHCP on the server or the router? (if
>>>> you have a router)
>>>>
>>>>
>>>>
>>> Thanks for the reply.
>>>
>>> No, there is no machine at all on 192.168.1.12, and the
>>> DHCP server is configured correctly to give a DNS
>>> server address of 192.168.1.1.
>>> We are using a DHCP server that has a different address
>>> altogether.
>>>
>>> The strange thing is that this switch happens whilst a
>>> user is logged on and has been for a while...not on
>>> machine start up or logon.
>>>
>>> Any ideas?
>>>
>>> Dilan
>>
>> I think we're going to need more info to help you out on
>> this one.
>>
>> Is 192.168.1.1 your router? If it is, is it a Windows
>> machine or a 3rd party router?
>>
>> If you disable DHCP on the 192.168.1.1 machine, and then
>> do an ipconfig /release and then an ipconfig /renew,
>> what DHCP server shows up in the ipconfig /all?
>>
>> Honestly, if 192.168.1.1 is not a Windows machine, it
>> would be to your advantage, and to AD and DNS'
>> advantage, to use a Windows machine for DHCP and DNS,
>> since the two services and APIs are tied together for
>> proper dynamic registration performance and reliability.
>>
>> If this is a Windows DHCP, did you set the Scope Option
>> 006 and Server Option 006?
>>
>> --
>> Regards,
>> Ace
>>
>> Please direct all replies ONLY to the Microsoft public
>> newsgroups
>> so all can benefit.
>>
>> This posting is provided "AS-IS" with no warranties or
>> guarantees
>> and confers no rights.
>>
>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I,
>> MCT, MVP
>> Microsoft Windows MVP - Windows Server - Directory
>> Services
>>
>> Security Is Like An Onion, It Has Layers
>> HAM AND EGGS: A day's work for a chicken;
>> A lifetime commitment for a pig.
>
> Ace,
>
> To clarify;
>
> Our network is configured as following -
>
> DHCP server: 192.168.1.1
> DNS Servers: 192.168.1.1/ 192.168.1.2
>
> (All above addresses are static)
>
> All workstations are set to DHCP, and I've checked the
> scope options
> on the DHCP server itself as regards DNS, and it points
> to the correct
> addresses.
>
> Our router is on a completely different address.
>
> The problem is that, randomly, users seem to lose their
> internet
> connection. As I mentioned before, the actual
> connectivity is there
> but the fault lies with name resolution as we can ping
> externally/internally by IP address but not by name.
> Checking the
> IPCONFIG shows that the faulty machines are picking up
> 192.168.1.10 as
> their DNS server, although all other settings are correct.
> Rebooting the machines solves the problem until it
> happens again.
> I understand that we could set the workstations to
> statically point at
> the correct DNS servers, however this is a workaround,
> not a solution
> and I'd like to find out what's causing this.
> The faulty machines always pick up x.10 as the DNS server.
> x.10 itself is excluded from our DHCP range for
> distribution, and is
> also not currently being used, so I have no idea why they
> are picking
> this address up as a DNS server.
>
> Many thanks for your help
> Dilan

On the ipconfig for the machines with the bogus DNS address, what IP do they
show for the DHCP server?

--
Best regards,
Kevin D4 Dad Goodknecht Sr. [MVP]
Hope This Helps
================================================
--
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
================================================
http://www.lonestaramerica.com/
================================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
================================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
================================================
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

In news:%231uHXD2jEHA.1764@TK2MSFTNGP10.phx.gbl,
Kevin D. Goodknecht Sr. [MVP] <admin@nospam.WFTX.US> made a post then I
commented below
>
> On the ipconfig for the machines with the bogus DNS address, what IP
> do they show for the DHCP server?
>

Curious about that as well, when he gets the bogus DNS address.

