ultimate_newuser
asked on
Windows XP cannot resolve DNS names but nslookup works
My PC is a samsung X20 laptop, ran fine for many years.
Had trouble with spoolsv.exe, made me remove some network drivers (e.g. Cisco VPN client, AVM bluetooth driver), and installed XP service pack 3 (through complete download).
After this, DNS resolution has stopped working.
Network connection works fine, can reach any host through IP address, but no windows program resolves DNS names.
E.g.
>ping google.com
gives: ping can't find host "google.com"
>nslookup google.com
Server: two.xxx.intern
Address: 172.16.0.246
non-authoritative answer:
Name: google.com
addresses: 74.125.67.100,....
Have seen similar question before, but answers didn't help.
- Windows XP Professional SP3
- Basic SW loaded
- Integrated NIC
- ESET virus, old Sophos installation (unable to remove, but disabled)
Problem:
- PC receives IP information address via DHCP (IP addr, DNS)
- PC cannot resolve Internet host names via DNS
- PC can get to web sites using ip address in place of Host name
ipconfig /all gives:
Ethernetadapter LAN-Verbindung:
Verbindungsspezifisches DNS-Suffix: xxx.de.intern
Beschreibung. . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller
Physikalische Adresse . . . . . . : 00-1C....
DHCP aktiviert. . . . . . . . . . : Yes
Autokonfiguration aktiviert . . . : Yes
IP-Adresse. . . . . . . . . . . . : 172.16.2.139
Subnetzmaske. . . . . . . . . . . : 255.255.252.0
Standardgateway . . . . . . . . . : 172.16.0.1
DHCP-Server . . . . . . . . . . . : 172.16.0.253
DNS-Server. . . . . . . . . . . . : 172.16.0.246
172.16.0.245
Primärer WINS-Server. . . . . . . : 172.16.0.253
Troubleshooting history (the following have been unsuccessful)
- LSPFIX
- WinsockXPfix
- Removed TCP/IP and reinstalled
- Disabled Windows Firewall
- Set manual DNS server addresses
- Spybot S&D, AdAware failes
- services: dns-client running, tried activated/non-activated
- re-installed network card (broadcom 440)
- problem on both connections: the internal nic and the wlan
- tried to remove service pack 3, failed due to "file not found"
Current status
I am currently at a loss.
Do you have any idea?
Thanks!
Had trouble with spoolsv.exe, made me remove some network drivers (e.g. Cisco VPN client, AVM bluetooth driver), and installed XP service pack 3 (through complete download).
After this, DNS resolution has stopped working.
Network connection works fine, can reach any host through IP address, but no windows program resolves DNS names.
E.g.
>ping google.com
gives: ping can't find host "google.com"
>nslookup google.com
Server: two.xxx.intern
Address: 172.16.0.246
non-authoritative answer:
Name: google.com
addresses: 74.125.67.100,....
Have seen similar question before, but answers didn't help.
- Windows XP Professional SP3
- Basic SW loaded
- Integrated NIC
- ESET virus, old Sophos installation (unable to remove, but disabled)
Problem:
- PC receives IP information address via DHCP (IP addr, DNS)
- PC cannot resolve Internet host names via DNS
- PC can get to web sites using ip address in place of Host name
ipconfig /all gives:
Ethernetadapter LAN-Verbindung:
Verbindungsspezifisches DNS-Suffix: xxx.de.intern
Beschreibung. . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller
Physikalische Adresse . . . . . . : 00-1C....
DHCP aktiviert. . . . . . . . . . : Yes
Autokonfiguration aktiviert . . . : Yes
IP-Adresse. . . . . . . . . . . . : 172.16.2.139
Subnetzmaske. . . . . . . . . . . : 255.255.252.0
Standardgateway . . . . . . . . . : 172.16.0.1
DHCP-Server . . . . . . . . . . . : 172.16.0.253
DNS-Server. . . . . . . . . . . . : 172.16.0.246
172.16.0.245
Primärer WINS-Server. . . . . . . : 172.16.0.253
Troubleshooting history (the following have been unsuccessful)
- LSPFIX
- WinsockXPfix
- Removed TCP/IP and reinstalled
- Disabled Windows Firewall
- Set manual DNS server addresses
- Spybot S&D, AdAware failes
- services: dns-client running, tried activated/non-activated
- re-installed network card (broadcom 440)
- problem on both connections: the internal nic and the wlan
- tried to remove service pack 3, failed due to "file not found"
Current status
I am currently at a loss.
Do you have any idea?
Thanks!
akahan
What happens if you set your DNS server to 208.67.222.222? Does DNS suddenly start working? If so, perhaps it's a problem with the DNS servers you are currently using, which seem to be on your own network.
ASKER
Thank you for the quick reply!
Just tested it, unfortunately doesn't help.
As nslookup also uses the nameserver on our own network and ip addresses are resolved with nslookup, I assume the problem is on the client.
How can I discover if my client sends out any udp/tcp packets at all for the dns request? Maybe that'd help to narrow down the problem
Just tested it, unfortunately doesn't help.
As nslookup also uses the nameserver on our own network and ip addresses are resolved with nslookup, I assume the problem is on the client.
How can I discover if my client sends out any udp/tcp packets at all for the dns request? Maybe that'd help to narrow down the problem
Good point re nslookup.
You could use wireshark (a packet sniffer) to determine whether the machine is actually sending packets for the DNS requests. Have you looked for something strange in your hosts file?
You could use wireshark (a packet sniffer) to determine whether the machine is actually sending packets for the DNS requests. Have you looked for something strange in your hosts file?
ASKER
hosts file: was empty
now I just put in two lines for my provider's smtp/imap server to be able to send and receive emails.
Thanks for the wireshark hint, just downloading and will test it in a minute.
now I just put in two lines for my provider's smtp/imap server to be able to send and receive emails.
Thanks for the wireshark hint, just downloading and will test it in a minute.
ASKER
ok, captured the packets with wireshark.
now it gets interesting:
test:
typed "http://www.google.com" into firefox and captured packets.
result:
Even though the dns server 208.67.222.222 is the only DNS server according to ipconfig /all, there are no packets sent to it.
The client sends a packet to the WINS-Server in the network to port 137 net bios querying for www.google.com.
The wins-server returns "requested name does not exist"
Client sends 4 net bios name queries to 172.16.3.255 (?) without getting a response.
So:
- client does not send a dns query to the nameserver
- client sends netbios ns requests to wins server
now it gets interesting:
test:
typed "http://www.google.com" into firefox and captured packets.
result:
Even though the dns server 208.67.222.222 is the only DNS server according to ipconfig /all, there are no packets sent to it.
The client sends a packet to the WINS-Server in the network to port 137 net bios querying for www.google.com.
The wins-server returns "requested name does not exist"
Client sends 4 net bios name queries to 172.16.3.255 (?) without getting a response.
So:
- client does not send a dns query to the nameserver
- client sends netbios ns requests to wins server
- Are you by any chance using Zonealarm?
ASKER
have used it previously, but not anymore.
no zonealarm processes running.
no zonealarm processes running.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you. Yes, that's a good idea. I was already looking for the downloaded version from this morning, but somehow it's gone, so I'll have to download it tomorrow again when I'm at the good network connection with a second computer.
ASKER
sp3 installation in protected mode fixed the problem