Peculiar name resolution problem on VirginMedia cable connection

For many months I've had http://www.google.co.uk/advanced_search?hl=en as
one of my browser home pages. Suddenly it no longer works. I cannot ping
or traceroute www.google.co.uk because that address no longer resolves.
But, www.google.com does work.

I've rebooted my laptop serveral times and had both the router & cable-modem
powered off and back on several times. I'm using a Virgin Media connection
and am assuming that there's a problem in their name servers.

My router says it is using 194.168.4.100 as the primary DNS
and 194.168.8.100 as the secondary;

- I presume it gets those addresses assigned by DHCP by VM when my cable
modem connects to them, since I certainly don't manually define what DNS
servers to use.

Can anyone else with a VM connection see a problem?

Does anyone else think I should hard-code DNS server addresses in the
router?

--
Jeremy C B Nicoll - my opinions are my own.

Jeremy Nicoll - news posts wrote:
> For many months I've had http://www.google.co.uk/advanced_search?hl=en as
> one of my browser home pages. Suddenly it no longer works. I cannot ping
> or traceroute www.google.co.uk because that address no longer resolves.
> But, www.google.com does work.
>
> I've rebooted my laptop serveral times and had both the router & cable-modem
> powered off and back on several times. I'm using a Virgin Media connection
> and am assuming that there's a problem in their name servers.
>
> My router says it is using 194.168.4.100 as the primary DNS
> and 194.168.8.100 as the secondary;

Same sort of symptom I saw a year or so back. I've a call open about
problems with ...8.100; opened in Sept, and closed (unfixed &
unannounced) and reopened a few weeks ago.

Progress? Nil. I think only the tea lady can be left in tech support.


(The problem seems to be duff dns data from that machine; correct udp
checksums, so it has to be a faulty dns server or transparent dns proxy.
Paranoia makes me wonder about a phorm link - iirc someone said BT
meddled with dns while trialling phorm. Originally I got duff packets
with correct checksums from various unrelated non-vm dns servers - hence
my transparent proxy suspicions.)


>
> - I presume it gets those addresses assigned by DHCP by VM when my cable
> modem connects to them, since I certainly don't manually define what DNS
> servers to use.

Yes.

>
> Can anyone else with a VM connection see a problem?

Yes, but I run my own lan dns server and can work round it. VM won't
take the blinkers off afaict.

>
> Does anyone else think I should hard-code DNS server addresses in the
> router?
>
Try losing the '8' machine and see if that improves things. Otherwise
OpenDNS maybe?


--
Mike Scott (unet <at> scottsonline.org.uk)
Harlow Essex England

In uk.telecom.broadband, on Thu, 20 Mar 2008 13:26:40, Jeremy Nicoll -
news posts wrote:

>Does anyone else think I should hard-code DNS server addresses in the
>router?

You could put 4.2.2.1 in your local config. Assuming VM don't hijack
port 53...

Your headers suggest Windows XP, but aren't you using Linux? If
Windows, install Treewalk http://treewalkdns.com.

--
Jim Crowther

Jim Crowther <Don'(E-Mail Removed)> wrote:

> In uk.telecom.broadband, on Thu, 20 Mar 2008 13:26:40, Jeremy Nicoll -
> news posts wrote:
>
> >Does anyone else think I should hard-code DNS server addresses in the
> >router?
>
> You could put 4.2.2.1 in your local config. Assuming VM don't hijack
> port 53...
>
> Your headers suggest Windows XP, but aren't you using Linux? If
> Windows, install Treewalk http://treewalkdns.com.

Linux? Me? What gave you that idea? (Until a year or two ago I used RISC
OS; I have a feeling there used to be a Unix variant with a similar name,
but now I use XP and sometimes a RO emulation under XP - these problems are
all innative XP.)

--
Jeremy C B Nicoll - my opinions are my own.

Jeremy Nicoll - news posts <(E-Mail Removed)> wrote:

> For many months I've had http://www.google.co.uk/advanced_search?hl=en as
> one of my browser home pages. Suddenly it no longer works. I cannot ping
> or traceroute www.google.co.uk because that address no longer resolves.
> But, www.google.com does work.
>
> I've rebooted my laptop serveral times and had both the router &
> cable-modem powered off and back on several times. I'm using a Virgin
> Media connection and am assuming that there's a problem in their name
> servers.
>
> My router says it is using 194.168.4.100 as the primary DNS
> and 194.168.8.100 as the secondary;
>
> - I presume it gets those addresses assigned by DHCP by VM when my cable
> modem connects to them, since I certainly don't manually define what DNS
> servers to use.

