DNS - Slow adress resolving

djs_core · December 25, 2009, 7:30pm

Hi,
I have a network of three pc. All connected to the same router.
One - openSUSE 11.1 32bit - ifup (network work fine) - IP, gateway and DNS set manualy
Second - openSUSE 11.2 32bit - networkmanager (network work fine)
Three - openSUSE 11.2 64bit - ifup (Slow adress resolving) - IP,gateway and DNS set manualy
Problem:
On the third PC, address resolving takes about 5s-15s…(on other 1s-2s). Problem is not only in Browser, but in the whole system (yast software manager, console, mumble, games, just everything was need to resolving the address via DNS…)
Here is my resolv.conf:


### /etc/resolv.conf file autogenerated by netconfig!
#
# Before you change this file manually, consider to define the
# static DNS configuration using the following variables in the
# /etc/sysconfig/network/config file:
#     NETCONFIG_DNS_STATIC_SEARCHLIST
#     NETCONFIG_DNS_STATIC_SERVERS
#     NETCONFIG_DNS_FORWARDER
# or disable DNS configuration updates via netconfig by setting:
#     NETCONFIG_DNS_POLICY=''
#
# See also the netconfig(8) manual page and other documentation.
#
# Note: Manual change of this file disables netconfig too, but
# may get lost when this file contains comments or empty lines
# only, the netconfig settings are same with settings in this
# file and in case of a "netconfig update -f" call.
#
### Please remove (at least) this line when you modify the file!
nameserver 194.228.41.113
nameserver 194.228.41.65

The DNS servers will not be a problem, when the other pc works fine…
Any idea?

syampillai · December 25, 2009, 7:32pm

Try switching off the IPV6 option and see. You can do it from the Yast tool for “Network setup”.

djs_core · December 25, 2009, 7:36pm

IPV6 support Shutting down immediately after installation (sorry, I forgot to write)

syampillai · December 25, 2009, 8:01pm

Can you install wireshark and snoop the packets? You will be able to determine how the DNS requests are answered.

zypper install wireshark
wireshark

lwfinger · December 25, 2009, 8:07pm

On 12/25/2009 12:46 PM, djs core wrote:
>
> IPV6 support Shutting down immediately after installation (sorry, I
> forgot to write)

If you ping your router, are you getting losses from the computer with the
problem? If so, try changing cables or router ports.

If you ping the primary nameserver, is there much difference in the times for
the different PCs?

Are there major differences in the traceroute to that nameserver?

djs_core · December 25, 2009, 10:16pm

To syampillai:
Ok. Here are the logs from wireshark:
http://www.djscore.org/tmp/packets.tar.gz

To lwfinger:
If you ping your router, are you getting losses from the computer with the
problem? If so, try changing cables or router ports.
No, all ok:


PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.871 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.756 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.761 ms
64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=0.762 ms
64 bytes from 192.168.1.1: icmp_seq=5 ttl=64 time=0.741 ms
64 bytes from 192.168.1.1: icmp_seq=6 ttl=64 time=0.757 ms
64 bytes from 192.168.1.1: icmp_seq=7 ttl=64 time=0.739 ms
64 bytes from 192.168.1.1: icmp_seq=8 ttl=64 time=0.737 ms
64 bytes from 192.168.1.1: icmp_seq=9 ttl=64 time=0.757 ms
64 bytes from 192.168.1.1: icmp_seq=10 ttl=64 time=0.758 ms
64 bytes from 192.168.1.1: icmp_seq=11 ttl=64 time=0.761 ms

djs_core · December 25, 2009, 10:33pm

To lwfinger:
If you ping the primary nameserver, is there much difference in the times for
the different PCs?
I can’t ping nameserver:

djs_core@linux-qicj:~> ping 194.228.41.113
PING 194.228.41.113 (194.228.41.113) 56(84) bytes of data.
^C
--- 194.228.41.113 ping statistics ---
31 packets transmitted, 0 received, 100% packet loss, time 30008ms

