Jay wrote:
> Hi,
>
> Thanks for the responses.
>
> From some reading I found the following _might_ be the problem:
Reverse
> DNS lookups (even for local addresses - 192.168.x.x) timing out with
> the ISP's nameservers. This problem also comes up when I SSH into the
> box via VPN - after giving the password, it takes a few seconds (<10)
> to get to the prompt.
They _should_ time out -- this is good
> If I do a traceroute from the Linux box (192.168.2.253) to the
Windows
> system (192.168.2.254), it is painfully slow, eventhough it is only
one
> hop --
Still no $ /sbin/route -n output or explicit confirmation that .253 and
..254 are on the same subnet. Presume so. Means there are _no_ hops
between them. None of their frames to each other should enter a
router. Just ARP, build an ethernet frame, and ship off the packets.
> # traceroute 192.168.2.254
> traceroute to 192.168.2.254 (192.168.2.254), 30 hops max, 38 byte
> packets
> <<-- 15 sec delay -->>
> 1 192.168.2.254 (192.168.2.254) 0.160 ms 0.162 ms 0.093 ms
>
> The packets I captured with tcpdump show that for the traceroute
above,
> it queries the two DNS servers at the ISP... after the first server
> times-out, I see an ARP request "who has 192.168.2.254? Tell
> 192.168.2.253". Then for some reason, it queries the second DNS
server,
> and obviously that times-out as well.
For the traceroute, it indicates broken route tables or TCP settings.
My vote is broken route table(s). Or one _really_ messed up firewall.
Because you have provided no local means to resolve the _names_ the DNS
servers of the ISP are consulted (that's what your resolv.conf said to
do).
> When I rename the file /etc/resolv.conf - everything speeds up. The
> apps on Tomcat are as fast as possible, and the traceroute to Windows
> is also fast.
Did you clear the ARP caches of all the hosts before "testing"?
Not being able to see your routing tables on the hosts I cannot give
you any confident answer -- so I offer none. Your resolv.conf is
vanilla -- you don't need the search term if it's left blank. Boinking
source? You never know.
> Also, when I add the windows box's IP to the /etc/hosts file, the
> delays between the systems is gone.
That's what the hosts file is for -- name resolution. At one time they
were used and maintained by "hand" on the _entire_ internet. How times
change
> However, I am not sure if either of these (renaming resolv.conf or
> adding _all_ local systems to the hosts file) are the right way to
fix
> the problem or avoid future issues.
What populates resolv.conf? DHCP server? You? Except to say you need
it now or will some day, I can't really offer an answer. My RH
resolv.conf file reads like this (populated via DHCP):
; generated by /sbin/dhclient-script
nameserver 24.204.0.4
nameserver 24.204.0.5
That's the whole thing -- every byte, nothing added. Did you edit or
add anything to the output below? The banners? Is that the exact
file?
/etc/hosts is a perfectly viable solution if you can mangage the files
on each host on your lan. The link I gave you is based on them but can
provide better service across subnets and acts as a DNS cache -- fewer
lookups at the ISP.
> I read online some instructions on editing the named.conf file, but
> would like to be sure if that is the way to go... I don't have this
> file, though I do have a named.custom file. Any pointers?
For a lan of modest size named is overkill -- you'll spend more time
setting it up, maintaining it, understanding it than you'll ever spend
with something like dnsmasq. Modest is, say, < 50, depending on
physical location/spread and how valuable is an excuse to get out from
the desk. Might even go to 100 if it allowed me to meet interesting
co-workers ;-)
Once you've built your hosts files and placed them they are not likely
to change that much -- one or two, here and there, now and then.
They can provide an avenue for mischief, but I've never had any
problems with them.
> Following are some of the files:
>
> --- begin /etc/resolv.conf---
> nameserver 205.171.3.65
> nameserver 198.6.1.3
> search
> --- end /etc/resolv.conf---
>
> --- begin /etc/hosts (real domain name replaced by xx) ---
> # Do not remove the following line, or various programs
> # that require network functionality will fail.
> 127.0.0.1 localhost.localdomain localhost
> 192.168.2.253 oakdev02.xx.com oakdev02
> --- end /etc/hosts ---
>
[snip]
I would go with /etc/hosts if possible. I would make sure I understood
very well the ins-n-outs of bind's setup if I _needed_ to _deploy_ it.
My first efforts would be to find a means not to need it

Get it
just a little wrong and you can mess up a network real fast -- with the
press of an ON button.
hth,
prg
email above disabled