Intermittent TCP/IP Printing failing -- DNS related? EventID 6161 Error 1241

Only a few of my users are having intermittent printing problems. WinXP SP2 reports that the job failed. This generates a System Error in the Event Log with ID 6161. The content of the message is not helpful, but it has an error code in it of 1241 which is ERROR_INCORRECT_ADDRESS.

 I assumed that this would be a DNS problem from the error code. DNS is on Windows 2003 Server that is also running DHCP (w/ dynamic updates from DHCP to DNS). All of the printers have a static IP. All workstations are using DHCP. All workstations seem to resolve fine when the problem occurs. I can ping them and I can not ping the printers. It complains of not finding the host.

When I do an nslookup everything is fine, even when the problem occurs. If I do an ipconfig /displaydns it shows up as something like:

C:\>ipconfig /displayDNS | more
Windows IP Configuration

          printername.domain.com
          ----------------------------------------------------
          Name does not exist.
         
          dnsserver.domain.com
          -----------------------------------------------------
          (Information here is correct) (more stuff not listed)

If I do an ipconfig /flushdns everything is ok again and the print job goes through (without resubmitting). It really baffles me. DNS appears to be working correctly and so is I've run out of things to check. :(

Any help would be appreciated.

Thanks,
Jason
Lakee911Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MikeKaneCommented:
I assume that you have static A records for these printers in DNS or are you allowing WINS lookup from dns?


0
Lakee911Author Commented:
Yes A records exist in DNS for these printers. Thanks.
0
Keith AlabasterEnterprise ArchitectCommented:
If DNS itself was the issue then all users would have the problem, not just a couple and again, it would not be intermittent. That said, What is the common aspect to these users; there has to be something. VLAN? Subnet? DHCP server? VPN users? Geographical location?

Do you have a number of WINS/DNS servers or just the one? If more than one, are the records identical in each (are they replicating correctly)?

0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Lakee911Author Commented:
Keith: That's what has me baffled: the few users and intermittent occurance. Funny thing is *knock on wood* it's not occured today at all!

Every workstation is virtually identical software wise. Some hardware is different, but 99.9% same as far as software (except some user settings and they can't tinker with critical stuff).

We have two DNS servers, one here and one in a remote office. They are identical, replicating perfectly.

I appreciate your help with this.

Thanks,
Jason
0
Keith AlabasterEnterprise ArchitectCommented:
Ok, the printers are networked (they have static IP addresses. I'll make an assumption that they are HP. Are all other protocols switched off such as IPX/SPX, Appletalk etc?

You cannot ping the printers without flushing the DNS. Performing the netstat on the addresses, what does this show you? Does NSLOOKUP on the ipaddress or name of the vanished printer(s) return the right values?

After performing a dnsflush, do the same two commands again. Have any of the values changed in what is being reported (in respect to the printers)


 

0
Keith AlabasterEnterprise ArchitectCommented:
Sorry, I should have added that this should be performed from a machine that has lost connection to the printer(s)
0
SlyDogCommented:
When you say you can't ping the printer, are you trying the WINS name, the FQDN, or the IP?
Also, why do you have DNS entries for your printers? Just curious.
Are you running the printers off the server via a queue, or are you printing directly to them from each workstation?
0
Lakee911Author Commented:
Keith: The printers are HP. At one time we were using IPX/SPX so I know that's still on. That was a long time ago.I don't think that's an issue since this cropped up recently. I'll try the netstat next time. I'll have to wait until it occurs again.

SlyDog: Can't ping WINS or FQDN. It says it's an unknown host. Pinging UP works just fine. We're printing directly to them via TCP/IP. Each of our printers has a name and thats' what's in DNS. Easier to refer to them that way. Can remember name.domain.com rather than a bunch of IPs. Is it uncommon to have printers in DNS?

Thanks!
0
Keith AlabasterEnterprise ArchitectCommented:
jason, perform the netstat and the nslookup before hand as well. This will give you a baseline of what you would be expecting to see. Then, when the problem reoccurs, you can repeat the two tests on working/not working machines.

Cheers
Keith
0
Keith AlabasterEnterprise ArchitectCommented:
PS. No, its not uncommon to put the names into DNS; in fact, with 2000 onwards, many systems only have them in the DNS as WINS is slowly being dropped. (Well, that is the intention but probably won't happen in my lifetime)
0
Lakee911Author Commented:
Keith: If I do a netstat before the problem w/o printing obviously the printer isn't listed (not connected to it). If I actually print to it, sure it's listed. Is that what you wanted me to check? Thanks.

