Re: Phantom DNS server

From: Dilan Weerasinghe (dilanw77_at_hotmail.com)
Date: 09/01/04 

Date: 1 Sep 2004 04:22:46 -0700

"Kevin D. Goodknecht Sr. [MVP]" <admin@nospam.WFTX.US> wrote in message news:<#1uHXD2jEHA.1764@TK2MSFTNGP10.phx.gbl>...
<snip>
> > Ace,
> >
> > To clarify;
> >
> > Our network is configured as following -
> >
> > DHCP server: 192.168.1.1
> > DNS Servers: 192.168.1.1/ 192.168.1.2
> >
> > (All above addresses are static)
> >
> > All workstations are set to DHCP, and I've checked the
> > scope options
> > on the DHCP server itself as regards DNS, and it points
> > to the correct
> > addresses.
> >
> > Our router is on a completely different address.
> >
> > The problem is that, randomly, users seem to lose their
> > internet
> > connection. As I mentioned before, the actual
> > connectivity is there
> > but the fault lies with name resolution as we can ping
> > externally/internally by IP address but not by name.
> > Checking the
> > IPCONFIG shows that the faulty machines are picking up
> > 192.168.1.10 as
> > their DNS server, although all other settings are correct.
> > Rebooting the machines solves the problem until it
> > happens again.
> > I understand that we could set the workstations to
> > statically point at
> > the correct DNS servers, however this is a workaround,
> > not a solution
> > and I'd like to find out what's causing this.
> > The faulty machines always pick up x.10 as the DNS server.
> > x.10 itself is excluded from our DHCP range for
> > distribution, and is
> > also not currently being used, so I have no idea why they
> > are picking
> > this address up as a DNS server.
> >
> > Many thanks for your help
> > Dilan
>
> On the ipconfig for the machines with the bogus DNS address, what IP do they
> show for the DHCP server?
>
> --
> Best regards,
> Kevin D4 Dad Goodknecht Sr. [MVP]
> Hope This Helps
> ================================================
> --
> When responding to posts, please "Reply to Group"
> via your newsreader so that others may learn and
> benefit from your issue, to respond directly to
> me remove the nospam. from my email address.
> ================================================
> http://www.lonestaramerica.com/
> ================================================
> Use Outlook Express?... Get OE_Quotefix:
> It will strip signature out and more
> http://home.in.tum.de/~jain/software/oe-quotefix/
> ================================================
> Keep a back up of your OE settings and folders
> with OEBackup:
> http://www.oehelp.com/OEBackup/Default.aspx
> ================================================

Kevin,

They show the correct DHCP server (192.168.1.1). Would it have been
different, I would have assumed we had some sort of rogue DHCP machine
on the network giving out wrong DNS server info, but in all cases the
faulty machines are using the correct DHCP server.

Thanks
Dilan

Relevant Pages