djs_core@linux-qicj:~> ping 194.228.41.65
PING 194.228.41.65 (194.228.41.65) 56(84) bytes of data.
^C
--- 194.228.41.65 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 3999ms

lwfinger · December 25, 2009, 11:01pm

On 12/25/2009 03:26 PM, djs core wrote:
>
> To syampillai:
> Ok. Here are the logs from wireshark:
> http://www.djscore.org/tmp/packets.tar.gz
>
> To lwfinger:
> -If you ping your router, are you getting losses from the computer with
> the
> problem? If so, try changing cables or router ports.-
> No, all ok:
>
> Code:
> --------------------
>
> PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
> 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.871 ms
> 64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.756 ms
> 64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.761 ms
> 64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=0.762 ms
> 64 bytes from 192.168.1.1: icmp_seq=5 ttl=64 time=0.741 ms
> 64 bytes from 192.168.1.1: icmp_seq=6 ttl=64 time=0.757 ms
> 64 bytes from 192.168.1.1: icmp_seq=7 ttl=64 time=0.739 ms
> 64 bytes from 192.168.1.1: icmp_seq=8 ttl=64 time=0.737 ms
> 64 bytes from 192.168.1.1: icmp_seq=9 ttl=64 time=0.757 ms
> 64 bytes from 192.168.1.1: icmp_seq=10 ttl=64 time=0.758 ms
> 64 bytes from 192.168.1.1: icmp_seq=11 ttl=64 time=0.761 ms

I usually let a ping run for 200 tries, but your network looks OK.

Larry

ken_yap · December 26, 2009, 12:18am

Please do

dig @194.228.41.113 www.iol.cz
dig @194.228.41.65 www.iol.cz

BTW are you sure you are using the right nameservers. For iol.cz they are apparently 194.228.2.61 and 194.228.2.1

syampillai · December 26, 2009, 4:34am

Your DNS resolution timings don’t look that bad. See the DNS packets from the captured data:

No.     Time            Source                Destination           Protocol Info
      1 01:07:50.543055 192.168.1.2           194.228.41.113        DNS      Standard query A www.xfce.org
      2 01:07:50.543071 192.168.1.2           194.228.41.113        DNS      Standard query AAAA www.xfce.org
      3 01:07:50.634661 194.228.41.113        192.168.1.2           DNS      Standard query response A 67.205.48.142 A 72.232.199.162 A 138.48.2.101
      4 01:07:55.547665 192.168.1.2           194.228.41.113        DNS      Standard query A www.xfce.org
      5 01:07:55.563710 194.228.41.113        192.168.1.2           DNS      Standard query response A 138.48.2.101 A 67.205.48.142 A 72.232.199.162
      6 01:07:55.563745 192.168.1.2           194.228.41.113        DNS      Standard query AAAA www.xfce.org
      7 01:07:55.580461 194.228.41.113        192.168.1.2           DNS      Standard query response
    142 01:07:56.174177 192.168.1.2           194.228.41.113        DNS      Standard query A blog.xfce.org
    143 01:07:56.174201 192.168.1.2           194.228.41.113        DNS      Standard query AAAA blog.xfce.org
    144 01:07:56.174352 192.168.1.2           194.228.41.113        DNS      Standard query A mmassonnet.blogspot.com
    145 01:07:56.174367 192.168.1.2           194.228.41.113        DNS      Standard query AAAA mmassonnet.blogspot.com
    146 01:07:56.174694 192.168.1.2           194.228.41.113        DNS      Standard query A jeromeg.blog.free.fr
    147 01:07:56.174723 192.168.1.2           194.228.41.113        DNS      Standard query AAAA jeromeg.blog.free.fr
    148 01:07:56.226804 194.228.41.113        192.168.1.2           DNS      Standard query response A 212.27.63.51 A 212.27.63.52
    149 01:07:56.230436 194.228.41.113        192.168.1.2           DNS      Standard query response A 138.48.2.101
    150 01:07:56.230949 194.228.41.113        192.168.1.2           DNS      Standard query response CNAME blogspot.l.google.com A 74.125.87.191
    151 01:08:01.175641 192.168.1.2           194.228.41.113        DNS      Standard query A jeromeg.blog.free.fr
    152 01:08:01.177684 192.168.1.2           194.228.41.113        DNS      Standard query A blog.xfce.org
    153 01:08:01.178657 192.168.1.2           194.228.41.113        DNS      Standard query A mmassonnet.blogspot.com
    154 01:08:01.192060 194.228.41.113        192.168.1.2           DNS      Standard query response A 212.27.63.52 A 212.27.63.51
    155 01:08:01.192107 192.168.1.2           194.228.41.113        DNS      Standard query AAAA jeromeg.blog.free.fr
    156 01:08:01.193818 194.228.41.113        192.168.1.2           DNS      Standard query response A 138.48.2.101
    157 01:08:01.193861 192.168.1.2           194.228.41.113        DNS      Standard query AAAA blog.xfce.org
    158 01:08:01.197256 194.228.41.113        192.168.1.2           DNS      Standard query response CNAME blogspot.l.google.com A 74.125.87.191
    159 01:08:01.197283 192.168.1.2           194.228.41.113        DNS      Standard query AAAA mmassonnet.blogspot.com
    160 01:08:01.208870 194.228.41.113        192.168.1.2           DNS      Standard query response AAAA 2a01:e0c:1:1597::52 AAAA 2a01:e0c:1:1597::51
    161 01:08:01.209119 192.168.1.2           194.228.41.113        DNS      Standard query A feedproxy.google.com
    162 01:08:01.209134 192.168.1.2           194.228.41.113        DNS      Standard query AAAA feedproxy.google.com
    163 01:08:01.211059 194.228.41.113        192.168.1.2           DNS      Standard query response
    164 01:08:01.211164 192.168.1.2           194.228.41.113        DNS      Standard query A forum.xfce.org
    165 01:08:01.211178 192.168.1.2           194.228.41.113        DNS      Standard query AAAA forum.xfce.org
    166 01:08:01.213025 194.228.41.113        192.168.1.2           DNS      Standard query response CNAME blogspot.l.google.com
    167 01:08:01.213125 192.168.1.2           194.228.41.113        DNS      Standard query A bugzilla.xfce.org
    168 01:08:01.213139 192.168.1.2           194.228.41.113        DNS      Standard query AAAA bugzilla.xfce.org
    169 01:08:01.227077 194.228.41.113        192.168.1.2           DNS      Standard query response CNAME www4.l.google.com A 74.125.39.133 A 74.125.39.118
    170 01:08:01.228509 194.228.41.113        192.168.1.2           DNS      Standard query response CNAME www4.l.google.com
    171 01:08:01.228650 192.168.1.2           194.228.41.113        DNS      Standard query A wiki.xfce.org
    172 01:08:01.228666 192.168.1.2           194.228.41.113        DNS      Standard query AAAA wiki.xfce.org
    173 01:08:01.270414 194.228.41.113        192.168.1.2           DNS      Standard query response A 138.48.2.101
    174 01:08:06.214673 192.168.1.2           194.228.41.113        DNS      Standard query A forum.xfce.org
    175 01:08:06.215741 192.168.1.2           194.228.41.65         DNS      Standard query A bugzilla.xfce.org
    176 01:08:06.215758 192.168.1.2           194.228.41.65         DNS      Standard query AAAA bugzilla.xfce.org
    177 01:08:06.232667 192.168.1.2           194.228.41.65         DNS      Standard query A wiki.xfce.org
    178 01:08:06.232683 192.168.1.2           194.228.41.65         DNS      Standard query AAAA wiki.xfce.org
    179 01:08:06.240143 194.228.41.113        192.168.1.2           DNS      Standard query response A 138.48.2.101
    180 01:08:06.240185 192.168.1.2           194.228.41.113        DNS      Standard query AAAA forum.xfce.org
    181 01:08:06.252491 194.228.41.65         192.168.1.2           DNS      Standard query response A 138.48.2.101
    182 01:08:06.252636 194.228.41.65         192.168.1.2           DNS      Standard query response
    183 01:08:06.252808 192.168.1.2           194.228.41.113        DNS      Standard query A www.os-cillation.com
    184 01:08:06.252824 192.168.1.2           194.228.41.113        DNS      Standard query AAAA www.os-cillation.com
    185 01:08:06.260110 194.228.41.113        192.168.1.2           DNS      Standard query response
    186 01:08:06.260250 192.168.1.2           194.228.41.113        DNS      Standard query A sourceforge.net
    187 01:08:06.260266 192.168.1.2           194.228.41.113        DNS      Standard query AAAA sourceforge.net
    188 01:08:06.268015 194.228.41.65         192.168.1.2           DNS      Standard query response A 138.48.2.101
    189 01:08:06.273914 194.228.41.65         192.168.1.2           DNS      Standard query response
    190 01:08:06.283826 194.228.41.113        192.168.1.2           DNS      Standard query response A 216.34.181.60

