Networking Forums

Networking Forums > Wireless Networking > Wireless Internet > Is there a command that shows what's happening to a WISP at the DNSserver level?

Reply
Thread Tools Display Modes

Is there a command that shows what's happening to a WISP at the DNSserver level?

 
 
U vigilance
Guest
Posts: n/a

 
      09-23-2011, 08:49 PM
I am trying to figure out why my Santa Cruz mountains Surfnet WISP setup
takes so long to load a web page (even Google's bare bones home page
takes, sometimes far too long) so I'm trying to better understand how DNS
servers work.

What I have in my wrt54g home router is a set of three supposedly fast DNS
servers from this DNS server list:
http://theos.in/windows-xp/free-fast...ns-server-list

But, even so, on multiple computers in the home, Linux & Windoze, it
takes far too long to 'get' the web pages, even though speedtest.net
shows 18ms ping latency, 1Mbps upload, & 1.2 Mbps download.

I keep getting intermittent "Microtik hotspot errors" from Surfnet ...
and their (rather grouchy) technical support blamed my DNS servers setup.

I can't prove or disprove that until/unless I better understand DNS
servers, overall, and how they impact speed of loading (or not loading)
web pages.

Is 'this' what happens?

1. I type www.google.com in my laptop browser on PC 10.20.30.1
2. That "www.google.com" request goes wirelessly to my office wrt54g
router which is 10.20.30.40

THIS IS THE PART THAT I 'THINK' I UNDERSTAND ...

3. The office wrt54g router sends that "www.google.com" request to the
rooftop ubuquiti radio which is 192.168.10.20 but the office wrt54g
router must also be sending its DNS server list to the bridge (right?)
a) wrt54g DNS1 = 8.8.8.8
b) wrt54g DNS2 = 8.8.4.4
c) wrt54g DNS3 = 4.2.2.1
d) wrt54g WINS = blank

What command can I use to 'see' that DNS transaction?

4. My rooftop ubiquiti radio sends the "www.google.com" request & DNS
list to my rooftop antenna which sends it through the air to the Surfnet
line-of-sight antenna on 192.168.4.1

THIS IS THE PART I REALLY DON'T UNDERSTAND.

5. Surfnet sees that request for "www.google.com" and the list of three
DNS servers (I guess), and it forwards that "www.google.com" request to
the first of those DNS servers (I guess) which is 8.8.8.8.

6. The DNS server at 8.8.8.8 presumably forwards back the IP address of
"www.google.com" (e.g., 74.125.224.112) but a "traceroute www.google.com"
on Ubuntu doesn't seem to show any of that).

HOW DO I CHECK HOW LONG THE DNS SERVER IS TAKING TO RESPOND?


Here is a traceroute:


$ traceroute www.google.com
traceroute to www.google.com (74.125.224.112), 30 hops max, 60 byte
packets
1 10.20.30.40 (10.20.30.40) 2.587 ms 7.338 ms 7.903 ms
2 192.168.10.20 (192.168.10.20) 16.803 ms 17.272 ms 17.713 ms
3 192.168.4.1 (192.168.4.1) 20.221 ms 20.353 ms 20.523 ms
4 64.74.213.61 (64.74.213.61) 20.618 ms 20.837 ms 21.409 ms
5 sanjose-mk.surfnetc.com (64.74.213.193) 23.447 ms 23.628 ms 23.856
ms
6 border1.internap.surfnetc.com (66.151.140.1) 24.043 ms 5.466 ms
15.656 ms
7 border1.g6-3.surfcomm-3.sje003.pnap.net (64.95.143.165) 16.140 ms
16.763 ms 17.040 ms
8 core3.pc1-bbnet1.sje.pnap.net (66.151.144.3) 17.494 ms core3.pc2-
bbnet2.sje.pnap.net (66.151.144.67) 21.470 ms core3.pc1-
bbnet1.sje.pnap.net (66.151.144.3) 21.654 ms
9 xe-0-0-0-4.r06.snjsca04.us.bb.gin.ntt.net (128.241.219.129) 21.791
ms 21.941 ms 22.055 ms
10 ae-3.r07.snjsca04.us.bb.gin.ntt.net (129.250.5.59) 22.256 ms 25.348
ms 27.017 ms
11 xe-9-0-0.edge1.sanjose3.level3.net (4.68.110.49) 26.147 ms * 27.038
ms
12 * * *
13 you-tube-in.edge2.sanjose1.level3.net (4.79.40.178) 13.144 ms
13.649 ms 17.372 ms
14 72.14.232.136 (72.14.232.136) 17.558 ms 17.943 ms 18.496 ms
15 64.233.174.109 (64.233.174.109) 18.914 ms 26.702 ms 24.631 ms
16 74.125.224.112 (74.125.224.112) 26.859 ms 27.346 ms 27.018 ms

