Problem in DNS

[FanacooL]

Hi!
One of my client machine running windows XP is resolving the DNS entries of the local domain wrongly, whenever i try to ping any other machine on the network i get timeout from a specific IP 93.191.141.136 which is not a part of my DNS entries. Furthermore all the entries on this particular client machines are fine, i mean its reflecting to my DNS Server.

When i run nslookup i get all the results for queries fine, the problem pertains to this particular machine only. Furthermore when i stop the dnscache the system resolves the DNS entries to correct IP which means the problem is in the DNSCACHE. I have used flushdns to delete the entries but no effect.

Only the system works correctly when the dnscache is Stopped, my query is why i am facing this issue, how it can be resolved and is there any local file where the dnscache entries get written so if i can remove the wrong entries from there.

F A N A

[SirDice]

Did you check the hosts file?

[FanacooL]

couldn't find anything there! they are intact!

[Cider]

hi there,

Besides the hosts file I cannot think of anything else. Is DNS working on the other machines in the network correctly? Maybe a user has misconfigured the settings or installed a rogue DNS server.

I'm sure SD can give some more suggestions.

[FanacooL]

well every other machine is fine and getting the correct entries, its surely the dnscache thing making issue but why no idea..... BTW is there a way i can permanently turnoff the dnscache till the issue resolved.

[Cider]

Hi there,

Have a look at this.

This is client side so it will only affect the one machine.

http://support.microsoft.com/kb/318803



basically net stop dnscache

[SirDice]

It's a bit of an oldy but you might want to check if the patch was actually installed.

http://www.microsoft.com/technet/sec.../ms07-062.mspx

Also check ipconfig /all especially the DNS suffix search list and the Connection-specific DNS suffix.

[Cheap Scotch Ron]

check the DNS cache registry entries. There's a popular hack promoted to "tweak" performance by changing the settings. Restore them to default values if they have been changed. Here's a link to the hack

http://www.computerworld.com/action/...icleId=9019951

CSR

[FanacooL]

Also check ipconfig /all especially the DNS suffix search list and the Connection-specific DNS suffix.

Just found one thing in DNS Suffix Search List here i can see one of my old DNS Server which is no more in the domain, i am bit strange how come the client showing this entry.

[SirDice]

Just found one thing in DNS Suffix Search List here i can see one of my old DNS Server which is no more in the domain, i am bit strange how come the client showing this entry.

It's probably been added by hand. In the TCP/IP properties of the interface you'll find an "Advanced" button. Have a look at the DNS tab, I'm sure it's been added there.