Topic: Anybody experiencing DNS issues recently? (Read 3840 times)

The Bar-Abbas Anomaly · « **on:** April 07, 2005, 10:26:03 pm »

My Comcast DNS servers have been having fits for over 24 hours, and I'm currently using RCN Internet DNS addys too connect through Comcast because of it.

http://isc.sans.org/

Internet Storm Center says there's a DNS cache poisoning issue (virus?) going around the world.... Anybody else have problems?

Quote

The InfoCon is currently set at yellow in response to the DNS cache poisoning issues that we have been reporting on for the last several days. We originally went to yellow because we were uncertain of the mechanisms that allowed seemingly "secure" systems to be vulnerable to this issue. Now that we have a better handle on the mechanisms, WE WANT TO GET THE ATTENTION OF ISPs AND ANY OTHERS WHO RUN DNS SERVERS THAT MAY ACT AS FORWARDS FOR DOWNSTREAM Microsoft DNS SYSTEMS. If you are running BIND, please consider updating to Version 9. Read on for more information...

toasty0 · « **Reply #1 on:** April 07, 2005, 11:00:04 pm »

Quote from: Bar-Abbas on April 07, 2005, 10:26:03 pm

My Comcast DNS servers have been having fits for over 24 hours, and I'm currently using RCN Internet DNS addys too connect through Comcast because of it.

http://isc.sans.org/

Internet Storm Center says there's a DNS cache poisoning issue (virus?) going around the world.... Anybody else have problems?

Quote
The InfoCon is currently set at yellow in response to the DNS cache poisoning issues that we have been reporting on for the last several days. We originally went to yellow because we were uncertain of the mechanisms that allowed seemingly "secure" systems to be vulnerable to this issue. Now that we have a better handle on the mechanisms, WE WANT TO GET THE ATTENTION OF ISPs AND ANY OTHERS WHO RUN DNS SERVERS THAT MAY ACT AS FORWARDS FOR DOWNSTREAM Microsoft DNS SYSTEMS. If you are running BIND, please consider updating to Version 9. Read on for more information...

Not that I'm aware of, but there is always the possibility of a Perfect Storm or Tsunami effect on the net.

Jerry

Javora · « **Reply #2 on:** April 08, 2005, 02:48:20 am »

Yeah I had problems connecting a few hours ago. My spouse and I were talking about it and we were thinking that it might be traffic overload due to the pope's funeral tonight. The funeral starts around 3:45am EST I think. The issues cleared up around midnight EST or so, I guessing that is when everybody decided to call it quits for the night. But I think it is plausible that people looking into the Pope's funeral along with normal Internet traffic brought things to a stand still. When I tried to figure out the problem on my end I ran across this message on the Comcast web site:

Quote

We are currently experiencing a national outage that may cause intermittent connectivity. Our engineers are currently working to resolve the issue.

I guess it could be a coincidence but too many things lined up just right IMHO.

Darth Sidious · « **Reply #3 on:** April 08, 2005, 08:59:06 am »

This was the exact problem i was having yesterday evening. Seems to have cleared up since ths morning.

(Also on Comcast)

Quote from: Bar-Abbas on April 07, 2005, 10:26:03 pm

My Comcast DNS servers have been having fits for over 24 hours, and I'm currently using RCN Internet DNS addys too connect through Comcast because of it.

http://isc.sans.org/

Internet Storm Center says there's a DNS cache poisoning issue (virus?) going around the world.... Anybody else have problems?

Quote
The InfoCon is currently set at yellow in response to the DNS cache poisoning issues that we have been reporting on for the last several days. We originally went to yellow because we were uncertain of the mechanisms that allowed seemingly "secure" systems to be vulnerable to this issue. Now that we have a better handle on the mechanisms, WE WANT TO GET THE ATTENTION OF ISPs AND ANY OTHERS WHO RUN DNS SERVERS THAT MAY ACT AS FORWARDS FOR DOWNSTREAM Microsoft DNS SYSTEMS. If you are running BIND, please consider updating to Version 9. Read on for more information...

The Bar-Abbas Anomaly · « **Reply #4 on:** April 08, 2005, 09:36:57 am »

ICS followed up by saying that Comcast's problems were not cache poisoning, but technical problems with equipment...