Obviously I'm confused but I'm trying to debug why web pages,
intermittently, take far too long to load (and one out of fifty fail
outright, giving a Microtik hotspot error, 192.168.4.1).

Is there a command that shows what is happening at the DNS server level?
 
Reply With Quote
 
 
 
 
Jeff Liebermann
Guest
Posts: n/a

 
      09-24-2011, 12:47 AM
On Fri, 23 Sep 2011 20:49:59 +0000 (UTC), U vigilance
<(E-Mail Removed)> wrote:

>I am trying to figure out why my Santa Cruz mountains Surfnet WISP setup
>takes so long to load a web page (even Google's bare bones home page
>takes, sometimes far too long) so I'm trying to better understand how DNS
>servers work.


Greeting from Ben Lomond.

>What I have in my wrt54g home router is a set of three supposedly fast DNS
>servers from this DNS server list:
> http://theos.in/windows-xp/free-fast...ns-server-list


Pick your server using Google Namebench or Gibson's DNSbench.
<http://www.grc.com/dns/benchmark.htm>
<http://code.google.com/p/namebench/>
The Google version is more thorough.

>But, even so, on multiple computers in the home, Linux & Windoze, it
>takes far too long to 'get' the web pages, even though speedtest.net
>shows 18ms ping latency, 1Mbps upload, & 1.2 Mbps download.


Are you cacheing DNSlookups in your router? If so, that may be the
problem. Some routers are just plane buggy. Unfortunately, the
WRT54G is one of those. If v4 and below, you're probably ok. If v5
or v6, they're garbage. I forgot what v7 and v8 are like.

>I keep getting intermittent "Microtik hotspot errors" from Surfnet ...
>and their (rather grouchy) technical support blamed my DNS servers setup.


I see you've talked to Brett. Say hellow for me. He's really a good
guy, but thoroughly overloaded and minimally supported.

You should NOT be seeing Microtik hotspot error messages unless
SurfnetC is running their mesh as a hot spot or that you're connecting
via wireless to their Mikrotik mesh router. My guess is the latter
and that you're having connection issues between your wireless
laptop/desktop and the Mikrotic wireless router on your roof? Since
they are both operating on the same RF channel, you're going to get
intererence from other users and other mesh routers connecting to it.

>I can't prove or disprove that until/unless I better understand DNS
>servers, overall, and how they impact speed of loading (or not loading)
>web pages.


Plenty of ways to screw up DNS lookups.

>Is 'this' what happens?
>1. I type www.google.com in my laptop browser on PC 10.20.30.1
>2. That "www.google.com" request goes wirelessly to my office wrt54g
>router which is 10.20.30.40


So far, so good. Have you tried taking the office wireless link out
of the picture and connecting to the WRT54G with a CAT5 cable? You
should.