djs_core · December 26, 2009, 9:43am

To lwfinger:

I usually let a ping run for 200 tries, but your network looks OK.

I also tried 528 ping, but still everything is ok

64 bytes from 192.168.1.1: icmp_seq=521 ttl=64 time=0.726 ms
64 bytes from 192.168.1.1: icmp_seq=522 ttl=64 time=0.731 ms
64 bytes from 192.168.1.1: icmp_seq=523 ttl=64 time=0.716 ms
64 bytes from 192.168.1.1: icmp_seq=524 ttl=64 time=0.723 ms
64 bytes from 192.168.1.1: icmp_seq=525 ttl=64 time=0.730 ms
64 bytes from 192.168.1.1: icmp_seq=526 ttl=64 time=0.718 ms
64 bytes from 192.168.1.1: icmp_seq=527 ttl=64 time=0.725 ms
64 bytes from 192.168.1.1: icmp_seq=528 ttl=64 time=0.709 ms

To ken_yap:

Please do

dig @194.228.41.113 http://www.iol.cz
dig @194.228.41.65 http://www.iol.cz

Here is:

djs_core@linux-qicj:~> dig @194.228.41.113 www.iol.cz

; <<>> DiG 9.6.1-P2 <<>> @194.228.41.113 www.iol.cz
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25336
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.iol.cz.			IN	A

;; ANSWER SECTION:
www.iol.cz.		595	IN	CNAME	www.techzona.cz.
www.techzona.cz.	86395	IN	CNAME	techzona.cz.
techzona.cz.		85962	IN	A	160.218.160.72

;; AUTHORITY SECTION:
techzona.cz.		85962	IN	NS	dns.iol.cz.
techzona.cz.		85962	IN	NS	ns2.tel.cz.

;; ADDITIONAL SECTION:
dns.iol.cz.		86016	IN	A	194.228.2.61
ns2.tel.cz.		86302	IN	A	194.228.2.1

;; Query time: 16 msec
;; SERVER: 194.228.41.113#53(194.228.41.113)
;; WHEN: Sat Dec 26 09:22:39 2009
;; MSG SIZE  rcvd: 157

djs_core@linux-qicj:~> dig @194.228.41.65 www.iol.cz

; <<>> DiG 9.6.1-P2 <<>> @194.228.41.65 www.iol.cz
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26547
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.iol.cz.			IN	A

;; ANSWER SECTION:
www.iol.cz.		600	IN	CNAME	www.techzona.cz.
www.techzona.cz.	7637	IN	CNAME	techzona.cz.
techzona.cz.		7637	IN	A	160.218.160.72

;; AUTHORITY SECTION:
techzona.cz.		7637	IN	NS	dns.iol.cz.
techzona.cz.		7637	IN	NS	ns2.tel.cz.

;; ADDITIONAL SECTION:
dns.iol.cz.		6738	IN	A	194.228.2.61
ns2.tel.cz.		22223	IN	A	194.228.2.1

;; Query time: 16 msec
;; SERVER: 194.228.41.65#53(194.228.41.65)
;; WHEN: Sat Dec 26 09:23:07 2009

;; MSG SIZE  rcvd: 157

BTW are you sure you are using the right nameservers.

