Disappearing DNS

Hi, I have a weird problem. This morning some of our clients were having
problems accessing the internet. I investigated and found that they had lost
there DNS settings which were assigned by a 2003 DHCP server. I did an
ipconfig/renew and they came back again.........but not for long! Some
clients seems to work ok now but there is still a number which only hold
onto there DNS settings for approx 20 - 40 minutes. They do not lose their
own IP, WINS or gateway though. As a temporary workaround I have added the
DNS server entries into there network connection. I have put procmon on a
machine and told it to filter on
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\
to see if I can find what is accessing the reg key but so far the machine
has been ok - typical!

FYI the servers and clients have been rebooted recently after putting the
latest windows updates on.

Any ideas?

What is the dhcp lease renewal interval set to?

"Paul" wrote:

> Hi, I have a weird problem. This morning some of our clients were having
> problems accessing the internet. I investigated and found that they had lost
> there DNS settings which were assigned by a 2003 DHCP server. I did an
> ipconfig/renew and they came back again.........but not for long! Some
> clients seems to work ok now but there is still a number which only hold
> onto there DNS settings for approx 20 - 40 minutes. They do not lose their
> own IP, WINS or gateway though. As a temporary workaround I have added the
> DNS server entries into there network connection. I have put procmon on a
> machine and told it to filter on
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\
> to see if I can find what is accessing the reg key but so far the machine
> has been ok - typical!
>
> FYI the servers and clients have been rebooted recently after putting the
> latest windows updates on.
>
> Any ideas?
>
>
>
>

2 days

"Joshua Bolton" <(E-Mail Removed)> wrote in message
news:28F16A83-1780-41C4-8DF3-(E-Mail Removed)...
> What is the dhcp lease renewal interval set to?
>
> "Paul" wrote:
>
>> Hi, I have a weird problem. This morning some of our clients were having
>> problems accessing the internet. I investigated and found that they had
>> lost
>> there DNS settings which were assigned by a 2003 DHCP server. I did an
>> ipconfig/renew and they came back again.........but not for long! Some
>> clients seems to work ok now but there is still a number which only hold
>> onto there DNS settings for approx 20 - 40 minutes. They do not lose
>> their
>> own IP, WINS or gateway though. As a temporary workaround I have added
>> the
>> DNS server entries into there network connection. I have put procmon on a
>> machine and told it to filter on
>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\
>> to see if I can find what is accessing the reg key but so far the machine
>> has been ok - typical!
>>
>> FYI the servers and clients have been rebooted recently after putting the
>> latest windows updates on.
>>
>> Any ideas?
>>
>>
>>
>>

What about a rogue DHCP server that would send incorrect informations? I
doubt it because you said the renewal time is 2 days.

Have you tried to use Microsoft Network Monitor on your XP clients and
filter on DHCP to see what could be wrong?

"Paul" wrote:

> 2 days
>
> "Joshua Bolton" <(E-Mail Removed)> wrote in message
> news:28F16A83-1780-41C4-8DF3-(E-Mail Removed)...
> > What is the dhcp lease renewal interval set to?
> >
> > "Paul" wrote:
> >
> >> Hi, I have a weird problem. This morning some of our clients were having
> >> problems accessing the internet. I investigated and found that they had
> >> lost
> >> there DNS settings which were assigned by a 2003 DHCP server. I did an
> >> ipconfig/renew and they came back again.........but not for long! Some
> >> clients seems to work ok now but there is still a number which only hold
> >> onto there DNS settings for approx 20 - 40 minutes. They do not lose
> >> their
> >> own IP, WINS or gateway though. As a temporary workaround I have added
> >> the
> >> DNS server entries into there network connection. I have put procmon on a
> >> machine and told it to filter on
> >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\
> >> to see if I can find what is accessing the reg key but so far the machine
> >> has been ok - typical!
> >>
> >> FYI the servers and clients have been rebooted recently after putting the
> >> latest windows updates on.
> >>
> >> Any ideas?
> >>
> >>
> >>
> >>

Hi, at first I thought it could be another DHCP server but it was giving out
all the correct IP settings. I also disabled the DHCP server to see if
anything else answered the request. I don't think the network monitor will
help as the client receives the correct DNS settings but they then disappear
completely - a /renew gets them back.

