OT: OS X Strange DNS Lookup Failures

From:

Date:

Time:

Ever since upgrading to OS X 10.2, every now and then, for no reason that I can discern, DNS lookups stop working on my OS X 10.2.1 Mac. I start getting "server not found" errors in my browser and I can't collect my email; I'm told the domain does not exist.

If I use Network Utility or IPNetMonitorX's DNS Query tool to do the lookup of the very domains that Eudora and my browser cannot find, they resolve just fine. If I use IPNetMonitorX's Lookup tool, the lookups do not work. The difference is that the lookup tool first checks the local DNS cache while Network Utility and IPNetMonitorX's DNS Query tool directly query a DNS server.

I believe that OS X must be caching DNS locally and the cache is becoming corrupted.

At first, the way I got it working again was to edit my listed name servers in Network preferences. At first I thought the problem was a particular name server which happened to be the first listed. Adding another name server above it in the list and saving the config changes always fixed the problem.

Now I realize that it doesn't matter which name server is listed first, when lookups stop working, I simply re-order the listed servers and things work again. I think that changing the listed name servers has the effect of flushing the local cache and that's why things start working again.

In fact, I tried going into Terminal and doing a lookupd -flushcache and this would start lookups working again. After a few days of this, it required two or three invocations of "lookupd -flushcache" to get lookups working and later flushing the cache became ineffective.

Changing the order of listed name servers is the most reliable way to get lookups working again so I duplicated my configuration in the Network panel of System Preferences and now whenever lookups stop working I simply select this different "Location" and hit apply. I've been operating this way for weeks, with my Networks preferences panel always open for quick access.

I have not been able to associate this failure with any particular thing I do or application I run.

I've been looking around and reading lots of man pages. I found something interesting when using "nidump". Check this out:

[gwhiz:~] warren% nidump hosts .
127.0.0.1 10.0.1.222 localhost
255.255.255.255 broadcasthost
10.0.1.10 gateway
10.0.1.22 maxine
10.0.1.2 tivo
63.167.xxx.xx
Connected to 63.167.xxx.xxx.
220 FTP server ready
Name (63.167.xxx.xxx:warren):
331 Guest login ok
Password:
230 Guest login ok, access restrictions apply.
Remote system type is Type:.
ftp> binary
200 Type set to I.
ftp> put boot.bin
local: boot.bin remote: boot.bin
500 'EPSV': command not understood.
227 Entering Passive Mode (63,167,xxx,xxx,4,1)
150 Opening BINARY mode data connection for boot.bin
10% |****** | 65536 0.68 KB/s - stalled -^C
send aborted. Waiting for remote to finish abort.
quit
<snipped more terminal session>
10.0.1.1 AirPort

___
As you can see, after the line "10.0.1.2 tivo", the dump seems to be the transcript of an ftp session I had some time ago, beginning just after the initial "ftp " and then the last line is the entry for my AirPort base station. It would appear that the NI database is corrupted -- or something because right in the middle of the machines I have listed via NetInfo Manager is a terminal session. I did have some crosslinked files recently, but this DNS problem first showed up much longer ago than the ftp session that found its way into the nidump. (The ftp session was done in Terminal.app.)

I'm not sure how to correct this. In a normal Unix system, I'd simply edit /etc/hosts when I wanted to add or delete hosts. In X I add entries in NetInfo Manager. When I look at the entries in /machines in the NetInfo database, nothing appears to be corrupted so I don't really know where the contents of "nidump hosts ." comes from.

I've talked to Apple about this and have a case number. Apple was, apparently looking into it before I reported it. When 10.2.2 came out, I'd hoped for a fix but the problem remains.

The problem may simply be the obvious corruption of some file that is the source of info for "nidump hosts ." or it could be whatever caused the corruption in the first place.

Today, for the first time, changing my location in the Network settings failed to get lookups going again. I rebooted instead. I probably should have seen if a log out / log in fixed it but didn't try.

Can anyone shed light on this or tell me the source of data returned by "nidump hosts ."? Is it something I can correct?

Sales:
888/4-DPOINT

Support:
858/452-3696