These nameservers are automatically assigned to router from my ISP:
http://www.djscore.org/tmp/screen-adsl.png

For iol.cz they are apparently 194.228.2.61 and 194.228.2.1

Ok. I try

To syampillai:

Your DNS resolution timings don’t look that bad. See the DNS packets from the captured data:

I see, but really is the waiting time averaged 5s to 15s…

ken_yap · December 26, 2009, 9:55am

No, don’t bother trying different nameservers, I think they are internal servers, while the ones I found are for the outside world. Your response times are pretty good. I don’t think it’s DNS. My suspicion is that your browser is sending out an IPv6 DNS request and this has to timeout before it will try IPv4. Another possibility is bad interaction with mdns.

You can watch the DNS packets with wireshark and see when they are actually sent. If they are sent much later than when you click on the link, then it’s doing something else before IPv4 DNS.

Also do you have the Name Service Caching Daemon (nscd) running? You should.

djs_core · December 26, 2009, 9:58am

According to ken_yap, I set the dns servers to:

194.228.2.61
194.228.2.1

and resolving works fine! :shame: Thank you!
But why the router assigned a different DNS from ISP?
In any event, thanks all for the help, people from this forum are the best :good:

ken_yap · December 26, 2009, 10:05am

Well it’s good that it works but it ought to work with your ISP’s suggested servers. I still think you are trying to send IPv6 queries to the internal servers, while the outside ones simply reject IPv6 right away. So I think there are unresolved issues with your setup.

syampillai · December 26, 2009, 12:17pm

I think this may be the problem. I had faced with similar issues.

Dexter1979 · December 26, 2009, 1:04pm

Ever tried using openDNS?
Server 1 -> 208.67.222.222
Server 2 -> 208.67.220.220

It’s free and fast. Ever since I started using them I have had no probs with DNS related issues. My ISP has unreliable DNS servers…

I would set these up in the router so all users have these DNS servers unless you always set your servers manually.

djs_core · December 27, 2009, 12:16am

To ken_yap and syampillai:

I still think you are trying to send IPv6 queries to the internal servers, while the outside ones simply reject IPv6 right away. So I think there are unresolved issues with your setup.

I think this may be the problem. I had faced with similar issues.

But, I have in YaST setting IPV6 to disable and the problem is not only in the browser…Pls see first post

To Dexter1979:

Ever tried using openDNS?
Server 1 -> 208.67.222.222
Server 2 -> 208.67.220.220

It’s free and fast. Ever since I started using them I have had no probs with DNS related issues. My ISP has unreliable DNS servers…

I would set these up in the router so all users have these DNS servers unless you always set your servers manually.

Thanks for tip, but the DNS writen above have for me better ping and now work fine

Dexter1979 · December 27, 2009, 12:22am

Nothing wrong with that so

I do find them a lot quicker than the crappy servers my ISP had. Oh, and they will not effect your ping since that has nothing to do with the actual DNS lookup. Eventho the servers of OpenDNS are probably a bit further away they will respond quicker and send your computer to the correct site quicker. The time it took for my browser to actually start loading the site dropped dramatically when I started using openDNS. Your connection speed and line quality will have a impact on your ping so that should not be effected at all. Try it and change it back if you don’t like it. It’s worth a shot!

ken_yap · December 27, 2009, 1:00am

I think there are also IPv6 settings in bind and also perhaps in nsswitch.conf. I remember having to disable IPv6 in the bind config for a mixed network even though IPv6 protocol was disabled in the kernel.

Remember there are many things under the umbrella of IPv6. You may disable the IPv6 protocol in the kernel networking stack, but there is still something called IPv6 lookup over IPv4, or fetching AAAA records. That is not affected by the lack of a IPv6 transport.

Here at home I have IPv6 enabled, since everything is Linux except for one XP laptop. In fact I was pleasantly surprised to find one day that some internal traffic was going over IPv6, because Apache and Firefox are IPv6 ready.

djs_core · December 27, 2009, 1:43am

ok, I try OpenDNS