>THIS IS THE PART THAT I 'THINK' I UNDERSTAND ...
>
>3. The office wrt54g router sends that "www.google.com" request to the
>rooftop ubuquiti radio which is 192.168.10.20 but the office wrt54g
>router must also be sending its DNS server list to the bridge (right?)
>a) wrt54g DNS1 = 8.8.8.8
>b) wrt54g DNS2 = 8.8.4.4
>c) wrt54g DNS3 = 4.2.2.1
>d) wrt54g WINS = blank


Close. The WRT54G router has a DNS cache inside. It will first look
in the unspecified operating system's DNS cache on the laptop for the
IP address. If Windoze XP, you can get this list with:
ipconfig /displaydns
You can also clear it with:
ipconfig /flushdns

If there's nothing for google on the laptop, it goes to whatever is
the default gateway. If your unspecified operating system on your
laptop has 10.20.30.40 as the default gateway, it will query
10.20.30.40 for the IP address. The WRT54G router also has a DNS
cache, where it looks for a match for google.com. If found, it
returns whatever is stored. There's no way to get to the DNS lookup
table with the stock firmware.

If nothing is found in the router, it goes to the first DNS server and
queries for www.google.com. (I do NOT want to dive into details on
how it parses the FQDN, TLD servers, or recursive lookups). If the
first DNS server is down or times out, it goes to the 2nd DNS server.
This usually takes about 30-45 seconds. If both the first and 2nd are
down, it goes to the third. It tries 3-4 times each and then gives up
with an error message, which could easily take over a minute.

>What command can I use to 'see' that DNS transaction?


What operating system are you using on your laptop?
It can't be done with the stock Linksys firmware.

>4. My rooftop ubiquiti radio sends the "www.google.com" request & DNS
>list to my rooftop antenna which sends it through the air to the Surfnet
>line-of-sight antenna on 192.168.4.1


I didn't know the SurfnetC is now using Ubiquiti. Are you sure?

>THIS IS THE PART I REALLY DON'T UNDERSTAND.
>
>5. Surfnet sees that request for "www.google.com" and the list of three
>DNS servers (I guess), and it forwards that "www.google.com" request to
>the first of those DNS servers (I guess) which is 8.8.8.8.
>
>6. The DNS server at 8.8.8.8 presumably forwards back the IP address of
>"www.google.com" (e.g., 74.125.224.112) but a "traceroute www.google.com"
>on Ubuntu doesn't seem to show any of that).


Ok, you're using Ubuntu. Good to know. Thanks.

For Ubuntu, you may or may not have the DNS cache (nscd) enabled:
<http://www.ubuntugeek.com/local-dns-cache-for-faster-browsing-on-ubuntu-machine.html>
<http://www.ubuntugeek.com/howto-clearflush-dns-cache-in-ubuntu.html>
If nscd is not installed, don't worry about the local cache. However,
if installed, look for corruption and garbage.

>HOW DO I CHECK HOW LONG THE DNS SERVER IS TAKING TO RESPOND?


Namebench or DNSbench. Namebench should run on Linux.

>Obviously I'm confused but I'm trying to debug why web pages,
>intermittently, take far too long to load (and one out of fifty fail
>outright, giving a Microtik hotspot error, 192.168.4.1).


Hint: Take as much of the intermediate hardware at your house out of
the picture. That means plug your PC directly into the
Mikrotic/Ubiquiti/whatever router. Test again.

>Is there a command that shows what is happening at the DNS server level?


Not that I know of.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558
 
Reply With Quote
 
Jeff Liebermann
Guest
Posts: n/a

 
      09-24-2011, 01:05 AM
On Fri, 23 Sep 2011 17:47:11 -0700, Jeff Liebermann <(E-Mail Removed)>
wrote:

>>Is there a command that shows what is happening at the DNS server level?


nslookup might be helpful. It will show which servers are being
queried, but not the relevent timing. If it takes a while to get a
response, then there are delays. Maybe someone has done a version
that includes timing. Dunno.

The idea behind the abcdefg.com is to find a domain that is probably
NOT in a cache somewhere. Much easier than flushing the caches. This
is Windoze XP because I'm too lazy to warm up the Linux laptop.

