1.0.0.0 DNS replies for many domain names (network)

1.0.0.0 DNS replies for many domain names (network)

[Amogh Hooshdar]

I am having a strange problem with Debian Etch 4.0 (both 64-bit and
32-bit) using 2.6.18 kernel. Most websites do not open with browser,
Pidgin and most other GUI applicatoins. but I am able to ping them
fine. I am also able to do nslookup properly. When I tried to
investigate it with Wireshark net sniffer, I observed the following.

PROBLEM WITH 2.6.18
Say, I try to open www.google.com, browser sends DNS query for
www.google.com to my DNS server which is correctly configured in
resolv.conf. It replies with the correct IP address. www.google.com
redirects the browser to www.google.co.in. browser sends a DNS query
again for www.google.co.in and the DNS server replies with 1.0.0.0
which obviously is the wrong address.

Similar thing happens for many other domains like ftp.us.debian.org,
etc. It is quite random and happens 95% of the times. In other words I
am virtually not able to access internet.

OK WITH 2.6.20
The above was for Debian. With a Ubuntu 7.04 which has 2.6.20 kernel
everything is fine. no problems at all. With windows also no problem
at all.

Is this due to something in the 2.6.18 kernel which is related to the
way it sends a DNS query. Any information on this subject would be
highly appreciated since I am trying to understand why one distro
causes the problem and not the other. is it related to the kernel or
only to the distro?

Key words: DNS, domain, networking, IP address

Re: 1.0.0.0 DNS replies for many domain names (network)

[Vaidyanathan Srinivasan]

* Amogh Hooshdar <amoghhooshdar@gmail.com> [2007-12-14 17:20:17]:

> I am having a strange problem with Debian Etch 4.0 (both 64-bit and
> 32-bit) using 2.6.18 kernel. Most websites do not open with browser,
> Pidgin and most other GUI applicatoins. but I am able to ping them
> fine. I am also able to do nslookup properly. When I tried to
> investigate it with Wireshark net sniffer, I observed the following.
> 
> PROBLEM WITH 2.6.18
> Say, I try to open www.google.com, browser sends DNS query for
> www.google.com to my DNS server which is correctly configured in
> resolv.conf. It replies with the correct IP address. www.google.com
> redirects the browser to www.google.co.in. browser sends a DNS query
> again for www.google.co.in and the DNS server replies with 1.0.0.0
> which obviously is the wrong address.

I had this problem on Debian 4.0 and it was due to bug in the DSL
router.  I had DNS server set to 192.168.1.1 that is my DSL router
that holds the real DNS IP and forwards the DNS lookup request.

Once in a while the DNS proxy server will give out 1.0.0.0.  The
solution I used was to find the real DNS server and fill it in
resolv.conf  This avoids the DNS proxy on the router and then problem
went away.

https://bugs.launchpad.net/ubuntu/+bug/81057

--Vaidy
 

Re: 1.0.0.0 DNS replies for many domain names (network)

[Amogh Hooshdar]

I fixed this by installing bind9 which has named server. After
installing bind9, I used the default configuration, which understands
DNS AAAA type queries and uses the root name servers and other servers
for resolution.

On Dec 17, 2007 10:21 AM, Vaidyanathan Srinivasan
<svaidy@linux.vnet.ibm.com> wrote:
> * Amogh Hooshdar <amoghhooshdar@gmail.com> [2007-12-14 17:20:17]:
>
> > I am having a strange problem with Debian Etch 4.0 (both 64-bit and
> > 32-bit) using 2.6.18 kernel. Most websites do not open with browser,
> > Pidgin and most other GUI applicatoins. but I am able to ping them
> > fine. I am also able to do nslookup properly. When I tried to
> > investigate it with Wireshark net sniffer, I observed the following.
> >
> > PROBLEM WITH 2.6.18
> > Say, I try to open www.google.com, browser sends DNS query for
> > www.google.com to my DNS server which is correctly configured in
> > resolv.conf. It replies with the correct IP address. www.google.com
> > redirects the browser to www.google.co.in. browser sends a DNS query
> > again for www.google.co.in and the DNS server replies with 1.0.0.0
> > which obviously is the wrong address.
>
> I had this problem on Debian 4.0 and it was due to bug in the DSL
> router.  I had DNS server set to 192.168.1.1 that is my DSL router
> that holds the real DNS IP and forwards the DNS lookup request.
>
> Once in a while the DNS proxy server will give out 1.0.0.0.  The
> solution I used was to find the real DNS server and fill it in
> resolv.conf  This avoids the DNS proxy on the router and then problem
> went away.
>
> https://bugs.launchpad.net/ubuntu/+bug/81057
>
> --Vaidy
>
>