Ace
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

"Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in message news:<#1uHXD2jEHA.1764@TK2MSFTNGP10.phx.gbl>...
<snip>
> > Ace,
> >
> > To clarify;
> >
> > Our network is configured as following -
> >
> > DHCP server: 192.168.1.1
> > DNS Servers: 192.168.1.1/ 192.168.1.2
> >
> > (All above addresses are static)
> >
> > All workstations are set to DHCP, and I've checked the
> > scope options
> > on the DHCP server itself as regards DNS, and it points
> > to the correct
> > addresses.
> >
> > Our router is on a completely different address.
> >
> > The problem is that, randomly, users seem to lose their
> > internet
> > connection. As I mentioned before, the actual
> > connectivity is there
> > but the fault lies with name resolution as we can ping
> > externally/internally by IP address but not by name.
> > Checking the
> > IPCONFIG shows that the faulty machines are picking up
> > 192.168.1.10 as
> > their DNS server, although all other settings are correct.
> > Rebooting the machines solves the problem until it
> > happens again.
> > I understand that we could set the workstations to
> > statically point at
> > the correct DNS servers, however this is a workaround,
> > not a solution
> > and I'd like to find out what's causing this.
> > The faulty machines always pick up x.10 as the DNS server.
> > x.10 itself is excluded from our DHCP range for
> > distribution, and is
> > also not currently being used, so I have no idea why they
> > are picking
> > this address up as a DNS server.
> >
> > Many thanks for your help
> > Dilan
>
> On the ipconfig for the machines with the bogus DNS address, what IP do they
> show for the DHCP server?
>
> --
> Best regards,
> Kevin D4 Dad Goodknecht Sr. [MVP]
> Hope This Helps
> ================================================
> --
> When responding to posts, please "Reply to Group"
> via your newsreader so that others may learn and
> benefit from your issue, to respond directly to
> me remove the nospam. from my email address.
> ================================================
> http://www.lonestaramerica.com/
> ================================================
> Use Outlook Express?... Get OE_Quotefix:
> It will strip signature out and more
> http://home.in.tum.de/~jain/software/oe-quotefix/
> ================================================
> Keep a back up of your OE settings and folders
> with OEBackup:
> http://www.oehelp.com/OEBackup/Default.aspx
> ================================================

Kevin,

They show the correct DHCP server (192.168.1.1). Would it have been
different, I would have assumed we had some sort of rogue DHCP machine
on the network giving out wrong DNS server info, but in all cases the
faulty machines are using the correct DHCP server.

Thanks
Dilan
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

In news:4df8d57a.0409010322.54ea37fb@posting.google.com,
Dilan Weerasinghe <dilanw77@hotmail.com> wrote their comments
Then Kevin replied below:

> Kevin,
>
> They show the correct DHCP server (192.168.1.1). Would it
> have been
> different, I would have assumed we had some sort of rogue
> DHCP machine
> on the network giving out wrong DNS server info, but in
> all cases the
> faulty machines are using the correct DHCP server.

It has to be getting it from DHCP, a GPO and/or the registry.



--
Best regards,
Kevin D4 Dad Goodknecht Sr. [MVP]
Hope This Helps
================================================
--
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
================================================
http://www.lonestaramerica.com/
================================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
================================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
================================================
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

In news:4df8d57a.0409010322.54ea37fb@posting.google.com,
Dilan Weerasinghe <dilanw77@hotmail.com> made a post then I commented below
> "Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in
> message news:<#1uHXD2jEHA.1764@TK2MSFTNGP10.phx.gbl>... <snip>
>>> Ace,
>>>
>>> To clarify;
>>>
>>> Our network is configured as following -
>>>
>>> DHCP server: 192.168.1.1
>>> DNS Servers: 192.168.1.1/ 192.168.1.2
>>>
>>> (All above addresses are static)
>>>
>>> All workstations are set to DHCP, and I've checked the
>>> scope options
>>> on the DHCP server itself as regards DNS, and it points
>>> to the correct
>>> addresses.
>>>
>>> Our router is on a completely different address.
>>>
>>> The problem is that, randomly, users seem to lose their
>>> internet
>>> connection. As I mentioned before, the actual
>>> connectivity is there
>>> but the fault lies with name resolution as we can ping
>>> externally/internally by IP address but not by name.
>>> Checking the
>>> IPCONFIG shows that the faulty machines are picking up
>>> 192.168.1.10 as
>>> their DNS server, although all other settings are correct.
>>> Rebooting the machines solves the problem until it
>>> happens again.
>>> I understand that we could set the workstations to
>>> statically point at
>>> the correct DNS servers, however this is a workaround,
>>> not a solution
>>> and I'd like to find out what's causing this.
>>> The faulty machines always pick up x.10 as the DNS server.
>>> x.10 itself is excluded from our DHCP range for
>>> distribution, and is
>>> also not currently being used, so I have no idea why they
>>> are picking
>>> this address up as a DNS server.
>>>
>>> Many thanks for your help
>>> Dilan
>>
>> On the ipconfig for the machines with the bogus DNS address, what IP
>> do they show for the DHCP server?
>>
>> --
>> Best regards,
>> Kevin D4 Dad Goodknecht Sr. [MVP]
>> Hope This Helps
>> ================================================
>> --
>> When responding to posts, please "Reply to Group"
>> via your newsreader so that others may learn and
>> benefit from your issue, to respond directly to
>> me remove the nospam. from my email address.
>> ================================================
>> http://www.lonestaramerica.com/
>> ================================================
>> Use Outlook Express?... Get OE_Quotefix:
>> It will strip signature out and more
>> http://home.in.tum.de/~jain/software/oe-quotefix/
>> ================================================
>> Keep a back up of your OE settings and folders
>> with OEBackup:
>> http://www.oehelp.com/OEBackup/Default.aspx
>> ================================================
>
> Kevin,
>
> They show the correct DHCP server (192.168.1.1). Would it have been
> different, I would have assumed we had some sort of rogue DHCP machine
> on the network giving out wrong DNS server info, but in all cases the
> faulty machines are using the correct DHCP server.
>
> Thanks
> Dilan

One question, are you using a DHCP Relay agent ?

