DNS issues

[Richard Körber]

Hi!

I just installed F11 beta and updated to the latest packages. It was working 
fine so far, but then suddenly I got issues with domain name resolving.

When I use Firefox, Thunderbird, wget, whatever, I always get an error message 
that the domain name could not be resolved. Anyhow the network is up, DNS 
server IPs are set correctly and I can even use dig and ping to successfully 
resolve domain names. When I enter a plain IP address at Firefox, it also 
fetches the page correctly.

Configuration files seem to be correct, there are no hints in the log files, I 
even checked that there is no proxy set, but I found nothing. I created a 
clean user to make sure there is no configuration messed up. I rebooted the 
system, but still got that issue. I'm totally clueless now...

Is this a F11 bug? I have had a look at bugzilla, but I wasn't sure what I 
should search for.

Regards
-- 
Richard "Shred" Körber

[Anne Wilson]

On Wednesday 22 April 2009 23:56:38 Richard Körber wrote:
>  Hi!
>
>  I just installed F11 beta and updated to the latest packages. It was
>  working fine so far, but then suddenly I got issues with domain name
>  resolving.
>
>  When I use Firefox, Thunderbird, wget, whatever, I always get an error
>  message that the domain name could not be resolved. Anyhow the network is
>  up, DNS server IPs are set correctly and I can even use dig and ping to
>  successfully resolve domain names. When I enter a plain IP address at
>  Firefox, it also fetches the page correctly.
>
>  Configuration files seem to be correct, there are no hints in the log
>  files, I even checked that there is no proxy set, but I found nothing. I
>  created a clean user to make sure there is no configuration messed up. I
>  rebooted the system, but still got that issue. I'm totally clueless now...
>
>  Is this a F11 bug? I have had a look at bugzilla, but I wasn't sure what I
>  should search for.
>  
This happens from time to time on my F10 netbook, too, although it's not a 
frequent event.  Rebooting is the only way I've found out of it.  Whatever 
causes it, it's common to both versions.

Anne
-- 
New to KDE4? - get help from http://userbase.kde.org
Just found a cool new feature?  Add it to UserBase

["Jóhann B. Guðmundsson"]

On 04/23/2009 06:16 AM, Anne Wilson wrote:
>  On Wednesday 22 April 2009 23:56:38 Richard Körber wrote:
>    
> > Hi!
> >
> > I just installed F11 beta and updated to the latest packages. It was
> > working fine so far, but then suddenly I got issues with domain name
> > resolving.
> >
> > When I use Firefox, Thunderbird, wget, whatever, I always get an error
> > message that the domain name could not be resolved. Anyhow the network is
> > up, DNS server IPs are set correctly and I can even use dig and ping to
> > successfully resolve domain names. When I enter a plain IP address at
> > Firefox, it also fetches the page correctly.
> >
> > Configuration files seem to be correct, there are no hints in the log
> > files, I even checked that there is no proxy set, but I found nothing. I
> > created a clean user to make sure there is no configuration messed up. I
> > rebooted the system, but still got that issue. I'm totally clueless now...
> >
> > Is this a F11 bug? I have had a look at bugzilla, but I wasn't sure what I
> > should search for.
> >
> >     
>  This happens from time to time on my F10 netbook, too, although it's not a 
>  frequent event.  Rebooting is the only way I've found out of it.  Whatever 
>  causes it, it's common to both versions.
>
>  Anne
>     
I've experienced the same ( or similar ) seemed to be domain specific.  

Had open a bug ( #496979 ) then closed it again cause we could duplicate
it on
debian and f10 and thus deemed the fqdn in question had an broken dns setup.

Also on http://udrepper.livejournal.com/20948.html

"DNS NSS improvement

In glibc 2.9 I already implemented an improvement to the DNS NSS module
which optimizes the lookup of IPv4 and IPv6 addresses for the same host.
This can improve the response time of the lookup due to parallelism. It
also fixes a bug in name lookup where the IPv4 and IPv6 addresses could
be returned for different hosts.

The problem with this change was that there are broken DNS servers and
broken firewall configurations which prevented the two results from
being received successfully. Some broken DNS servers (especially those
in cable modems etc) only send one reply. For this reason Fedora had
this change disabled in F10.

For F11 I’ve added a work-around for broken servers. The default
behavior is the same as described above. I.e., we get the improved
performance for working DNS servers. In case the program detects a
broken DNS server or firewall because it received only one reply the
resolver switches into a mode where the second request is sent only
after the first reply has been received. We still get the benefit of the
bug fix described above, though.