I've since turned on a lot more logging in ZoneAlarm and seen that incoming
info from those DNS servers were being blocked (though I dunno how /any/ DNS
was working, that being so).

I looked at the DNS servers I'd previously told ZA were to be 'trusted' and
found I'd two other addresses defined: 62.31.64.39 and 62.31.112.39 - which
were BlueYonder servers. I added the new pair and it's all working again.

I can't help feeling that VM shouldn't have changed their server addresses
without some publicity.

--
Jeremy C B Nicoll - my opinions are my own.

"Jeremy Nicoll - news posts" <(E-Mail Removed)>
wrote in message
news:(E-Mail Removed) .invalid...
> Jeremy Nicoll - news posts <(E-Mail Removed)>
> wrote:
>
>> For many months I've had
>> http://www.google.co.uk/advanced_search?hl=en as
>> one of my browser home pages. Suddenly it no longer works. I cannot
>> ping
>> or traceroute www.google.co.uk because that address no longer
>> resolves.
>> But, www.google.com does work.
>>
>> I've rebooted my laptop serveral times and had both the router &
>> cable-modem powered off and back on several times. I'm using a
>> Virgin
>> Media connection and am assuming that there's a problem in their name
>> servers.
>>
>> My router says it is using 194.168.4.100 as the primary DNS
>> and 194.168.8.100 as the secondary;
>>
>> - I presume it gets those addresses assigned by DHCP by VM when my
>> cable
>> modem connects to them, since I certainly don't manually define what
>> DNS
>> servers to use.
>
> I've since turned on a lot more logging in ZoneAlarm and seen that
> incoming
> info from those DNS servers were being blocked (though I dunno how
> /any/ DNS
> was working, that being so).
>
> I looked at the DNS servers I'd previously told ZA were to be
> 'trusted' and
> found I'd two other addresses defined: 62.31.64.39 and 62.31.112.39 -
> which
> were BlueYonder servers. I added the new pair and it's all working
> again.
>
> I can't help feeling that VM shouldn't have changed their server
> addresses
> without some publicity.
>
> --
> Jeremy C B Nicoll - my opinions are my own.



They haven't. 194.168.4.100 and .....8.100 have been the DNS servers
since I've been on broadband - at least six years.


--
Woody

harrogate three at ntlworld dot com

In uk.telecom.broadband, on Sat, 22 Mar 2008 20:16:50, Woody wrote:

>"Jeremy Nicoll - news posts" <(E-Mail Removed)>
>wrote in message
[]
>> I've since turned on a lot more logging in ZoneAlarm and seen that
>> incoming
>> info from those DNS servers were being blocked (though I dunno how
>> /any/ DNS
>> was working, that being so).
>>
>> I looked at the DNS servers I'd previously told ZA were to be
>> 'trusted' and
>> found I'd two other addresses defined: 62.31.64.39 and 62.31.112.39 -
>> which
>> were BlueYonder servers. I added the new pair and it's all working
>> again.
>>
>> I can't help feeling that VM shouldn't have changed their server
>> addresses
>> without some publicity.
>
>They haven't. 194.168.4.100 and .....8.100 have been the DNS servers
>since I've been on broadband - at least six years.

194.168.4.100 looks like a cache, while the others are actual
nameservers.

If an ISP has DNS issues, it's time to install Treewalk.

--
Jim Crowther

"Woody" <(E-Mail Removed)> wrote:

> > I looked at the DNS servers I'd previously told ZA were to be 'trusted'
> > and found I'd two other addresses defined: 62.31.64.39 and 62.31.112.39
> > - which were BlueYonder servers. I added the new pair and it's all
> > working again.

> They haven't. 194.168.4.100 and .....8.100 have been the DNS servers
> since I've been on broadband - at least six years.

Well, your sig mentions harrogate. If that's anywhere near where you live
then perhaps you were part of the ntl network rather than telewest/
blueyonder? Or maybe they are the default DNS servers for people not in
Edinburgh?