You can crank up the debug level with:
set d2

You can use Google DNS instead of your local DNS with
server 8.8.8.8

C:\> nslookup
Default Server: DD-WRT
Address: 192.168.1.1
> set type=ANY
> set debug
> set recurse
> www.abcdefg.com

Server: DD-WRT
Address: 192.168.1.1

------------
Got answer:
HEADER:
opcode = QUERY, id = 2, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 2,
additional = 0

QUESTIONS:
www.abcdefg.com, type = ANY, class = IN
ANSWERS:
-> www.abcdefg.com
internet address = 64.74.115.210
ttl = 7200 (2 hours)
AUTHORITY RECORDS:
-> abcdefg.com
nameserver = ns16.worldnic.com
ttl = 172800 (2 days)
-> abcdefg.com
nameserver = ns15.worldnic.com
ttl = 172800 (2 days)

------------
Non-authoritative answer:
www.abcdefg.com
internet address = 64.74.115.210
ttl = 7200 (2 hours)

abcdefg.com
nameserver = ns16.worldnic.com
ttl = 172800 (2 days)
abcdefg.com
nameserver = ns15.worldnic.com
ttl = 172800 (2 days)
>

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558
 
Reply With Quote
 
Jeff Liebermann
Guest
Posts: n/a

 
      09-24-2011, 01:10 AM
On Fri, 23 Sep 2011 18:05:03 -0700, Jeff Liebermann <(E-Mail Removed)>
wrote:

>nslookup might be helpful.


Also try dig.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558
 
Reply With Quote
 
Jeff Liebermann
Guest
Posts: n/a

 
      09-24-2011, 01:24 AM
On Fri, 23 Sep 2011 18:05:03 -0700, Jeff Liebermann <(E-Mail Removed)>
wrote:

>nslookup might be helpful.


Also try using "dig". It shows all the DNS servers that are being
queried and supplies the times. Nice.



C:\> dig www.abcdefghi.com +trace

; <<>> DiG 9.3.2 <<>> www.abcdefghi.com +trace
;; global options: printcmd
.. 248165 IN NS j.root-servers.net.
.. 248165 IN NS f.root-servers.net.
.. 248165 IN NS c.root-servers.net.
.. 248165 IN NS e.root-servers.net.
.. 248165 IN NS a.root-servers.net.
.. 248165 IN NS h.root-servers.net.
.. 248165 IN NS g.root-servers.net.
.. 248165 IN NS b.root-servers.net.
.. 248165 IN NS d.root-servers.net.
.. 248165 IN NS k.root-servers.net.
.. 248165 IN NS i.root-servers.net.
.. 248165 IN NS l.root-servers.net.
.. 248165 IN NS m.root-servers.net.
;; Received 500 bytes from 192.168.1.1#53(192.168.1.1) in 62 ms

com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
;; Received 507 bytes from 192.58.128.30#53(j.root-servers.net) in 125
ms

abcdefghi.com. 172800 IN NS ns1.hostingnet.com.
abcdefghi.com. 172800 IN NS ns2.hostingnet.com.
;; Received 114 bytes from 192.52.178.30#53(k.gtld-servers.net) in 250
ms

www.abcdefghi.com. 300 IN A 208.87.32.69
;; Received 51 bytes from 208.87.32.72#53(ns1.hostingnet.com) in 218
ms

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558
 
Reply With Quote
 
miso
Guest
Posts: n/a

 
      09-29-2011, 05:22 AM

>
> Pick your server using Google Namebench or Gibson's DNSbench.
> <http://www.grc.com/dns/benchmark.htm>
> <http://code.google.com/p/namebench/>
> The Google version is more thorough.


FWIW, I ran the google code. Their solution was twice as fast (so they
claim) as my isp DNS, so I changed the DNSs to their suggestions. I
don't know what I'm going to do with all the millisecond I've saved.
 
Reply With Quote
 
 
 
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Share level permissions from Command Prompt Matt Seitz Windows Networking 2 01-16-2007 04:57 PM
network actual bitrate (application level, tcp packet level) nirnimesh@gmail.com Linux Networking 1 01-24-2005 11:24 PM
Net session command shows IP address AnyBody43 Windows Networking 0 12-14-2004 09:13 AM
Firewalling at the domain users level instead of network level Santos Linux Networking 1 07-18-2004 02:16 PM
What is happening with 802.11a? Leo C Waible III Wireless Internet 2 01-10-2004 07:25 PM



1 2 3 4 5 6 7 8 9 10 11