The drawback is that a timeout is needed to detect the broken servers or
firewalls. This delay is experienced once per process start and could be
noticeable. But the broken setups of the few people affected must not
prevent the far larger group of people with working setups to experience
the advantage of the parallel lookup.

There are also ways to avoid the delays, some old, some new:

    * Install a caching name server on this machine or somewhere on the
      local network. bind is known to work correctly.
    * Run nscd on the local machine. In this case the delay is incurred
      once per system start (i.e., at the first lookup nscd performs).
    * Add “single-request” to the options in /etc/resolv.conf. This
      selects the compatibility mode from the start.

All of these work-arounds are easy to implement. Therefore there is no
reason to not have the fast mode the default which in any case will work
for 99% of the people."

However the end user will not blame the incompetent DNS admin but Fedora
( or what ever program he's using at the time.. firefox thunderbird
network manager etc.. )
when the M$ machine next to him manages to reach the site successfully
while the Fedora machine will not..

Are these "workarounds" in forums docs ?

JBG

[Christopher Beland]

I'll throw out some ideas, though others may have more experience with
this code.  Anne, I'm not sure you are experiencing the same problem, if
a reboot fixes it for you but not for Richard.  Are your other symptoms
similar?

On Thu, 2009-04-23 at 00:56 +0200, Richard Körber wrote:
>  When I use Firefox, Thunderbird, wget, whatever, I always get an
> error message 
>  that the domain name could not be resolved. Anyhow the network is up, DNS 
>  server IPs are set correctly and I can even use dig and ping to successfully 
>  resolve domain names. When I enter a plain IP address at Firefox, it also 
>  fetches the page correctly.
>  
>  Configuration files seem to be correct, there are no hints in the log files, I 
>  even checked that there is no proxy set, but I found nothing. I created a 
>  clean user to make sure there is no configuration messed up. I rebooted the 
>  system, but still got that issue. I'm totally clueless now... 
Could your applications be somehow caching bad lookups or bad network
connections?  It might be worthwhile to carefully document the sequence
of events (what you start when) after reboot, and see if the order or
timing makes any difference.  Does restarting e.g. Firefox help?

Good DNS lookups can also be cached locally, so it is easy to be fooled
into thinking DNS is working when it is really not.  (You can work
around that by thinking up a truly new domain name for each test.)

Different programs can certainly use different DNS resolution
mechanisms, so it could be that one of them is somehow malfunctioning or
reacting badly to external intermittent DNS failure.  If you have
another machine you can test on the same subnet, that can help rule
external DNS hiccups in or out.  You can also sniff your own network
traffic using wireshark, to see what's going on behind the scenes, if
necessary.

You might also sanity check your /etc/hosts and /etc/resolv.conf.  There
are a few Bugzilla reports related to having unusually large lists or
using NFS, but I assume you don't have either.

If none of the below bugs match your symptoms, I would recommend filing
a new bug with as much diagnostic detail as you can document.

https://bugzilla.redhat.com/show_bug.cgi?id=478760 
Host lookup fails after suspend

https://bugzilla.redhat.com/show_bug.cgi?id=473785
NetworkManager generates useless /etc/resolv.conf

https://bugzilla.redhat.com/show_bug.cgi?id=489371
removal of fedora-lsb irrevocably causes hostname resolution failure for
a lot of tools

Good luck!

Beland

[Richard Körber]

Hi!

The DNS server is working. I have tried another machine on the network, 
and it was still working correctly. I think it's very likely that the 
cause is to be found on the F11 beta machine.

I totally forgot to check IPv6 though. It was already late at night. :) 
I will try to disable IPv6 later when I am back at the machine.

Regards
-- 
Richard "Shred" Körber

[Oleg Ponomarev]

Hi! On Thu, 23 Apr 2009, Richard Körber wrote:

>  The DNS server is working. I have tried another machine on the
> network, and 
>  it was still working correctly. I think it's very likely that the cause is to 
>  be found on the F11 beta machine.
>
>  I totally forgot to check IPv6 though. It was already late at night. :) I 
>  will try to disable IPv6 later when I am back at the machine. 
Make sure you do not get only IPv6 nameserver addresses. You might see the 
same bug:

https://bugzilla.redhat.com/show_bug.cgi?id=486602

-- 
Regards, Oleg.