Quote

Comcast Problems

We have received a couple of inquiries regarding the unavailablity of Comcast. Apparently Comcast is experiencing problems nationwide due to an equipment update. This does not appear to have any connection to the DNS Cache Poisoning that we have been following over the last few days. The Comcast technical problems should be resolved shortly and all will return to normal.

E_Look · « **Reply #5 on:** April 08, 2005, 01:02:54 pm »

Maybe just about a couple of weeks ago it started and lasted that long.

I'll see how I can connect the next many weeks.

Javora · « **Reply #6 on:** April 08, 2005, 03:44:29 pm »

Just a follow up, from what I've been reading this connectivity issue affected Cox customers as well.

Bonk · « **Reply #7 on:** April 08, 2005, 03:47:36 pm »

I'm having a hell of a time seeing outside our university network at the moment... thought that Dynaverse.net was under attack again when I couldn't get through. But hp.com and cnn.com are timing out on me as well...

not sure if its DNS issues though... could just be P2P mp3s and pron video type crap clogging up our lan...?

Bonk · « **Reply #8 on:** April 08, 2005, 03:49:21 pm »

From what I read the ICANN DNS system is on the rocks and control of the distributed DNS database will soon be up for grabs... this could be the start of the takeover? (make the current system fail?)

Something about the .travel domain....

Javora · « **Reply #9 on:** April 08, 2005, 04:01:09 pm »

I have been keeping an eye on the dslreports site and it looks like we are not the only country that is having problems. People from Russia and Australia are having problems as well. This leads me back to the Pope's funeral and all the web casts that the Vatican had planned. Since Comcast just recently upgraded their connection rates from 3000mb/256mb to 4000mb/768mb, I guessing that Comcast was affected more.

Sethan · « **Reply #10 on:** April 14, 2005, 07:56:52 pm »

I had the same problem (also on Comcast) - so I pointed my system at the public DNS server at 199.166.31.3 - since then, no problems.

SkyFlyer · « **Reply #11 on:** April 15, 2005, 01:57:20 am »

SBC Global here... been having problems off and on for the past 3 days.

Darth Sidious · « **Reply #12 on:** April 15, 2005, 08:24:00 am »

I might need to go back on comcasts dns.

Woke up this morning and rebooted PC - and i started coming up non-clever in bittorrent even though the only thing that changed on my system was a primary dns change and a reboot.

Will investigate further when i get home

Bonk · « **Reply #13 on:** April 15, 2005, 02:14:28 pm »

Run a "netstat" just to check and see what is connected to your machine. (found a trojan that mimiced the effect of DNS issues on a work PC thus recently)

Darth Sidious · « **Reply #14 on:** April 15, 2005, 02:18:58 pm »

In comcasts case it WAS comcast. Hundreds of people across the US all on comcast having the same problem.

Stiill... i'll run one when i get home just in case

quote author=Bonk link=topic=163354794.msg1122555407#msg1122555407 date=1113592468]
Run a "netstat" just to check and see what is connected to your machine. (found a trojan that mimiced the effect of DNS issues on a work PC thus recently)

Quote

SkyFlyer · « **Reply #15 on:** April 16, 2005, 01:00:16 pm »

I see the comcast things timed out.... kinda funny since im on SBC Yahoo! DSL

SkyFlyer · « **Reply #16 on:** April 17, 2005, 04:19:36 am »

bump... anyone take a look at the screenshot?

Bonk · « **Reply #17 on:** April 21, 2005, 04:24:04 pm »

That netstat looks reasonable.

What you're looking for with a netstat is huge numbers of connections you did not initiate, which is indicative of worms or trojans on your machine, and since we do not see that here, then that is not your problem.

Some other users above mentioned that comcast has had DNS troubles, and some users have avoided this by using public DNS servers?

I reccomend complaining to comcast. (If you haven't already). But before you do so:

To test your DNS performance try "nslookup hp.com" at the command prompt - should give you the IPs for HP quickly...

If you are running software firewalls (ack!) make sure that your DNS, DHCP and gateway are trusted by the software firewall (if not god knows what will happen - network dependent).

Also try allowing pings to your machine (i.e. no "stealth" mode).

Make sure you are not using any proxies (evil by definition).

Do a thorough spyware scan with Ad-Aware, Spybot S&D and MS Anti-Spyware. Many spywares set you up to use a proxy transparently so all your browsing can be monitored which will of course slow the system down.

I'll post any other ideas as they come to me...

News: