198.18.1.x address problems

[#1]

Quote from: Townman

Really am learning to hate this version of Win with a real passion!

I know how you feel.
I use "start 8" to restore the start menu in win 8.1, that and learn to press the windows key whenever the metro screen pops up.
http://www.stardock.com/products/start8/?Referer=cnet
There is other similar free products you could try.

[#2]

@npr - Thanks, I will go look at that.
@CRT - Are there operational issues with the DNS please?  See below.
@Anyone still interested...!
I think I am starting to understand what is happening here, having just seen a similar issue on my Win7 platform.
I tried to get to www.kitz.co.uk and the browser reported that the site was not available!  
Launched CMD did the usual PING and NSLOOKUP checks and all was fine - sought to refresh the browser and still no connection to the website.  Opened a NEW TAB in the SAME IE11 BROWSER session and connected without issue.  Then attempting to connect in the failing TAB still failed.
Looked at TG spoof list and noted the presence of the requested website...

Quote

198.18.1.136     s2s.sn.eamobile.com          0.0.0.0          Not resolved 198.18.1.137     init.itunes.apple.com        0.0.0.0          Not resolved 198.18.1.138     api.tripadvisor.com          0.0.0.0          Not resolved 198.18.1.139     api.crittercism.com          0.0.0.0          Not resolved 198.18.1.140     gs-loc.ls-apple.com.akadns.net 0.0.0.0          Not resolved 198.18.1.141     iphone.feed.cdlvis.com       0.0.0.0          Not resolved 198.18.1.142     orcart.facebook.com          0.0.0.0          Not resolved 198.18.1.143     www.google.com               0.0.0.0          Not resolved 198.18.1.144     m.quantcount.com             0.0.0.0          Not resolved 198.18.1.145     p.brilig.com                 0.0.0.0          Not resolved 198.18.1.146     www.kitz.co.uk               0.0.0.0          Not resolved 198.18.1.115     www.googletagmanager.com     0.0.0.0          Not resolved 198.18.1.116     www-google-analytics.l.google.com 0.0.0.0          Not resolved 198.18.1.117     autoexpress.uk.intellitxt.com 0.0.0.0          Not resolved 198.18.1.118     www.subsinfo.co.uk           0.0.0.0          Not resolved 198.18.1.119     www.youronlinechoices.eu     0.0.0.0          Not resolved 198.18.1.120     www.cyclistmag.co.uk         0.0.0.0          Not resolved

I therefore postulate the following sequence of events is occurring...
1. The TG / PN DNS resolvers (in conjunction) failed to resolve the initial resolution request and supplied a spoofed IP address (rather than returning none***?)
2. The browser TAB accepted this address and cached it WITHIN the TAB's CONTEXT and simply reused it believing it to be a valid address.
3. In launching a new TAB IE / Windows decided (?) to re-resolve the address rather than using the cached spoofed IP address thereby resulting in a successful connection.
Questions...
1. Why is PN's DNS failing to deliver name resolutions from time to time?
2. Why when there is no resolution does the TG deliver a spoofed IP address?

Implied conclusion:
Windows caches address resolutions in the context of the application rather than (as I thought) at system / TC/IP stack level.
Having spooked a resolution, the TG router queries DNS again if asked for the same address again... and does not update the spoofed list if resolved.
Anyone know if this is how this should work?
Kevin
***EDIT: I just tried to browse to http://thissillydomaindoesnotexist.com and as expected got the "This page cannot be displayed" message, but no new spoofed entry in the TG.  Is it possible that at some level there is a different resolver response indicating that an address is completely unknown as opposed to this is a recognised domain name, but I do not have an address (or current address) for it?

[#3]

If as far as the TG582n is concerned an address was resolved - ie it went to an external DNS, there would be no entry in the table, even if the address didn't exist..

[#4]

Can I ask, does anyone know what DNS application that the TG582n uses ? - is it "Dnsmasq" or something similar ?
The way that these programs deal with failed/invalid lookups can often be tweaked to give better outcomes.

[#5]

The vast majority of the technicolor firmware is custom technicolor software. The DNS server, along with pretty much everything else, is in one single huge program called linux_appl.exe.
Of course, you could just disable the WANDownSpoofing feature.

[#6]

Hi ejs,
Can you explain what this does, why it does it and the consequence of disabling it please?
Just looked here - http://community.plus.net/forum/index.php/topic,116173.msg1002953.html#msg1002953 - and Matt notes that spoofing should only be seen when the WAN interface is down.
Reading around, it seems that this might be the explanation of why people have seen the TG welcome page on unexpected occasions, even though their internet connection is up.
This seems to point to a conjunction of two failures (1) PN DNS failure to deliver a resolution and (2) the TG delivering a spoofed address when the WAN is actually up.
Cheers,
Kevin

EDIT: @CRT see post 15 here - http://www.gpforums.co.nz/threads/478377-Windows-8-1-Upgrade-Ramifications - there is a suggestion there that there is a specific issue between Win8 and TGs
See also posts here - http://answers.microsoft.com/en-us/windows/forum/windows_8-networking/internet-connection-dropping-w... - from 12 Jan 2014 onwards.

Is this on your / the CSC / Product's radar?

[#7]

I've used win 8.1 with a Technicolor router (TG672) for over a year now and never seen this issue.
Although I always disable web browsing intercept in the routers GUI. Years ago there was a issue (sorry can't remember the details now) with this setting and it was common advice to disable it. The issue was probably fixed years ago but I still disable the setting out of habit.

[#8]

Quote from: npr

I always disable web browsing intercept in the routers GUI The issue was probably fixed years ago but I still disable the setting out of habit.

For clarity, I too do not have web browsing intercept set.  That TG model might not exhibit the spoofing issue.
It looks like there are a number of things going wrong here which ought not to be happening, that I suspect have been made worse by Win8 / Win8.1 "improving" the use of its name resolution cache thereby avoiding repeated DNS lookups.  This sounds like a highly desirable thing to do, but is well and truly fouled up when the DNS server fails to deliver a good resolution and the TG router decides to spoof the address even though the WAN interface is up.

[#9]

Quote from: Townman

***EDIT: I just tried to browse to http://thissillydomaindoesnotexist.com and as expected got the "This page cannot be displayed" message, but no new spoofed entry in the TG.  Is it possible that at some level there is a different resolver response indicating that an address is completely unknown as opposed to this is a recognised domain name, but I do not have an address (or current address) for it?

It is just so tempting to register that domain and then post back on here that when I tried it it worked!

[#10]

I laughed so much that it made me cry!
THANK YOU!
Simply LOVE it! 

[#11]

Is there any way of altering the length of time that Windows 8 holds it's DNS cache entries for, perhaps a registry tweak to reduce the TTL ?

[#12]

Purleigh,
I am not convinced that it is that simple.  On Win7 this morning I had one IE11 tab not connecting whilst another one did.  That implies name resolution caching within instances of programs.
If (as I have strongly hinted) PN DNS delivered resolutions on-time first-time we would not be having this discussion in the first place!
Kevin

[#13]

Other than for the challenge in solving this problem, why are you using Plusnet DNS ?
Both OpenDNS and Google are more reliable, faster, and can resolve more sites than the Plusnet DNSes can.

I gave up using Plusnet DNS (and other account facilities such as email, CGI, etc) years ago, because Plusnet never get around to making them work properly - and life is too short when alternatives are available that work properly.

[#14]

Good question - I guess it is a matter of it being the standard set up as used by the majority of users.
I suppose that I have two three fairly valid answers...
1. If anything breaks I can "point my finger" towards PlusNet for resolutions
2. If I am helping other users on the forums I see little point to having a configuration markedly different from what they are likely to have and then exclaim "well it works for me!"
3. If there are issues with PN's services, using them "as standard" and carefully observing what is happening (as per this weekend) might furnish them with enough information to fix them or at the very least inform the support channel that there is an issue which the need to be aware of.
Cheers,
Kevin

[#15]

Quote from: Townman

On Win7 this morning I had one IE11 tab not connecting whilst another one did.  That implies name resolution caching within instances of programs.

Sorry I don't see that, it implies the opposite to me.
Are you thinking of dns prefetching?
https://support.f5.com/kb/en-us/solutions/public/13000/900/sol13930.html
Would you happen to be running McAfee on the win7 machine as well? 
Don't know how recent this "recent update issue" is. eg
To resolve issues such as interrupted Internet access
http://home.mcafee.com/legacyeol/productupdate.aspx?ctst=1