DNS Issues Technicolor TG582n

[#1]

Quote from: NivagSwerdna

Something isn't right at all.... Maybe someone is spoofing DNS?

Similar thing is happening to me, but everything is going to 198.18.1.xxx which is supposed to be reserved for testing.

[#2]

At the request of PlusNet I have now set my Member Centre firewall to LOW...
Same problem.  DNS relay in Technicolor going deaf again.
{admin}[dns server debug]=>:dns server debug stats
Corrupted packets received      :      9253
Local questions resolved        :        2
Local negative answers sent      :        36
Total DNS packets forwarded      :    58566
External answers received        :    10114
Spoofed responses                :        0
Forward table full, discard      :        75
Spurious answers                :      1334
Unknown query types              :        12
{admin}[dns server debug]=>
I have decided to take a new approach....
When the router connects it receives...
Primary DNS: 212.159.6.10
Secondary DNS: 212.159.6.9
Instead I'm going to try different DNS servers for a while...
dns server route flush
dns server add 8.8.8.8
dns server add 8.8.4.4
dns server debug stats
dns server debug spoof clear
Interestingly I haven't seen a single corrupt DNS packet since I switched to google servers but it's early days yet.

[#3]

After about 15 mins of quiet time my router just got hit with a storm of corrupt packets...

Corrupted packets received       :         0
Corrupted packets received       :         0
Corrupted packets received       :         0
Corrupted packets received       :         0
Corrupted packets received       :         0
Corrupted packets received       :      7838
Corrupted packets received       :      8086
Corrupted packets received       :      9609
Corrupted packets received       :     10048
Corrupted packets received       :     10767
Corrupted packets received       :     13503
Corrupted packets received       :     15663
Corrupted packets received       :     15663
Corrupted packets received       :     15663
Corrupted packets received       :     15663
Corrupted packets received       :     15663
Corrupted packets received       :     15663

Interestingly the DNS relay didn't go deaf with this storm and no more corrupt packets have arrived for a while.
Does anyone know how to interpret "Corrupted packets received" is that LAN or WAN side?
Thanks
Nivag

[#4]

After switching away from the DNS servers supplied by PN during the handshake (212.159.6.10 & 212.159.6.9) to a different pair of PN DNS servers supplied by support I no longer have any issues (not the moment at least).  I think the corrupted packets reported by :dns server debus stats is interesting but unrelated to the DNS relay going deaf; instead my suspicion is that slow behaviour by the .10 and .9 DNS servers causes the router to drop them as candidates and eventually it has no DNS to relay to... and its algorithm doesn't seem to let them back into the dns server route without intervention.
Anyway with the new DNS servers all is working again and my LAN clients can continue to use the router 192.168.1.1 as their DNS server address.
I note that the DNS commands have been rewritten for later Technicolor routers... maybe they changed the logic in later models.
Regards
Nivag

[#5]

AFAIK the 6.9 6.10 13.49 and 13.50 DNS servers are all the same, it's the same 4 dns servers behind each of those publicised IP addresses. As in, there are 4 dns servers behind 6.9, the same 4 behind 6.10, and the same 4 behind 13.49 and 13.50.

[#6]

My new configuration does not point to .9, .10, .49 or .50; I guess I must have been advised to point to a pair behind those.
In any case my issues have, at least temporarily disappeared.
Incidentally my original ticket, submitted on Friday,  just received a response... "put a pin in the 'Reset hole' on the back of the router and hold it until the lights go out."  Sigh.
Qudos to Chris Coates for spotting my plight, contacting me direct and giving me this work around.
Regards
Nivag

[#7]

I guess the IP addresses must be from this list then.

[#8]

Quote from: ejs

I guess the IP addresses must be from this list then.

Indeed they are.  I didn't want to post the exact IPs since PN obviously prefer people to go to the customer facing tier where possible.
Regards
Nivag
PS
@ejs I've PMed you the IPs