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.
--
=================================
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

"Ace Fekay [MVP]" <PleaseSubstituteMyActualFirstName&LastNameHere@hotmail.com> wrote in message news:<uL069OHkEHA.1764@TK2MSFTNGP10.phx.gbl>...
> In news:4df8d57a.0409010322.54ea37fb@posting.google.com,
> Dilan Weerasinghe <dilanw77@hotmail.com> made a post then I commented below
> > "Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in
> > message news:<#1uHXD2jEHA.1764@TK2MSFTNGP10.phx.gbl>... <snip>
>
> One question, are you using a DHCP Relay agent ?
>
> --
> Regards,
> Ace
>
> Please direct all replies ONLY to the Microsoft public newsgroups
> so all can benefit.
>
> This posting is provided "AS-IS" with no warranties or guarantees
> and confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
> Microsoft Windows MVP - Windows Server - Directory Services
>
> Security Is Like An Onion, It Has Layers
> HAM AND EGGS: A day's work for a chicken;
> A lifetime commitment for a pig.

Ace,

No, we aren't.

Regards
Dilan
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

In news:4df8d57a.0409031114.68b0f0fb@posting.google.com,
Dilan Weerasinghe <dilanw77@hotmail.com> made a post then I commented below
>>
>> One question, are you using a DHCP Relay agent ?
>>
>
> Ace,
>
> No, we aren't.
>
> Regards
> Dilan

Ok, I've seen this before with Relay Agents. Just to recap, there are no
errors in any machines' Event logs? It is strange that the Options are not
coming across. And you do not have any GPOs that would be overriding this or
registry entries in a GPO or the machine? Is there a VPN on the client? Or a
PPPoE connection or anything else? Personal firewall possibly?

Ace
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

"Ace Fekay [MVP]" <PleaseSubstituteMyActualFirstName&LastNameHere@hotmail.com> wrote in message news:<#eQMz7ekEHA.2668@TK2MSFTNGP12.phx.gbl>...
> In news:4df8d57a.0409031114.68b0f0fb@posting.google.com,
> Dilan Weerasinghe <dilanw77@hotmail.com> made a post then I commented below
> >>
> >> One question, are you using a DHCP Relay agent ?
> >>
> >
> > Ace,
> >
> > No, we aren't.
> >
> > Regards
> > Dilan
>
> Ok, I've seen this before with Relay Agents. Just to recap, there are no
> errors in any machines' Event logs? It is strange that the Options are not
> coming across. And you do not have any GPOs that would be overriding this or
> registry entries in a GPO or the machine? Is there a VPN on the client? Or a
> PPPoE connection or anything else? Personal firewall possibly?
>
> Ace


Ace,

We've checked the event logs of the machines and, although there are
entries, these all relate to events that occur as a result of the
inablity to resolve names. We don't have any GPO's that relate to DNS
settings, nor any of the other things you've mentioned.

Something that was brought up, however, was that the problems
initially started to occur around the a third party came in to carry
out some work on one of our Cisco routers. We're checking this now, as
I'm led to believe that Cisco routers can also give out information
regarding DNS servers.

Whilst it was only one or two machines that picked up this incorrect
setting around the time of the router change, it has somehow spread to
the entire subnet, and we've had to manually configure our local DNS
servers into the TCP/IP properties of all our workstations.

I'll let you know how we get on...

Thanks for the continuing support - much appreciated
Dilan
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.dns (More info?)

In news:4df8d57a.0409081212.7c653d3c@posting.google.com,
Dilan Weerasinghe <dilanw77@hotmail.com> made a post then I commented below
> Ace,
>
> We've checked the event logs of the machines and, although there are
> entries, these all relate to events that occur as a result of the
> inablity to resolve names. We don't have any GPO's that relate to DNS
> settings, nor any of the other things you've mentioned.
>
> Something that was brought up, however, was that the problems
> initially started to occur around the a third party came in to carry
> out some work on one of our Cisco routers. We're checking this now, as
> I'm led to believe that Cisco routers can also give out information
> regarding DNS servers.
>
> Whilst it was only one or two machines that picked up this incorrect
> setting around the time of the router change, it has somehow spread to
> the entire subnet, and we've had to manually configure our local DNS
> servers into the TCP/IP properties of all our workstations.
>
> I'll let you know how we get on...
>
> Thanks for the continuing support - much appreciated
> Dilan

Thanks for the update. Curious what you find out.

Ace