Jason
0
Keith AlabasterEnterprise ArchitectCommented:
Yes please, just to see how this is being reported (whilst a print is taking place). You mentioned that by performing a dnsflush the print job starts without having to resubmit the job so the spooler etc is obviously ready to forward the data once it knows where. When the problem commences, one would assume that the arp or the lookup will try and identify the address. I would have expected to see a device not found error returned rather than the incorrect_address message.
0
SlyDogCommented:
There's no problem with having the printers in DNS.
A thought just occured to me however. When you install the printer on a workstation, when you create the port, do you use the DNS name or the IP? I''m guessing you use the DNS name, so maybe try creating the port with the IP and see what happens.
0
Lakee911Author Commented:
It seems this intermittent problem is affecting machines as well--not just printers. Happened on a couple occasions now. Maybe it's been there all along. To my knowledge only three (happening ALOT to one in particular) machines on my network are having this problem -- all three from different images (but configured identically) diferrent hardware and no other (that I know of) like hardware and/or image is experiencing this.

Latest and greatest details:  User could not get to http://intranetserver.domain.com but they COULD get to http://intranetserver/. Unfortunately I forgot to do an ipconfig /displaydns. After doing an ipconfig /flushdns, it would connect to http://intranetserver/. I could not ping intranetserver.domain.com but I COULD ping intranetserver. Before, as only the host--no domain, and after the fix, either way, netstat showed a connection to the server:

  TCP    workstation:4372             intranetserver.domain.com:http     ESTABLISHED

Funny thing is on MY workstation this particular machine shows up as the IP address, not the domain name! Most everything else on the network comes up as names, not IPs.

Doing any ipconfig /all on the resulting workstation shows:

Windows IP Configuration

        Host Name . . . . . . . . . . . . : workstation
        Primary Dns Suffix  . . . . . . . : domain.com
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : Yes
        DNS Suffix Search List. . . . . . : domain.com
                                            domain.com

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : domain.com
        Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connection
        Physical Address. . . . . . . . . : 00-10-DC-90-D4-15
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.69
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.254
        DHCP Server . . . . . . . . . . . : 192.168.1.3
        DNS Servers . . . . . . . . . . . : 192.168.1.3
                                            24.95.80.41
        Lease Obtained. . . . . . . . . . : Tuesday, November 08, 2005 10:36:03AM
        Lease Expires . . . . . . . . . . : Wednesday, November 08, 2006 10:36:03 AM


Which is comprable to my workstation and all others in the organization.

Both before and after the problem occured nslookup does a forward and reverse lookup just fine. Forward works for intranetserver.domain.com to it's IP and intranetserver to it's same IP. Reverse works from IP to intranetserver.domain.com.

Thanks,
Baffled aka Jason




0
SlyDogCommented:
I notice you have an 24.95.80.41 dns server for you workstation. If this isn't an internal DNS server, you maybe be doing lookups against it for internal IP's, in which case it won't resolve. Normally you point all internal clients to internal DNS servers only, and have those DNS servers resolve any requests for external IP's.
This may be the cause of you problems.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Keith AlabasterEnterprise ArchitectCommented:
Absolutely. All machines regardless of them being servers, workstations or printers should only be using the internal DNS servers. These servers will then have the forwarders set pointing to the resolving DNS servers provided by your ISP. Your local DNS servers should also have their own IP address in the TCPIP settings for DNS. This ensures that everything follows the same resolution path. You mentioned earlier that you have more than one DNS server but they were replicating correctly. On the secondary DNS server, does this forward to your master internal DNS server or does it forward to your external DNS server? Either way, the work stations (and printers) should not have a DNS entry for the external DNS.
0
Lakee911Author Commented:
Oh.....That makes sense but why would it rely on the secondary DNS server when the first is available? The forwarder is in place on the sever. I thought it was good backup (secondary DNS on client) if ours were to go down that Internet would be available.

I will change the external secondary DNS entry to our other internal DNS server (happens to be in a remote office, but that's ok) and see if it clears up! I'll post some points in a few days if all is well.

Thx,
Jason
0
Keith AlabasterEnterprise ArchitectCommented:
To be perfectly blunt, it is sometimes a dark art. The same effect takes place frequently within DHCP. You create two DHCP servers and put one half of the available scope on the first and the second half of the scope on the second. Nine times out of ten you will get the nearest DHCP server as it is most likely to respond first but often it will have picked an address from the second as the first may have been busy.

That notwithstanding, you are right, it is good practice to have a second DNS entry but this should be a second internal DNS server; not an external one.

from the info in your ipconfig, this would also suggest that (assuming your external DNS is even accessible), you are allowing DNS calls from work stations directly out to the Internet. That is certainly NOT good practice....

0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.