cancel
Showing results for 
Search instead for 
Did you mean: 

Odd ball DNS behaviour

Townman
Superuser
Superuser
Posts: 23,052
Thanks: 9,642
Fixes: 160
Registered: ‎22-08-2007

Odd ball DNS behaviour

Yet again when attempting to browse to google.co.uk I am getting "cannot connect" issues (no internet connection), even though I otherwise have no issues.  On investigating, I ran a nslookup query followed by a ping test.  I was somewhat surprised to see that the ping address resolution was different to all of the addresses listed by nslookup.
Looking further, I've found that repeated nslookups return different lists of IP addresses.  Is this to be expected or does it point to 'challenges' with PN's DNS servers?
Quote
#Microsoft Windows [Version 6.1.7601
#02/10/15-13:58:23.37
C:\Users\Kevin>nslookup
Default Server:  dsldevice.lan
Address:  192.168.1.254
> google.co.uk
Server:  dsldevice.lan
Address:  192.168.1.254
Non-authoritative answer:
Name:    google.co.uk
Addresses:  2a00:1450:4009:801::2003
          212.56.71.230
          212.56.71.249
          212.56.71.227
          212.56.71.251
          212.56.71.212
          212.56.71.229
          212.56.71.216
          212.56.71.223
          212.56.71.234
          212.56.71.240
          212.56.71.208
          212.56.71.241
          212.56.71.238
          212.56.71.219
          212.56.71.245
          212.56.71.218
> google.co.uk
Server:  dsldevice.lan
Address:  192.168.1.254
Non-authoritative answer:
Name:    google.co.uk
Addresses:  2a00:1450:4009:801::2003
          212.56.71.25
          212.56.71.49
          212.56.71.50
          212.56.71.35
          212.56.71.55
          212.56.71.45
          212.56.71.24
          212.56.71.29
          212.56.71.20
          212.56.71.40
          212.56.71.39
          212.56.71.54
          212.56.71.59
          212.56.71.44
          212.56.71.34
          212.56.71.30
> google.co.uk
Server:  dsldevice.lan
Address:  192.168.1.254
Non-authoritative answer:
Name:    google.co.uk
Addresses:  2a00:1450:4009:801::2003
          212.56.71.230
          212.56.71.249
          212.56.71.227
          212.56.71.251
          212.56.71.212
          212.56.71.229
          212.56.71.216
          212.56.71.223
          212.56.71.234
          212.56.71.240
          212.56.71.208
          212.56.71.241
          212.56.71.238
          212.56.71.219
          212.56.71.245
          212.56.71.218
> google.co.uk
Server:  dsldevice.lan
Address:  192.168.1.254
Non-authoritative answer:
Name:    google.co.uk
Addresses:  2a00:1450:4009:80a::2003
          212.56.71.118
          212.56.71.84
          212.56.71.103
          212.56.71.98
          212.56.71.108
          212.56.71.114
          212.56.71.94
          212.56.71.99
          212.56.71.89
          212.56.71.93
          212.56.71.119
          212.56.71.123
          212.56.71.104
          212.56.71.113
          212.56.71.88
          212.56.71.109
> google.co.uk
Server:  dsldevice.lan
Address:  192.168.1.254
Non-authoritative answer:
Name:    google.co.uk
Addresses:  2a00:1450:4009:80a::2003
          212.56.71.104
          212.56.71.123
          212.56.71.89
          212.56.71.114
          212.56.71.99
          212.56.71.119
          212.56.71.113
          212.56.71.93
          212.56.71.118
          212.56.71.94
          212.56.71.103
          212.56.71.109
          212.56.71.108
          212.56.71.98
          212.56.71.88
          212.56.71.84
> google.co.uk
Server:  dsldevice.lan
Address:  192.168.1.254
Non-authoritative answer:
Name:    google.co.uk
Addresses:  2a00:1450:4009:800::2003
          212.56.71.119
          212.56.71.123
          212.56.71.94
          212.56.71.109
          212.56.71.98
          212.56.71.84
          212.56.71.118
          212.56.71.108
          212.56.71.93
          212.56.71.99
          212.56.71.89
          212.56.71.103
          212.56.71.114
          212.56.71.104
          212.56.71.88
          212.56.71.113
> google.co.uk
Server:  dsldevice.lan
Address:  192.168.1.254
Non-authoritative answer:
Name:    google.co.uk
Addresses:  2a00:1450:4009:801::2003
          212.56.71.104
          212.56.71.123
          212.56.71.89
          212.56.71.114
          212.56.71.99
          212.56.71.119
          212.56.71.113
          212.56.71.93
          212.56.71.118
          212.56.71.94
          212.56.71.103
          212.56.71.109
          212.56.71.108
          212.56.71.98
          212.56.71.88
          212.56.71.84

