INITIAL DELAY (was: Pls advise what is happening - IP addresses & port 53)

> Alix wrote on Fri, 09 Dec 2005 10:16:15 GMT:
>
>> BACKGROUND
>>
>> I am on NTL with no other PCs or printers attached. I use
>> FILSECLAB's personal firewall.
>>
>> I downloaded and installed "TreeWalk DNS" a week ago on my XP
>> Pro system. As I am in Europe I also installed the "ORSC
>> Slave-Root" package. I have to say I am not particularly
>> familiar with the technical details of DNS lookups.
>>
>> OBSERVATIONS
>>
>> Today I booted up. Before I manually launched anything I saw
>> the following entries shown below in my firewall monitor.
>>
>> These entries have worried me because for the last week my PC
>> has been hesitating for several seconds before connecting to
>> servers such as (http://www.google.com or an NNTP news servrer)
>> for the first time. Subsequent connections seems as fast as
>> usual.


On Mon 12 Dec 2005 09:54:37, Spack <(E-Mail Removed)>
wrote:
>
> [snipped the rest]
>
> You've installed a DNS server, and you're seeing the effects of
> having done do. NAMED (the DNS process) running at boot is
> completely normal, as it's installed as a service (that might
> give you a clue where to look to disable it if you want). It's
> connecting to multiple IPs on port 53 to do DNS lookups in
> response to what you're doing on your PC - web browsing, news
> reading, etc. DNS lookups are a bit slower because you're
> resolving direct to the root servers yourself, rather than
> letting a dedicated DNS server do it which might have already
> cached the information you need for popular sites. Those hosts
> you're seeing with port 53 open are due to them being
> authoritative DNS servers for domains you are trying to connect
> to, including a couple of Top Level Domain servers.
>
> I'd advise you to remove Treewalk. I'd also advise not running
> your own DNS server unless you know what you're doing. I've been
> running DNS servers here at work for 11 years, and I'd never
> bother installing one on my home PC.
>

Spack, I have removed Treewalk but I *STILL* get the same problem of
a very slow resolution of my first DNS query. Maybe something like 5
seconds. Subsequent DNS names are resolved are very fast.

Just to remind you, I run XP Pro with SP2. I have a standalone XP
Pro machine attached direct to a cable modem and then to the Net.
There are no printers or other PCs attached via any local network.

If I shut down my browser (Opera) and then relaunch it I find I start
again with a very slow resolution of the first address I type in
which is usually Google. I get the same "slow first use" on my
newsreader.

My 3rd party firewall's monitor shows me that the initial delay is
happening INSIDE my machine because there is no attempt to go through
the firewall for several seconds.

Looking around Google someone else had the same problem on what I
think is a Linux machine: they wrote that they resolved it by using
this command:
route add default gw 192.168.0.1
Could this work for me? Or could it screw things up as I do not have
a networked machine.

Maybe I have got something running on my machine which I do not need
to have running and which causes this delay? From the XP services
screen I have selected these to show you what see I have got running.

DCOM Server Process Launcher
DHCP Client
DNS Client
Remote Access Connection Manager
Remote Procedure Call
Remote Registry
Secondary Logon
Server
Windows Firewall/ICS

I disabled and stopped these:

DCOM Server Process Launcher (disabled only possible)
Remote Registry
Secondary Logon
Server
Windows Firewall/ICS (I use a 3rd party firewall)

I enabled & started this which I found in a stopped state:

Simple TCP/IP Services

On 19 Dec 2005 12:03, ALix <(E-Mail Removed)> wrote:

>Looking around Google someone else had the same problem on what I
>think is a Linux machine: they wrote that they resolved it by using
>this command:
> route add default gw 192.168.0.1
>Could this work for me? Or could it screw things up as I do not have
>a networked machine.

get an MS-DOS window and enter

route print

You should get something similar to

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.0.100 10.0.0.222 20
10.0.0.0 255.255.255.0 10.0.0.222 10.0.0.222 20
10.0.0.222 255.255.255.255 127.0.0.1 127.0.0.1 20
10.255.255.255 255.255.255.255 10.0.0.222 10.0.0.222 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
224.0.0.0 240.0.0.0 10.0.0.222 10.0.0.222 20
255.255.255.255 255.255.255.255 10.0.0.222 10.0.0.222 1
Default Gateway: 10.0.0.100
================================================== =========================
Persistent Routes:
Network Address Netmask Gateway Address Metric
17.250.248.0 255.255.255.0 10.0.0.200 1
151.164.0.0 255.255.0.0 10.0.0.200 1

In my case, a DNS lookup using the server 193.111.x.x will go to one of my
ADSL connections (gateway 10.0.0.100) while other lookups, if that one is
not working, can go to 151.164.x.x go via a second connection, 10.0.0.200.

I decided to use 10.0.0.100 for my main gateway IP as it is easy for me to
remember. Yours will depend on your kit, and the IP given in the earlier
post by someone else, their network. Your default connection will most
likely be that of your NTL cable modem anyway, so I doubt a change you
make will make it any faster. There might even be a chance your 'lease
time' (if applicable, using DHCP) means there's some negotiation before
you can do any DNS lookup, while your PC is allocated an IP address.

I was hoping that trying a 'ping' or 'tracert' would work immediately but
both, on my PC, seemed to hesitate (and for the tracert, there was quite
clearly a lookup as my "tracert 212.58.224.86" reported the IP as being
part of the BBC). Not sure if there's some easy way to force an attempt
to reach some remote service without any DNS lookup... Hmmm, even when
I try a telnet connection ('telnet 38.113.244.203') it seems to pause
the first time. Any ideas, anyone, for a way to force traffic without
a DNS lookup which might slow down the attempt... to see if the NIC is
allocated IP and in a working state or needing to check with the cable
modem for any details... Peter M


--
runbox.com - 10 GB of mail storage and 1000 MB for files...
30 day free trial... <http://2238.runbox.com/>
Can accept mail for your domain and apply filtering...
Point your MX record to mx.runbox.com and use POP/IMAP...

What's the output of "ipconfig /all"?

It might be as simple as Treewalk has removed itself but your computer is
still trying to access treewalk and has to wait for those queries to
timeout before it tries again..

--
Colin
*Drop DEAD from the email address to reply*