"Yann" <(E-Mail Removed)> wrote in message
news:BBB4A66D-6859-43AB-9F18-(E-Mail Removed)...
> What about a rogue DHCP server that would send incorrect informations? I
> doubt it because you said the renewal time is 2 days.
>
> Have you tried to use Microsoft Network Monitor on your XP clients and
> filter on DHCP to see what could be wrong?
>
> "Paul" wrote:
>
>> 2 days
>>
>> "Joshua Bolton" <(E-Mail Removed)> wrote in message
>> news:28F16A83-1780-41C4-8DF3-(E-Mail Removed)...
>> > What is the dhcp lease renewal interval set to?
>> >
>> > "Paul" wrote:
>> >
>> >> Hi, I have a weird problem. This morning some of our clients were
>> >> having
>> >> problems accessing the internet. I investigated and found that they
>> >> had
>> >> lost
>> >> there DNS settings which were assigned by a 2003 DHCP server. I did an
>> >> ipconfig/renew and they came back again.........but not for long! Some
>> >> clients seems to work ok now but there is still a number which only
>> >> hold
>> >> onto there DNS settings for approx 20 - 40 minutes. They do not lose
>> >> their
>> >> own IP, WINS or gateway though. As a temporary workaround I have added
>> >> the
>> >> DNS server entries into there network connection. I have put procmon
>> >> on a
>> >> machine and told it to filter on
>> >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\
>> >> to see if I can find what is accessing the reg key but so far the
>> >> machine
>> >> has been ok - typical!
>> >>
>> >> FYI the servers and clients have been rebooted recently after putting
>> >> the
>> >> latest windows updates on.
>> >>
>> >> Any ideas?
>> >>
>> >>
>> >>
>> >>

I dunno - my first thought was rogue dhcp server too. Turn it off on
your server, and run tcpdump on one of your machines to monitor traffic
for ports 67 and 68. If you see dhcp requests, and then see dhcp
replies, you'll know you have a problem.

Another thing you could check is the IP address of the dhcp server when
you're having the problem. Look at ipconfig /all for that information.
If it's not what you expected, you'll know where to go.

grep

Paul wrote:
> Hi, at first I thought it could be another DHCP server but it was giving
> out all the correct IP settings. I also disabled the DHCP server to see
> if anything else answered the request. I don't think the network monitor
> will help as the client receives the correct DNS settings but they then
> disappear completely - a /renew gets them back.
>
> "Yann" <(E-Mail Removed)> wrote in message
> news:BBB4A66D-6859-43AB-9F18-(E-Mail Removed)...
>
>> What about a rogue DHCP server that would send incorrect informations? I
>> doubt it because you said the renewal time is 2 days.
>>
>> Have you tried to use Microsoft Network Monitor on your XP clients and
>> filter on DHCP to see what could be wrong?
>>
>> "Paul" wrote:
>>
>>> 2 days
>>>
>>> "Joshua Bolton" <(E-Mail Removed)> wrote in
>>> message
>>> news:28F16A83-1780-41C4-8DF3-(E-Mail Removed)...
>>> > What is the dhcp lease renewal interval set to?
>>> >
>>> > "Paul" wrote:
>>> >
>>> >> Hi, I have a weird problem. This morning some of our clients were
>>> >> having
>>> >> problems accessing the internet. I investigated and found that
>>> they >> had
>>> >> lost
>>> >> there DNS settings which were assigned by a 2003 DHCP server. I
>>> did an
>>> >> ipconfig/renew and they came back again.........but not for long!
>>> Some
>>> >> clients seems to work ok now but there is still a number which
>>> only >> hold
>>> >> onto there DNS settings for approx 20 - 40 minutes. They do not lose
>>> >> their
>>> >> own IP, WINS or gateway though. As a temporary workaround I have
>>> added
>>> >> the
>>> >> DNS server entries into there network connection. I have put
>>> procmon >> on a
>>> >> machine and told it to filter on
>>> >>
>>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\
>>>
>>> >> to see if I can find what is accessing the reg key but so far the
>>> >> machine
>>> >> has been ok - typical!
>>> >>
>>> >> FYI the servers and clients have been rebooted recently after
>>> putting >> the
>>> >> latest windows updates on.
>>> >>
>>> >> Any ideas?
>>> >>
>>> >>
>>> >>
>>> >>