[Richard Körber]

>  Make sure you do not get only IPv6 nameserver addresses. You might
> see 
>  the same bug:
>  
>  https://bugzilla.redhat.com/show_bug.cgi?id=486602 
No, the /etc/resolv.conf only contains IPv4 addresses here.

-- 
Regards,
Richard "Shred" Körber

[Ulrich Drepper]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

What's the status of this?  I haven't heard any more details.  Has this
resolved itself?

- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
>
> iEYEARECAAYFAkn0ficACgkQ2ijCOnn/RHR3iQCff5+tqRfFpmqIzedMTgkshNMq
> 9r8AoL4D+uDsZDj95Bywg+FxrchlJs1H
> =4m58
> -----END PGP SIGNATURE-----

[Richard Körber]

Hi!

>  What's the status of this?  I haven't heard any more details.
>  Has this
>  resolved itself? 
I have found out that nss-mdns.i586 caused the trouble, see here:

https://www.redhat.com/archives/fedora-test-list/2009-April/msg01471.html

-- 
Regards,
Richard "Shred" Körber

[Ulrich Drepper]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>  I have found out that nss-mdns.i586 caused the trouble, see here:
>  [...] 
What did the /etc/nsswitch.conf file look like after you installed only
the i586 package?  What I see is that

   mdns4_minimal [NOTFOUND=return]

gets inserted into the hosts line.  This shouldn't cause any problems
(and my testing confirms this).  In this case the missing x86-64 module
is causes the mdns4_minimal entry to be ignored.

If there is something like [UNAVAIL=return] or [!SUCCESS=return] then
this is a problem because the UNAVAIL action is used in case the module
is missing.

- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
>
> iEYEARECAAYFAkn0kZYACgkQ2ijCOnn/RHQAIgCfYDB75nv+h/D2j+MKscwrCOo3
> GMUAnRxvDVDNkicHyVefoPyDbZxtmhWZ
> =+2XC
> -----END PGP SIGNATURE-----

[Richard Körber]

Hi!

>  What did the /etc/nsswitch.conf file look like after you installed
> only
>  the i586 package?  What I see is that
>
>      mdns4_minimal [NOTFOUND=return]
>
>  gets inserted into the hosts line. 
When no nss_mdns is installed, the host line reads:

   hosts:      files dns

After installing nss_mdns.i586, name resolving is broken. The only changed 
line in nsswitch.conf is the hosts line, which now reads:

   hosts:      files mdns4_minimal [NOTFOUND=return] dns

After installing nss_mdns.x86_64 as well, name resolving works again. The 
nsswitch.conf file is unchanged, the hosts line still reads:

   hosts:      files mdns4_minimal [NOTFOUND=return] dns

>  If there is something like [UNAVAIL=return] or [!SUCCESS=return]
> then
>  this is a problem because the UNAVAIL action is used in case the module
>  is missing. 
There is nothing like that in the nsswitch.conf even when name resolving is 
broken.

Should I file a bug in bugzilla?

-- 
Regards,
Richard "Shred" Körber

[Anne Wilson]

On Thursday 23 April 2009 09:10:58 Christopher Beland wrote:
>  I'll throw out some ideas, though others may have more experience
> with
>  this code.  Anne, I'm not sure you are experiencing the same problem, if
>  a reboot fixes it for you but not for Richard.  Are your other symptoms
>  similar?
>  
I haven't kept records, and my memory is notoriously unreliable.  Certainly I 
can confirm that firefox continues to work correctly on the Mandriva laptop at 
the time that I see the problem, so it's not a straight networking or dns 
problem.  I'm unsure of the implications of ipv6 in that up to now I've been 
disabling it.

In F10, for the first time, I set resolve.conf to use the router to pick up 
the dns servers from my isp.  When the problem recurred yesterday I added IP 
addresses for the ISP's nameservers.  Of course I'm now waiting to see whether 
it still happens.

Anne
-- 
New to KDE4? - get help from http://userbase.kde.org
Just found a cool new feature?  Add it to UserBase

[Jiri Cerny]

Hi,

I had exactly the same problems with rawhide that you are describing
approx. 2 weeks ago.
The DNS resolving did not work when I used my ASDL modem as DNS server
(that is the DNS server provided by DHCP). Then I changed the network
configuration to use directly the DNS server of my provider and since
then I had no problem. I was busy at that time and I had not time to
report this bug anywhere.

There might be a connection to DNS issues described in
http://udrepper.livejournal.com/20948.html ... However somebody more
knowledgeable than me should decide it.

