DNS Server Problems - Keep having to restart the DNS service

For about a week now during the day our office internet connection goes down. When it goes down I have to restart the DNS service on our server which brings the internet back online.

Our DNS server has forwarders set-up to send external requests to an external internet based DNS server. We use NAT to share internet access throughout the office.

When the connection goes down we can access websites by using IP address. This obviously confirms the problem is DNS based.

Whilst restarting the DNS service on our server sorts the problem I do need to find out what's causing it to go down.

There are no errors or warning messages in the event log.


Any advice welcomed!

 

Hey Mark

Someting else a required service (for DNS) or something is shutting down therefore DNS.

Look closely at the required services for DNS.

Additionally and indirectly you may possibly solve this by hard coding just the internet DNS Ip's of your ISP. Even if using DHCP for local LAN IP.

This should keep internet up but still does not address the reason DNS goes down.

Have you checked the event logs for this?

Mike

 

What server OS are you using?

Setting your ISP's DNS IPs as the secondary DNS via DHCP may help keep the internet connection live - but if you are using 2000 or 2003 server, DNS failure on the server will give you log on and authentication problems. So you still need to find the underlying problem.

If we know the server OS, it would help us find a solution.

 

As an outside possibuility check hard drive space on the server.
As the drive fills it starts shutting down services. Been there done that.

Just thought I would throw that out as an outside chance that could be the problem. DNS and DHCP are on of the first to shut down.

 

Thanks for your responses so far.

Some further details. The internet was off again when I arrived in the office this morning. Again it came straight back on after restarting the DNS service.

To answer your queries:

- We are using Windows 2000 Server

- Where in DHCP should I set the ISP's DNS as a secondary address?

- The required services for DNS are NTLM Security Support Provider and Remote Procedure Call

- The DNS event log shows the following:- (sorry for the layout)

16/01/2007 08:26:16 DNS Error None 3152 N/A SERVER The DNS server was unable to open file dns\dns.log for write. Most likely the file is a zone file that is already open. Close the zone file and re-initiate zone write.

16/01/2007 04:00:12 DNS Information None 2 N/A SERVER The DNS server has started.
16/01/2007 04:00:10 DNS Information None 3 N/A SERVER The DNS server has shutdown.
16/01/2007 00:00:12 DNS Information None 2 N/A SERVER The DNS server has started.
16/01/2007 00:00:10 DNS Information None 3 N/A SERVER The DNS server has shutdown.
15/01/2007 20:00:03 DNS Information None 2 N/A SERVER The DNS server has started.
15/01/2007 20:00:00 DNS Information None 3 N/A SERVER The DNS server has shutdown.
15/01/2007 19:57:05 DNS Warning None 5501 N/A SERVER The DNS server encountered a bad packet from 192.112.36.4. Packet processing leads beyond packet length.
15/01/2007 19:57:01 DNS Warning None 5501 N/A SERVER The DNS server encountered a bad packet from 0.0.0.0. Packet processing leads beyond packet length.
15/01/2007 19:56:37 DNS Warning None 5501 N/A SERVER The DNS server encountered a bad packet from 0.0.0.0. Packet processing leads beyond packet length.
15/01/2007 19:56:34 DNS Warning None 5501 N/A SERVER The DNS server encountered a bad packet from 0.0.0.0. Packet processing leads beyond packet length.
15/01/2007 19:56:19 DNS Warning None 5501 N/A SERVER The DNS server encountered a bad packet from 0.0.0.0. Packet processing leads beyond packet length.
15/01/2007 19:56:16 DNS Warning None 5501 N/A SERVER The DNS server encountered a bad packet from 0.0.0.0. Packet processing leads beyond packet length.
15/01/2007 19:56:03 DNS Warning None 5501 N/A SERVER The DNS server encountered a bad packet from 0.0.0.0. Packet processing


Again cheers for your help on this!

 

just been looking at the event logs on the server and it has recorded this:

16/01/2007 09:53:34 DNS Error None 140 N/A SERVER The DNS server could not initialize the remote procedure call (RPC) service. If it is not running, start the RPC service or reboot the computer. The event data is the error code.
16/01/2007 09:53:32 DNS Warning None 5501 N/A SERVER The DNS server encountered a bad packet from 0.0.0.0. Packet processing leads beyond packet length.


This obviously points towards the RPC service which I'll look into.

 

Hey Mark

Are you getting event logs full errors sometimes? Or do you empty them often?

Here is what M$ has to say
http://support.microsoft.com/kb/198757

Is this perhaps the LAN IP of the server in question?
192.112.36.4. Packet processing leads beyond packet length

Wait for the next DNS shut down, and see if the same IP is the problem in events. If so that machine is the problem.

To confirm this you should find the workstation that did this and unplug it for a day.

Have you noticed this same IP before in the events?

If this the Server IP or the errored IP is random. Then drop back and punt time!

I have seen a bad NIC spew bad data and cause this and similar problems.

BTW: to easily get text from the event logs is rt click the catagory you want like
system
choose Save log file as
choose as type *.txt

Adding Explicit DNS entries is Ok if done properly. I only suggested it as an emergency gap measure to get the internet back up untill the problem is found.

In this case it could cover up the problem and may have other issues dependng on your setup.

Your answer:

First do this
cmd prompt

type
ipconfig /all >c:\ipcfg.out
browse there print this

Now
rt click Local Area Connection
properties
Internet Protocol TCP/IP

If
Obtain DNS server address automatically has the DOT
then choose
Use the following

put any other DNS's from ipconfig in first then the ISP DNS numbers. If many you may need to go to Advanced to add all of them.

Do this as a stop gap until you find the real problem.

Mike

 

Mark

I will check back in in about an hour. Untill then I am offline.

Hope to come back to news that you got it.

Mike

 

i've got the server running a net start/stop batch file every 15 minutes now to restart the dns service - this at least keeps it running.

the ip address you specified, and the 0.0.0.0 ip address I specified are not our IP addresses.

i've seen loads of posts on newsgroups with IT Managers with the exact same problem but none of them have a solution - other than just restarting the dns server as and when the problem occurs.

 

Hi Mark

I missed your 2nd post today about the ip 0.0.0.0.

But be sure. Can you ping 192.112.36.4

What do you get when you do ping it?

Is 192.112... your current subnet?

Is your Local Area connection named with a number like Local Area connection1?

Has the NIC been replaced in this server or have a 2nd NIC?

I don't know the size of your system and just realized you are in the UK.

But I would like to see the ipconfig. If you don't wish to post it on the BBS consider to PM it to me.

If you can, get all stations to log off or do the following after hours.

You can copy and paste into a CMD or Bat file example (ClrNet.cmd) the following
=================================================
@echo off
echo Flushing Arp Cache
netsh interface ip delete arpcache
pause

echo Flushing DNS
ipconfig /flushdns
pause

echo Releasing all network adapters
ipconfig /release *
pause

echo Renewing all network adapters
ipconfig /renew *
pause

echo Reregister DNS
ipconfig /registerdns
pause

echo Release and renew NETBIOS cache
nbtstat -RR
pause
=================================================
Or run each line from the cmd prompt. Report back any unusual responses.

Should reboot after this.

Of course you would need to turn off your DNS reset script to see if this fixed it.

Mike