Hi, thanks for your response. I solved the problem in the end yesterday. I
had tested for other DHCP servers but got no response.I used Microsoft's
latest network monitor and discovered that the OSX server we use for testing
had, according to the Apple guys, turned on its DHCP server after an update.
This DHCP server was not configured but for some reason the XP clients would
accept the blank DNS settings from this server even though they would get
the correct settings from the Windows 2003 server. I am not sure why but the
XP clients seem to try to renew these DNS settings every minute instead of
the usual time periods for a DHCP lease.




"grep" <(E-Mail Removed)> wrote in message
news:#(E-Mail Removed)...
>I dunno - my first thought was rogue dhcp server too. Turn it off on your
>server, and run tcpdump on one of your machines to monitor traffic for
>ports 67 and 68. If you see dhcp requests, and then see dhcp replies,
>you'll know you have a problem.
>
> Another thing you could check is the IP address of the dhcp server when
> you're having the problem. Look at ipconfig /all for that information. If
> it's not what you expected, you'll know where to go.
>
> grep
>
> Paul wrote:
>> Hi, at first I thought it could be another DHCP server but it was giving
>> out all the correct IP settings. I also disabled the DHCP server to see
>> if anything else answered the request. I don't think the network monitor
>> will help as the client receives the correct DNS settings but they then
>> disappear completely - a /renew gets them back.
>>
>> "Yann" <(E-Mail Removed)> wrote in message
>> news:BBB4A66D-6859-43AB-9F18-(E-Mail Removed)...
>>
>>> What about a rogue DHCP server that would send incorrect informations? I
>>> doubt it because you said the renewal time is 2 days.
>>>
>>> Have you tried to use Microsoft Network Monitor on your XP clients and
>>> filter on DHCP to see what could be wrong?
>>>
>>> "Paul" wrote:
>>>
>>>> 2 days
>>>>
>>>> "Joshua Bolton" <(E-Mail Removed)> wrote in
>>>> message
>>>> news:28F16A83-1780-41C4-8DF3-(E-Mail Removed)...
>>>> > What is the dhcp lease renewal interval set to?
>>>> >
>>>> > "Paul" wrote:
>>>> >
>>>> >> Hi, I have a weird problem. This morning some of our clients were
>>>> >> having
>>>> >> problems accessing the internet. I investigated and found that
>>>> they >> had
>>>> >> lost
>>>> >> there DNS settings which were assigned by a 2003 DHCP server. I
>>>> did an
>>>> >> ipconfig/renew and they came back again.........but not for long!
>>>> Some
>>>> >> clients seems to work ok now but there is still a number which
>>>> only >> hold
>>>> >> onto there DNS settings for approx 20 - 40 minutes. They do not lose
>>>> >> their
>>>> >> own IP, WINS or gateway though. As a temporary workaround I have
>>>> added
>>>> >> the
>>>> >> DNS server entries into there network connection. I have put
>>>> procmon >> on a
>>>> >> machine and told it to filter on
>>>> >>
>>>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\
>>>> >> to see if I can find what is accessing the reg key but so far the
>>>> >> machine
>>>> >> has been ok - typical!
>>>> >>
>>>> >> FYI the servers and clients have been rebooted recently after
>>>> putting >> the
>>>> >> latest windows updates on.
>>>> >>
>>>> >> Any ideas?
>>>> >>
>>>> >>
>>>> >>
>>>> >>