Looking at a summary of the number of times an address was returned across the 7 queries is also interesting...
Quote
          212.56.71.103 4
          212.56.71.104 4
          212.56.71.108 4
          212.56.71.109 4
          212.56.71.113 4
          212.56.71.114 4
          212.56.71.118 4
          212.56.71.119 4
          212.56.71.123 4
          212.56.71.20 1
          212.56.71.208 2
          212.56.71.212 2
          212.56.71.216 2
          212.56.71.218 2
          212.56.71.219 2
          212.56.71.223 2
          212.56.71.227 2
          212.56.71.229 2
          212.56.71.230 2
          212.56.71.234 2
          212.56.71.238 2
          212.56.71.24 1
          212.56.71.240 2
          212.56.71.241 2
          212.56.71.245 2
          212.56.71.249 2
          212.56.71.25 1
          212.56.71.251 2
          212.56.71.29 1
          212.56.71.30 1
          212.56.71.34 1
          212.56.71.35 1
          212.56.71.39 1
          212.56.71.40 1
          212.56.71.44 1
          212.56.71.45 1
          212.56.71.49 1
          212.56.71.50 1
          212.56.71.54 1
          212.56.71.55 1
          212.56.71.59 1
          212.56.71.84 4
          212.56.71.88 4
          212.56.71.89 4
          212.56.71.93 4
          212.56.71.94 4
          212.56.71.98 4
          212.56.71.99 4

Is this normal behaviour or does it point to something amiss?
...yet again, opening a new browser session provides an immediate connection to google.co.uk without issue.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

12 REPLIES 12
aesmith
Pro
Posts: 629
Thanks: 80
Fixes: 4
Registered: ‎26-09-2015

Re: Odd ball DNS behaviour

Related to the problem last week?
From the office, using Open DNS or 8.8.8.8 it resolves sensibly ...
Quote
[tt]> server 8.8.8.8
Default server: 8.8.8.8
Address: 8.8.8.8#53
> www.google.co.uk
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
Name: www.google.co.uk
Address: 216.58.210.67
> server resolver2.opendns.com
Default server: resolver2.opendns.com
Address: 208.67.220.220#53
> www.google.co.uk
Server: resolver2.opendns.com
Address: 208.67.220.220#53
Non-authoritative answer:
Name: www.google.co.uk
Address: 216.58.210.67
>[/tt]


From home either Open DNS or Plusnet DNS give odd results ..
Quote
[tt]> www.google.co.uk
Server:  cdns01.plus.net
Address:  212.159.13.49
Non-authoritative answer:
Name:    www.google.co.uk
Addresses:  2a00:1450:4009:80d::2003
          212.56.71.24
          212.56.71.20
          212.56.71.54
          212.56.71.50
          212.56.71.45
          212.56.71.49
          212.56.71.30
          212.56.71.55
          212.56.71.29
          212.56.71.35
          212.56.71.59
          212.56.71.44
          212.56.71.34
          212.56.71.39
          212.56.71.40
          212.56.71.25
>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       
> www.google.co.uk

Server:  resolver2.opendns.com
Address:  208.67.220.220
Non-authoritative answer:
Name:    www.google.co.uk
Addresses:  2a00:1450:4009:801::2003
          212.56.71.35
          212.56.71.50
          212.56.71.44
          212.56.71.20
          212.56.71.49
          212.56.71.29
          212.56.71.54
          212.56.71.59
          212.56.71.55
          212.56.71.34
          212.56.71.24
          212.56.71.39
          212.56.71.45
          212.56.71.30
          212.56.71.40
          212.56.71.25
>
[/tt]

Note IPv6 included!
stuffit
Dabbler
Posts: 15
Registered: ‎10-07-2013

Re: Odd ball DNS behaviour

Also noticing DNS failures today. Didn't think too much of it at first, but now have noticed a few more big named sites not resolving (using Plusnet's DNS).
Have confirmed with a friend who is also using Plusnet, that he is seeing the same problem behaviour.
An example site that appears to be working fine with other ISPs, but not Plusnet: http://www.nasa.gov
aesmith
Pro
Posts: 629
Thanks: 80
Fixes: 4
Registered: ‎26-09-2015

Re: Odd ball DNS behaviour

Quote from: monksteve
An example site that appears to be working fine with other ISPs, but not Plusnet: http://www.nasa.gov

I can reach that from Plusnet, but I'm using Open DNS name servers.
stuffit
Dabbler
Posts: 15
Registered: ‎10-07-2013

Re: Odd ball DNS behaviour

Quote from: aesmith
Quote from: monksteve
An example site that appears to be working fine with other ISPs, but not Plusnet: http://www.nasa.gov

I can reach that from Plusnet, but I'm using Open DNS name servers.