The 62.31.64.39 and 62.31.112.39 addresses were those I used to get set in
my router when I connected to TW/BY/VM, and the 194.168 ones are what I get
now. I didn't change this myself; it was forced on me externally.


Googling this morning on the old and new address values is what made me
think this might be a TW/BY -> VM change. Consider this traceroute which I
just did a minute or two ago:

tracert ns1-edi.blueyonder.net

Tracing route to ns1-edi.blueyonder.net [62.31.64.39]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms router [192.168.1.1]
2 10 ms 7 ms 8 ms 10.123.184.1
3 7 ms 18 ms 9 ms 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
[77.96.1.34]
4 8 ms 7 ms 9 ms 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
[62.31.64.39]

Trace complete.

which tends to bear that out. Also:

nslookup 62.31.64.39
Server: my.router
Address: 192.168.1.1
Name: 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
Address: 62.31.64.39


nslookup 62.31.112.39
Server: my.router
Address: 192.168.1.1
Name: 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
Address: 62.31.112.39

-- interesting that those two machines have the same name - so are
they in fact just one machine?

nslookup 194.168.4.100
Server: my.router
Address: 192.168.1.1
Name: cache1.ntli.net
Address: 194.168.4.100


nslookup 194.168.8.100
Server: my.router
Address: 192.168.1.1
Name: cache2.ntli.net
Address: 194.168.8.100

-- whereas these seem to be NTL rather than BY...

--
Jeremy C B Nicoll - my opinions are my own.

"Jeremy Nicoll - news posts" <(E-Mail Removed)>
wrote in message
news:(E-Mail Removed) .invalid...
> "Woody" <(E-Mail Removed)> wrote:
>
>> > I looked at the DNS servers I'd previously told ZA were to be
>> > 'trusted'
>> > and found I'd two other addresses defined: 62.31.64.39 and
>> > 62.31.112.39
>> > - which were BlueYonder servers. I added the new pair and it's all
>> > working again.
>
>> They haven't. 194.168.4.100 and .....8.100 have been the DNS servers
>> since I've been on broadband - at least six years.
>
> Well, your sig mentions harrogate. If that's anywhere near where you
> live
> then perhaps you were part of the ntl network rather than telewest/
> blueyonder? Or maybe they are the default DNS servers for people not
> in
> Edinburgh?
>
> The 62.31.64.39 and 62.31.112.39 addresses were those I used to get
> set in
> my router when I connected to TW/BY/VM, and the 194.168 ones are what
> I get
> now. I didn't change this myself; it was forced on me externally.
>
>
> Googling this morning on the old and new address values is what made
> me
> think this might be a TW/BY -> VM change. Consider this traceroute
> which I
> just did a minute or two ago:
>
> tracert ns1-edi.blueyonder.net
>
> Tracing route to ns1-edi.blueyonder.net [62.31.64.39]
> over a maximum of 30 hops:
>
> 1 <1 ms <1 ms <1 ms router [192.168.1.1]
> 2 10 ms 7 ms 8 ms 10.123.184.1
> 3 7 ms 18 ms 9 ms
> 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
> [77.96.1.34]
> 4 8 ms 7 ms 9 ms
> 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
> [62.31.64.39]
>
> Trace complete.
>
> which tends to bear that out. Also:
>
> nslookup 62.31.64.39
> Server: my.router
> Address: 192.168.1.1
> Name: 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
> Address: 62.31.64.39
>
>
> nslookup 62.31.112.39
> Server: my.router
> Address: 192.168.1.1
> Name: 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
> Address: 62.31.112.39
>
> -- interesting that those two machines have the same name - so are
> they in fact just one machine?
>
> nslookup 194.168.4.100
> Server: my.router
> Address: 192.168.1.1
> Name: cache1.ntli.net
> Address: 194.168.4.100
>
>
> nslookup 194.168.8.100
> Server: my.router
> Address: 192.168.1.1
> Name: cache2.ntli.net
> Address: 194.168.8.100
>
> -- whereas these seem to be NTL rather than BY...
>
> --
> Jeremy C B Nicoll - my opinions are my own.


Agreed, I was NTL - which in Hgte was Bell Cablemedia (I think) - so
I've never known anything different.

I know it costs 50p a minute but the NTL tech support people are usually
very good, UK, and don't answer until they can talk to you.


--
Woody

harrogate three at ntlworld dot com