RE: strange DNS behavior over the last 2 days

From: Levinson, Karl <LevinsonK(at)STARS-SMI.com>
Date: Fri Mar 28 2003 - 16:00:29 EST

Two thoughts: when I see different results from NSLOOKUP and PING, I think about checking other sources of name resolution, such as WINS or NetBIOS name broadcast requests [and looking at the local machine name cache using NBTSTAT -c and IPCONFIG /FLUSHDNS on Windows 2000 to display, NBTSTAT -R and IPCONFIG /FLUSHDNS to flush the local caches]. If the problem is due to NetBIOS names, you might consider confirming your firewall blocks NetBIOS both to and from the internet.

Also, you might read the article at www.cert.org concerning DNS cache poisoning [Microsoft naturally had to rename it to "pollution"] and see if that might apply to your situation. If this was the case, flushing the name caches on both the local host and the server [for example by restarting the DNS service] would probably make the problem go away immediately [though temporarily]. Whether or notn this is the problem here, IMHO you really should consider enabling the setting to prevent cache poisoning on probably any Microsoft DNS server as described here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;241352

-----Original Message-----

From: steve baker [mailto:stephenbbaker@hotmail.com] Sent: Thursday, March 27, 2003 1:07 PM
To: incidents@securityfocus.com
Subject: strange DNS behavior over the last 2 days

For some odd reason, periodically our clients will visit a site, only to have a blank page appear as if the site loaded.

Nslookup resolves the correct IP address, but ping returns 64.251.66.2 for every address that has this problem. There are NO hosts files on these machines and regardless of which DNS server we point them to, the same problem occurs.

The problem occurs intermittently as well, which makes it even harder to pin

down. Some sites previously affected will be accessible and new sites not affected suddenly have the same problem - but they eventually clear up in just about 10 minutes.

Very strange. Has anyone heard or seen this before on a network running windows nt 4 DNS server with nt/2000 clients?

---

Powerful Anti-Spam Management and More... SurfControl E-mail Filter puts the brakes on spam, viruses and malicious code. Safeguard your business critical communications. Download a free 30-day trial: http://www.surfcontrol.com/go/zsfihl1 Received on Sat Mar 29 13:04:38 2003