2006-09-02 weird DNS problem - Revision history

Woozle: catg: tech notes

2007-04-17T00:50:04Z

catg: tech notes

← Older revision		Revision as of 00:50, 17 April 2007
Line 1:		Line 1:
	[[category:dated items]][[category:hypertwins network]]		[[category:dated items]][[category:hypertwins network]][[category:tech notes]]
	==Original Problem==		==Original Problem==
	I can't tell if this means I'm being hacked somehow or if it's just a network glitch at [[EarthLink]], but at essentially random times Samba will start returning weird IP addresses for local machines on the network. The addresses are consistently within a particular range, though the exact assignments seem to change.		I can't tell if this means I'm being hacked somehow or if it's just a network glitch at [[EarthLink]], but at essentially random times Samba will start returning weird IP addresses for local machines on the network. The addresses are consistently within a particular range, though the exact assignments seem to change.

Woozle: cat

2006-09-30T13:10:03Z

cat

← Older revision		Revision as of 13:10, 30 September 2006
Line 1:		Line 1:
	[[category:dated items]]		[[category:dated items]][[category:hypertwins network]]
	==Original Problem==		==Original Problem==
	I can't tell if this means I'm being hacked somehow or if it's just a network glitch at [[EarthLink]], but at essentially random times Samba will start returning weird IP addresses for local machines on the network. The addresses are consistently within a particular range, though the exact assignments seem to change.		I can't tell if this means I'm being hacked somehow or if it's just a network glitch at [[EarthLink]], but at essentially random times Samba will start returning weird IP addresses for local machines on the network. The addresses are consistently within a particular range, though the exact assignments seem to change.

Woozle: /* 2006-09-10 Resolution */ 9/24 more weirdness

2006-09-24T13:35:07Z

2006-09-10 Resolution: 9/24 more weirdness

← Older revision		Revision as of 13:35, 24 September 2006
Line 219:		Line 219:

	We have turned off the DLink router's DHCP and are now using [[dnsmasq]], using non-[[EarthLink]] upstream DNS servers ([[Xmission]] and IODynamics (Tenebram's employer)). Tene also made a number of other little tweaks, including one which now resolves NetBIOS names as effectively as regular Internet domain names, so (e.g.) I can now "ping bunsen".		We have turned off the DLink router's DHCP and are now using [[dnsmasq]], using non-[[EarthLink]] upstream DNS servers ([[Xmission]] and IODynamics (Tenebram's employer)). Tene also made a number of other little tweaks, including one which now resolves NetBIOS names as effectively as regular Internet domain names, so (e.g.) I can now "ping bunsen".
			==2006-09-24 related problem?==
			For some reason, beaker suddenly wasn't picking up DHCP from Gonzo; dnsmasq (on Gonzo) might have gotten turned off accidentally when I restarted Samba, and that may have gotten Beaker all confused. ipconfig/renew_all didn't work; it actually reported that no DHCP server was found and reverted to using the hardware router (192.168.0.1) for DNS, rather than coming up with an autoconfig IP address (I checked, and the router's DHCP was still turned off, so I don't know how it worked that one out).

			What eventually worked was:
			* ipconfig/release_all on Beaker
			* shut down Beaker
			* wait 5 seconds, then press Beaker's power button to turn him back on
			The network started appearing normally after that. ipconfig/all confirms that Gonzo (192.168.0.254) is now the DHCP server.

Woozle: /* 2006-09-10 Resolution */ Earthlink -> EarthLink

2006-09-10T23:10:50Z

2006-09-10 Resolution: Earthlink -> EarthLink

← Older revision		Revision as of 23:10, 10 September 2006
Line 216:		Line 216:
	*::209.86.66.94		*::209.86.66.94
	==2006-09-10 Resolution==		==2006-09-10 Resolution==
	The problem appears to have been caused in large part by [[~~Earthlink~~]]'s new "dead domain handling" scheme, possibly exacerbated by my [[DLink]] DI-604's sloppy handling of NetBIOS names, which in turn may have been exacerbated by a recent firmware upgrade I did to it (although that ''should'' have ''improved'' things, of course).		The problem appears to have been caused in large part by [[EarthLink]]'s new "dead domain handling" scheme, possibly exacerbated by my [[DLink]] DI-604's sloppy handling of NetBIOS names, which in turn may have been exacerbated by a recent firmware upgrade I did to it (although that ''should'' have ''improved'' things, of course).

	We have turned off the DLink router's DHCP and are now using [[dnsmasq]], using non-[[~~Earthlink~~]] upstream DNS servers ([[Xmission]] and IODynamics (Tenebram's employer)). Tene also made a number of other little tweaks, including one which now resolves NetBIOS names as effectively as regular Internet domain names, so (e.g.) I can now "ping bunsen".		We have turned off the DLink router's DHCP and are now using [[dnsmasq]], using non-[[EarthLink]] upstream DNS servers ([[Xmission]] and IODynamics (Tenebram's employer)). Tene also made a number of other little tweaks, including one which now resolves NetBIOS names as effectively as regular Internet domain names, so (e.g.) I can now "ping bunsen".

Woozle: /* Original Problem */ earthlink link

2006-09-10T23:10:03Z

Original Problem: earthlink link

← Older revision		Revision as of 23:10, 10 September 2006
Line 1:		Line 1:
	[[category:dated items]]		[[category:dated items]]
	==Original Problem==		==Original Problem==
	I can't tell if this means I'm being hacked somehow or if it's just a network glitch at ~~Earthlink~~, but at essentially random times Samba will start returning weird IP addresses for local machines on the network. The addresses are consistently within a particular range, though the exact assignments seem to change.		I can't tell if this means I'm being hacked somehow or if it's just a network glitch at [[EarthLink]], but at essentially random times Samba will start returning weird IP addresses for local machines on the network. The addresses are consistently within a particular range, though the exact assignments seem to change.

	My main worry is that this means my network traffic is being routed via some hacker's machine (which would be consistent with some odd delays and errors loading web pages) which might then allow passwords and such to be picked up.		My main worry is that this means my network traffic is being routed via some hacker's machine (which would be consistent with some odd delays and errors loading web pages) which might then allow passwords and such to be picked up.
Line 73:		Line 73:
	* '''209.86.66.91''': elydm.02.am.barefruit.com		* '''209.86.66.91''': elydm.02.am.barefruit.com
	* '''209.86.66.92''': elydm.03.am.barefruit.com		* '''209.86.66.92''': elydm.03.am.barefruit.com

	==2006-09-04 More information==		==2006-09-04 More information==
	C:\WINDOWS>tracert floyd		C:\WINDOWS>tracert floyd

Woozle: /* 2006-09-09 analysis */ resolution

2006-09-10T22:38:13Z

2006-09-09 analysis: resolution

← Older revision		Revision as of 22:38, 10 September 2006
Line 214:		Line 214:
	*:woozle@gonzo:~$ net lookup mokey		*:woozle@gonzo:~$ net lookup mokey
	*::209.86.66.94		*::209.86.66.94
			==2006-09-10 Resolution==
			The problem appears to have been caused in large part by [[Earthlink]]'s new "dead domain handling" scheme, possibly exacerbated by my [[DLink]] DI-604's sloppy handling of NetBIOS names, which in turn may have been exacerbated by a recent firmware upgrade I did to it (although that ''should'' have ''improved'' things, of course).

			We have turned off the DLink router's DHCP and are now using [[dnsmasq]], using non-[[Earthlink]] upstream DNS servers ([[Xmission]] and IODynamics (Tenebram's employer)). Tene also made a number of other little tweaks, including one which now resolves NetBIOS names as effectively as regular Internet domain names, so (e.g.) I can now "ping bunsen".

Woozle: /* 2006-09-08 More logs */ a lot of analysis

2006-09-09T16:54:45Z

2006-09-08 More logs: a lot of analysis

← Older revision		Revision as of 16:54, 9 September 2006
Line 171:		Line 171:

	Next: how to verify that this is happening because of the router, and then how to make it stop.		Next: how to verify that this is happening because of the router, and then how to make it stop.
			==2006-09-09 analysis==
			* DHCP seems to be fetching any locally-unresolved addresses (i.e. addresses which the router can't resolve) from Earthlink's servers.
			* '''Query''': why are they unresolved? Check to see what addresses those actual machines think they have.
			** '''Answer''': ifconfig on Bunsen reveals correct IP (192.168.0.106) even though "net lookup bunsen" on gonzo returns 209.86.66.94
			** '''Note''': DHCP listing on router has 192.168.0.106 listed as "unknown"...
			** '''Therefore''': seems likely router is not recognizing the name "bunsen", and replies that it does not know bunsen's address
			* '''Query''': why isn't the router receiving Bunsen's name in the DHCP request? Or, if it is receiving it, why isn't it storing it?
			** '''Subquery''': how can I tell if Bunsen is correctly transmitting its name when it does a DHCP?
			* '''Flaw in theory''': router's DHCP list shows 192.168.0.105 for Mokey, but "net lookup mokey" returns 209.86.66.92 on bunsen and 209.86.66.94 on gonzo. (Refreshed view of router's DHCP list just to be sure; no apparent changes.) At the moment, these addresses are being persistent.
			** '''Query''': how to get a debug/trace log of "net lookup"'s activity? Do we have to use ethereal?
			** '''Answer''': no. "net -d 2 lookup <u>machinename</u>" returns more info:
			*:woozle@gonzo:~$ '''net -d 2 lookup mokey'''
			*::[2006/09/09 10:27:45, 2] lib/interface.c:add_interface(81)
			*:::added interface ip=192.168.0.103 bcast=192.168.0.255 nmask=255.255.255.0
			*::[2006/09/09 10:27:45, 2] libsmb/namequery.c:name_query(492)
			*:::Got a positive name query response from 127.0.0.1 ( 209.86.66.94 )
			*::209.86.66.94
			*::[2006/09/09 10:27:45, 2] utils/net.c:main(878)
			*:::return code = 0
			** '''More''': a net lookup on bunsen was less illuminating at first; I had to go up to -d 5 before I got this bit at the end:
			*::Netbios name list:-
			*::my_netbios_names[0]="BUNSEN"
			*:[2006/09/09 10:31:13, 2] lib/interface.c:add_interface(81)
			*::added interface ip=192.168.0.106 bcast=192.168.0.255 nmask=255.255.255.0
			*:[2006/09/09 10:31:13, 5] lib/gencache.c:gencache_init(60)
			*::Opening cache file at /var/cache/samba/gencache.tdb
			*:[2006/09/09 10:31:13, 5] libsmb/namecache.c:namecache_fetch(201)
			*::name mokey#20 found.
			*:209.86.66.92
			*:[2006/09/09 10:31:13, 2] utils/net.c:main(988)
			*::return code = 0
			** '''It looks like''' the incorrect address for Mokey has been cached (in "my_netbios_names" in Bunsen). '''Query''': how to clear/refresh the cache?
			** '''Discovery''': {{manpagelink\|nmblookup}} <u>machinename</u> apparently refreshes the cache some of the time. (It also will return a non-127.0.0 address for the localhost.) However, it doesn't seem to be solving the problem on gonzo:
			*:woozle@gonzo:~$ nmblookup mokey
			*::querying mokey on 192.168.0.255
			*::192.168.0.105 mokey<00>
			*:woozle@gonzo:~$ net lookup mokey
			*::209.86.66.94
			*:woozle@gonzo:~$ nmblookup mokey
			*::querying mokey on 192.168.0.255
			*::192.168.0.105 mokey<00>
			*:woozle@gonzo:~$ net lookup mokey
			*::209.86.66.94

Woozle: /* 2006-09-08 More logs */ pinging netbiosnames

2006-09-09T01:58:06Z

2006-09-08 More logs: pinging netbiosnames

← Older revision		Revision as of 01:58, 9 September 2006
Line 138:		Line 138:
	:<TheWoozle> I sshed to Floyd using the address given by the router; that worked. ssh to Floyd using the net lookup address failed.		:<TheWoozle> I sshed to Floyd using the address given by the router; that worked. ssh to Floyd using the net lookup address failed.
	:<phealy> but the router's dhcp gives them all the searchpath, and they're looking at earthlink.net when they can't find the machine via SMB		:<phealy> but the router's dhcp gives them all the searchpath, and they're looking at earthlink.net when they can't find the machine via SMB

			Well, that would explain why saying "ping <u>netbiosname</u>" now produces something other than "unknown host <u>netbiosname</u>":
			:woozle@gonzo:~$ ping floyd
			::PING floyd.earthlink.net (209.86.66.93) 56(84) bytes of data.
			::64 bytes from elydm.04.am.barefruit.com (209.86.66.93): icmp_seq=1 ttl=54 time=20.5 ms
			::64 bytes from elydm.04.am.barefruit.com (209.86.66.93): icmp_seq=2 ttl=54 time=23.4 ms
			::64 bytes from elydm.04.am.barefruit.com (209.86.66.93): icmp_seq=3 ttl=54 time=17.2 ms

			::--- floyd.earthlink.net ping statistics ---
			::3 packets transmitted, 3 received, 0% packet loss, time 2009ms
			::rtt min/avg/max/mdev = 17.234/20.401/23.441/2.538 ms
			:woozle@gonzo:~$ ping bunsen
			::PING bunsen.earthlink.net (209.86.66.95) 56(84) bytes of data.
			::64 bytes from elydm.06.am.barefruit.com (209.86.66.95): icmp_seq=1 ttl=54 time=27.4 ms
			::64 bytes from elydm.06.am.barefruit.com (209.86.66.95): icmp_seq=2 ttl=54 time=31.1 ms

			::--- bunsen.earthlink.net ping statistics ---
			::2 packets transmitted, 2 received, 0% packet loss, time 1004ms
			::rtt min/avg/max/mdev = 27.408/29.278/31.148/1.870 ms
			:woozle@gonzo:~$ ping beaker
			::ping: unknown host beaker
			::woozle@gonzo:~$ net lookup beaker
			::209.86.66.92
			:woozle@gonzo:~$ ping beaker
			::PING beaker.earthlink.net (209.86.66.91) 56(84) bytes of data.
			::64 bytes from elydm.02.am.barefruit.com (209.86.66.91): icmp_seq=1 ttl=54 time=23.3 ms
			::64 bytes from elydm.02.am.barefruit.com (209.86.66.91): icmp_seq=2 ttl=54 time=23.0 ms

			::--- beaker.earthlink.net ping statistics ---
			::2 packets transmitted, 2 received, 0% packet loss, time 1007ms
			::rtt min/avg/max/mdev = 23.046/23.184/23.323/0.205 ms

			Next: how to verify that this is happening because of the router, and then how to make it stop.

Woozle: /* 2006-09-04 More information */ more logs & phealy dialogue

2006-09-09T01:54:16Z

2006-09-04 More information: more logs & phealy dialogue

← Older revision		Revision as of 01:54, 9 September 2006
Line 90:		Line 90:
	10 17 ms 17 ms 18 ms Earthlink.atdn.net [66.185.150.6]		10 17 ms 17 ms 18 ms Earthlink.atdn.net [66.185.150.6]
	11 16 ms 17 ms 17 ms floyd.earthlink.net [209.86.66.94]		11 16 ms 17 ms 17 ms floyd.earthlink.net [209.86.66.94]
			==2006-09-08 More logs==
			A series of "{{linuxcmd\|net}} lookup"s, all done within less than a minute:
			:woozle@gonzo:~$ net lookup floyd -l
			:209.86.66.90
			:woozle@gonzo:~$ net lookup floyd -l
			:192.168.0.101
			:woozle@gonzo:~$ net lookup floyd -l
			:209.86.66.91
			:woozle@gonzo:~$ net lookup floyd -l
			:209.86.66.91
			:woozle@gonzo:~$ net lookup floyd -l
			:192.168.0.101
			:woozle@gonzo:~$ net lookup floyd -l
			:209.86.66.92
			:woozle@gonzo:~$ net lookup floyd -l
			:192.168.0.101
			:woozle@gonzo:~$ net lookup floyd -l
			:209.86.66.92
			:woozle@gonzo:~$ net lookup floyd -l
			:192.168.0.101
			:woozle@gonzo:~$ net lookup floyd -l
			:209.86.66.93
			:woozle@gonzo:~$ net lookup floyd -l
			:192.168.0.101
			:woozle@gonzo:~$ net lookup floyd -l
			:192.168.0.101


			Also, phealy says:

			i'm betting your problem is that, say, floyd hasn't advertised itself recently and samba can't find it ... is there something in there ''(referring to [[resolv.conf]])'' like 'search earthlink.net'?

			:@gonzo:~$ cat /etc/resolv.conf
			::search earthlink.net
			::nameserver 192.168.0.1

			yea ... so when it can't find it, it looks to dns ... that search line means "if you can't find 'floyd', try 'floyd.earthlink.net' ... the delays are, respectively, WINS timing out, and then 'floyd' timing out

			:<TheWoozle> Ok, that makes sense... but why did it start so abruptly? ... We've certainly had machines come and go on the LAN, and never had weird addresses pop up. If it couldn't find a machine, it would just say so.
			:<phealy> a setting change, the machine acting sas the WINS server went, etc. ... actually, did you change your router? ... or your ISP could have changed their DNS settings
			:<TheWoozle> Hmm... the router did get a firmware upgrade not long ago.
			:<phealy> probably that search line wasn't there before and now is
			:<TheWoozle> And if that search line was on the Samba master browser, it might cause other machines to act similarly?
			:<phealy> no ... but all machines work that way ... and they're all getting it from the router's DHCP ... if it can't find it via netbios, it looks for DNS
			:<TheWoozle> The router's DHCP listed the correct address for Floyd.
			:<phealy> right
			:<TheWoozle> I sshed to Floyd using the address given by the router; that worked. ssh to Floyd using the net lookup address failed.
			:<phealy> but the router's dhcp gives them all the searchpath, and they're looking at earthlink.net when they can't find the machine via SMB

Woozle: ping floyd; headers; "category:dated items"

2006-09-04T13:50:43Z

ping floyd; headers; "category:dated items"

@@ Line 1: / Line 1: @@
 I can't tell if this means I'm being hacked somehow or if it's just a network glitch at Earthlink, but at essentially random times Samba will start returning weird IP addresses for local machines on the network. The addresses are consistently within a particular range, though the exact assignments seem to change.
@@ Line 71: / Line 73: @@
 * '''209.86.66.91''': elydm.02.am.barefruit.com
 * '''209.86.66.92''': elydm.03.am.barefruit.com