Jiri

On Thu, Apr 23, 2009 at 12:56 AM, Richard Körber <fedora(a)ml.shredzone.de&gt; wrote:
>  Hi!
>
>  I just installed F11 beta and updated to the latest packages. It was working
>  fine so far, but then suddenly I got issues with domain name resolving.
>
>  When I use Firefox, Thunderbird, wget, whatever, I always get an error
>  message that the domain name could not be resolved. Anyhow the network is
>  up, DNS server IPs are set correctly and I can even use dig and ping to
>  successfully resolve domain names. When I enter a plain IP address at
>  Firefox, it also fetches the page correctly.
>
>  Configuration files seem to be correct, there are no hints in the log files,
>  I even checked that there is no proxy set, but I found nothing. I created a
>  clean user to make sure there is no configuration messed up. I rebooted the
>  system, but still got that issue. I'm totally clueless now...
>
>  Is this a F11 bug? I have had a look at bugzilla, but I wasn't sure what I
>  should search for.
>
>  Regards
>  --
>  Richard "Shred" Körber
>
>  --
>  fedora-test-list mailing list
>  fedora-test-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-test-list
>

[Jakub Jelinek]

On Thu, Apr 23, 2009 at 12:56:38AM +0200, Richard Körber wrote:
>  I just installed F11 beta and updated to the latest packages. It was
>
>  working fine so far, but then suddenly I got issues with domain name 
>  resolving.
>
>  When I use Firefox, Thunderbird, wget, whatever, I always get an error 
>  message that the domain name could not be resolved. Anyhow the network is 
>  up, DNS server IPs are set correctly and I can even use dig and ping to 
>  successfully resolve domain names. When I enter a plain IP address at 
>  Firefox, it also fetches the page correctly.
>
>  Configuration files seem to be correct, there are no hints in the log 
>  files, I even checked that there is no proxy set, but I found nothing. I 
>  created a clean user to make sure there is no configuration messed up. I 
>  rebooted the system, but still got that issue. I'm totally clueless 
>  now...
>
>  Is this a F11 bug? I have had a look at bugzilla, but I wasn't sure what 
>  I should search for. 
Try adding
options single-request
to your /etc/resolv.conf, maybe your DNS server is buggy.

	Jakub

[Ulrich Drepper]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You need to provide a lot more information:

- - turn off nscd

- - capture DNS traffic in wireshark (port 53)

- - run

     getent ahosts some.host.name

- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
>
> iEYEARECAAYFAknwd1AACgkQ2ijCOnn/RHRd2ACfUwHG6i7Dtz+B7uJNroVa/dve
> W30AnjnGP6boyMeOKBfV4NKlJJUkTZbu
> =XJqj
> -----END PGP SIGNATURE-----

[Richard Körber]

Hi!

>  - turn off nscd 
It was off all the time.

>  - capture DNS traffic in wireshark (port 53)
>  - run
>  
>       getent ahosts some.host.name 
There is no DNS related output in wireshark.

When I use dig some.host.name, I see the DNS request, and I get the IP address.

When I load a page in Firefox, there is also no DNS request in wireshark.

-- 
Regards,
Richard "Shred" Körber

[Ulrich Drepper]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Richard Körber wrote:
>  There is no DNS related output in wireshark. 
Assuming you really don't have nscd r unning this is something
completely different.

Check /etc/nsswitch.conf.  Run getent as before but with

  LD_DEBUG=files

in the environment to see whether the DNS NSS module is loaded and used.

- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
>
> iEYEARECAAYFAknwwbEACgkQ2ijCOnn/RHTG7wCgief6DGq5aJZ5S7ingTk7yk8T
> Xj8AoLhHTAEej2tC93BBW3sXZDHMp/Zf
> =u3sp
> -----END PGP SIGNATURE-----

[Richard Körber]

Hi!

Okay, I have found the reason...

This is a x86_64 installation. In order to install Google Earth, I had 
installed some i586 packages. One of it was nss-mdns. And this one is the culprit.

I have removed the nss-mdns-0.10-7.fc11.i586 package, and in that very moment, 
everything was working fine again. As soon as I reinstalled it, the DNS 
problems came back. Finally I installed both the i586 and x86_64 package of 
nss-mdns, and now everything is fine.

The question is: is this a bug in nss-mdns? Or is this an error in layer 8?

-- 
Regards,
Richard "Shred" Körber