OT: OS X Strange DNS Lookup Failures

Re: OT: OS X Strange DNS Lookup Failures

From:

Date:

Time:

We've received a report detailing a problem similar to this. It
appears there's a discussion on the Apple forums regarding certain
malformed responses causing problems for the version of lookupd in
Mac OS X 10.2.

Obviously, this is strictly hearsay, and we have no official comment
on the problem. It appears to not be our problem.
____________________________________________________________________
Chris Buxton Men & Mice
support@menandmice.com Making DNS Easy

At 8:40 AM -0700 11/22/02, Warren Michelsen wrote:
>Ever since upgrading to OS X 10.2, every now and then, for no reason
>that I can discern, DNS lookups stop working on my OS X 10.2.1 Mac.
>I start getting "server not found" errors in my browser and I can't
>collect my email; I'm told the domain does not exist.
>
>If I use Network Utility or IPNetMonitorX's DNS Query tool to do the
>lookup of the very domains that Eudora and my browser cannot find,
>they resolve just fine. If I use IPNetMonitorX's Lookup tool, the
>lookups do not work. The difference is that the lookup tool first
>checks the local DNS cache while Network Utility and IPNetMonitorX's
>DNS Query tool directly query a DNS server.
>
>I believe that OS X must be caching DNS locally and the cache is
>becoming corrupted.
>
>At first, the way I got it working again was to edit my listed name
>servers in Network preferences. At first I thought the problem was a
>particular name server which happened to be the first listed. Adding
>another name server above it in the list and saving the config
>changes always fixed the problem.
>
>Now I realize that it doesn't matter which name server is listed
>first, when lookups stop working, I simply re-order the listed
>servers and things work again. I think that changing the listed name
>servers has the effect of flushing the local cache and that's why
>things start working again.
>
>In fact, I tried going into Terminal and doing a lookupd -flushcache
>and this would start lookups working again. After a few days of
>this, it required two or three invocations of "lookupd -flushcache"
>to get lookups working and later flushing the cache became
>ineffective.
>
>Changing the order of listed name servers is the most reliable way
>to get lookups working again so I duplicated my configuration in the
>Network panel of System Preferences and now whenever lookups stop
>working I simply select this different "Location" and hit apply.
>I've been operating this way for weeks, with my Networks preferences
>panel always open for quick access.
>
>I have not been able to associate this failure with any particular
>thing I do or application I run.
>
>I've been looking around and reading lots of man pages. I found
>something interesting when using "nidump". Check this out:
>
>[gwhiz:~] warren% nidump hosts .
>127.0.0.1 10.0.1.222 localhost
>255.255.255.255 broadcasthost
>10.0.1.10 gateway
>10.0.1.22 maxine
>10.0.1.2 tivo
>63.167.xxx.xx
>Connected to 63.167.xxx.xxx.
>220 FTP server ready
>Name (63.167.xxx.xxx:warren):
>331 Guest login ok
>Password:
>230 Guest login ok, access restrictions apply.
>Remote system type is Type:.
>ftp> binary
>200 Type set to I.
>ftp> put boot.bin
>local: boot.bin remote: boot.bin
>500 'EPSV': command not understood.
>227 Entering Passive Mode (63,167,xxx,xxx,4,1)
>150 Opening BINARY mode data connection for boot.bin
> 10% |******
>| 65536 0.68 KB/s - stalled -^C
>send aborted. Waiting for remote to finish abort.
>quit
><snipped more terminal session>
>10.0.1.1 AirPort
>
>___
>As you can see, after the line "10.0.1.2 tivo", the dump
>seems to be the transcript of an ftp session I had some time ago,
>beginning just after the initial "ftp " and then the last line is
>the entry for my AirPort base station. It would appear that the NI
>database is corrupted -- or something because right in the middle of
>the machines I have listed via NetInfo Manager is a terminal
>session. I did have some crosslinked files recently, but this DNS
>problem first showed up much longer ago than the ftp session that
>found its way into the nidump. (The ftp session was done in
>Terminal.app.)
>
>I'm not sure how to correct this. In a normal Unix system, I'd
>simply edit /etc/hosts when I wanted to add or delete hosts. In X I
>add entries in NetInfo Manager. When I look at the entries in
>/machines in the NetInfo database, nothing appears to be corrupted
>so I don't really know where the contents of "nidump hosts ." comes
>from.
>
>I've talked to Apple about this and have a case number. Apple was,
>apparently looking into it before I reported it. When 10.2.2 came
>out, I'd hoped for a fix but the problem remains.
>
>The problem may simply be the obvious corruption of some file that
>is the source of info for "nidump hosts ." or it could be whatever
>caused the corruption in the first place.
>
>Today, for the first time, changing my location in the Network
>settings failed to get lookups going again. I rebooted instead. I
>probably should have seen if a log out / log in fixed it but didn't
>try.
>
>Can anyone shed light on this or tell me the source of data returned
>by "nidump hosts ."? Is it something I can correct?

Sales:
888/4-DPOINT

Support:
858/452-3696