Yeah, it's just Plusnet's DNS servers I'm seeing the problem on.
Townman
Superuser
Superuser
Posts: 23,052
Thanks: 9,642
Fixes: 160
Registered: ‎22-08-2007

Re: Odd ball DNS behaviour

Not seeing that problem here

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

stuffit
Dabbler
Posts: 15
Registered: ‎10-07-2013

Re: Odd ball DNS behaviour

Whatever the problem was, it seems to have been rectified some time over the evening / night, for myself and a couple of Plusnet friends at least.
cedlor
Grafter
Posts: 687
Thanks: 2
Registered: ‎02-04-2015

Re: Odd ball DNS behaviour

I had the Nasa problem yesterday but  it works ok today.  I was just wondering how come they can control drone helicopters on a probe on mars when BTOR cant find a REIN source in a block of 8 shops.
aesmith
Pro
Posts: 629
Thanks: 80
Fixes: 4
Registered: ‎26-09-2015

Re: Odd ball DNS behaviour

The funny thing is that when I look up say www.google.co.uk, over the Plusnet link then I get Plusnet host addresses returned, even from OpenDNS or even Google name servers.  Either Plusnet is re-writing the packet, or redirecting the query to their own DNS servers, or in some way the unrelated servers are being persuaded to return the Plusnet cache rather than the real thing.
ejs
Aspiring Hero
Posts: 5,442
Thanks: 631
Fixes: 25
Registered: ‎10-06-2010

Re: Odd ball DNS behaviour

The Plusnet Google cache is the real thing. Not all DNS servers do it, e.g. 4.2.2.2 doesn't. You don't really encourage people to use your third-party DNS servers, which claim to be better and faster, with the drawback that you'll end up getting Google or Akamai content from further away.
There's no problem with the DNS responses in the first post, Plusnet disabled their Google cache a little while ago, but have evidently turned it back on, presumably after fixing the issue Apple computers had with it.
Townman
Superuser
Superuser
Posts: 23,052
Thanks: 9,642
Fixes: 160
Registered: ‎22-08-2007

Re: Odd ball DNS behaviour

ejs,
Thanks for advising that there is no issue with what I reported.  Can you please pint to some reference to the other matter you mention please?
Seeing numerous sets of different address sets (at the same time as seeing my periodic inability to connect on an other wise functioning link) looked odd and potentially relevant to the symptoms.

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.

ejs
Aspiring Hero
Posts: 5,442
Thanks: 631
Fixes: 25
Registered: ‎10-06-2010

Re: Odd ball DNS behaviour

Last week's Google issue is here: https://community.plus.net/forum/index.php/topic,144230.0.html
I'm not sure if there's any particular reference about third party DNS and CDNs (content distribution networks such as Akamai). In the past, using Google DNS or OpenDNS or others could have resulted in you accessing CDN content from servers further away than what has been installed at Plusnet. You can compare traceroutes, e.g. to static.bbci.co.uk
With Plusnet DNS, and Google DNS and OpenDNS
[tt]traceroute to static.bbci.co.uk (212.56.73.32), 30 hops max, 60 byte packets
1  gateway (192.168.0.1)  3.199 ms
2  lo0.11.central11.pcl-bng02.plus.net (195.166.130.152)  11.138 ms
3  irb.11.PCL-CR01.plus.net (84.93.249.97)  10.684 ms
4  cache.akamai.com (212.56.73.32)  11.670 ms[/tt]
With 4.2.2.2, static.bbci.co.uk = 104.86.110.49
[tt]traceroute to 104.86.110.49 (104.86.110.49), 30 hops max, 60 byte packets
1  gateway (192.168.0.1)  1.502 ms
2  lo0.11.central11.pcl-bng02.plus.net (195.166.130.152)  12.116 ms
3  irb.11.PCL-CR02.plus.net (84.93.249.98)  11.958 ms
4  195.99.126.98 (195.99.126.98)  13.577 ms
5  core3-te0-9-0-21.faraday.ukcore.bt.net (109.159.249.165)  13.070 ms
6  peer2-et-3-3-0.faraday.ukcore.bt.net (62.6.201.193)  11.392 ms
7  213.137.183.102 (213.137.183.102)  11.669 ms
8  82.112.115.185 (82.112.115.185)  13.567 ms
9  ae-1.r03.londen05.uk.bb.gin.ntt.net (129.250.6.230)  12.974 ms
10  81.25.207.158 (81.25.207.158)  13.381 ms
11  a104-86-110-49.deploy.static.akamaitechnologies.com (104.86.110.49)  14.954 ms[/tt]
I don't know what the issue is with your computer or connection or elsewhere, there are a couple of other threads currently, but there doesn't seem to be anything widespread or more people would have noticed.
Townman
Superuser
Superuser
Posts: 23,052
Thanks: 9,642
Fixes: 160
Registered: ‎22-08-2007

Re: Odd ball DNS behaviour

Hi ejs,
Thank you for the added info - it have gone completely over my head that the resolutions were not to 'real' google.co.uk, rather a sea of proxy servers / addresses,

Superusers are not staff, but they do have a direct line of communication into the business in order to raise issues, concerns and feedback from the community.