Nslookup fails but ping to ip of same server works

nslookup on client fails no matter what address I put in for a DNS server.  Is there a way to see what is happening with nslookup.

when I type nslookup I get unknown for default server no matter what DNS server I use.
DwciAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Gerwin Jansen, EE MVETopic Advisor Commented:
Start nslookup (no parameters) and enter:

set debug

Then enter a name you want to lookup. If you don't see what is happening try this instead:

set d2

Then try the lookup again. What do you get?
giltjrCommented:
NSLOOKUP only tries to reslove names using DNS.

ping, along with most other commands will by default read the "hosts" file.  On *nix systems this would be /etc/hosts.  On Windows systems this would typically be C:\Windows\system32\drivers\etc\hosts.

Also on Windows systems it may try to use NetBIOS name lookup and/or WINS.
DwciAuthor Commented:
response is :
server: unknown
address: 192.168.1.1

socket (dg) failed: result too large
socket (dg) failed: result too large
*** unknown can't find msn.com: No response from server
SolarWinds® VoIP and Network Quality Manager(VNQM)

WAN and VoIP monitoring tools that can help with troubleshooting via an intuitive web interface. Review quality of service data, including jitter, latency, packet loss, and MOS. Troubleshoot call performance and correlate call issues with WAN performance for Cisco and Avaya calls

Gerwin Jansen, EE MVETopic Advisor Commented:
What if you try this on the nslookup command line:

> msn.com 208.67.220.220

(the ip address is an OpenDNS server)
giltjrCommented:
What operating system are you running?
giltjrCommented:
This part is normal:

response is :
server: unknown
address: 192.168.1.1

nslookup tried to do a reverse lookup on the IP address of the DNS server it is going to use.  Most places don't setup reverse entries (a.k.a. PTR records) so this always fails.  This is bascially saying nslookup could not find the name associated with the IP address 192.168.1.1.

Now the next two messages are a bit troubling:  socket (dg) failed: result too large

This implies that nsloolup got back a response, it it was larger than what it expected, thus the response was dropped/ignored and so nslookup said it never got a response.
footechCommented:
Try this.
nslookup
server 8.8.8.8
set vc
www.google.com.

Open in new window

Do you get a response?

I've never experienced it myself, but from what I've read the error message can be from when you're using EDNS0 but a device is not allowing it.

Next try this command and post back the results.
nslookup -type=TXT rs.dns-oarc.net
DwciAuthor Commented:
footech: the error on the first steps is unspecified error
second command returns
cannot find rs.dns-oarc.net no response from server

I am questioning if I have some sort of virus or malware that has done something to the network files.
footechCommented:
Do you have other machines on the same network which work correctly?  You could try running sfc /scannow to check system files.
What do you have for the internal DNS server?
What is the network firewall?

One more attempt at the last test.
nslookup
server 8.8.8.8
set vc
set type=txt
rs.dns-oarc.net

Open in new window

giltjrCommented:
Can you access website using host name from this computer?  Do you get to the correct site?

If so then it sound just like nslookup is broke and only nslookup.

Can you post the output from "ipconfig /all" command?

Typically nslookup will only use the 1st dns server if there is more than one configured.  Whereas all other programs when doing name resolution will all DNS servers that are configured.
DwciAuthor Commented:
after sfc command, which found nothing, still the same result.

As for giltjr questions:
No access to any hostname from the computer, any browser.

Below is the ipconfig but understand I have forced it to multiple DNS servers and it still doesn't work including 8.8.8.8.
 Connection-specific DNS Suffix  . : cacc.local
 Description . . . . . . . . . . . : Intel(R) 82579LM Gigabit Network Connect

 Physical Address. . . . . . . . . : 3C-97-0E-21-E1-69
 DHCP Enabled. . . . . . . . . . . : Yes
 Autoconfiguration Enabled . . . . : Yes
 IPv4 Address. . . . . . . . . . . : 192.168.1.21(Preferred)
 Subnet Mask . . . . . . . . . . . : 255.255.255.0
 Lease Obtained. . . . . . . . . . : Tuesday, April 14, 2015 1:45:26 PM
 Lease Expires . . . . . . . . . . : Wednesday, April 15, 2015 2:10:05 PM
 Default Gateway . . . . . . . . . : 192.168.1.1
 DHCP Server . . . . . . . . . . . : 192.168.1.1
 DNS Servers . . . . . . . . . . . : 192.168.1.1
                                     192.168.1.5
                                     192.168.1.1
 NetBIOS over Tcpip. . . . . . . . : Enabled
giltjrCommented:
When you say ping resolves the name, is the host name one on the Internet or one on your LAN?

Can you try:

nslookup
lserver 192.168.1.5
www.experts-exchange.com
DwciAuthor Commented:
OK so here is the complete scenario:

ping's to IP's works fine
ping's to FQDN do not work
nslookup does not work

Seems to be to be something with dns.  As stated above I continue to get no response from server.

All suggestions above have not changed the situation.  It doesn't seem to matter what DNS server I use it still fails.
giltjrCommented:
O.K, I mis-read the title and though that ping to names work.

What are 192.168.1.1 and 192.168.1.5?

Are they actually running a DNS server service?

If so are they configured to forward to your ISP DNS resolvers/servers or to some other resolvers/servers on the Internet such as Google's 8.8.8.8 and 8.8.4.4?

Are all firewalls invloved (on desktops/servers/routers or standalone firewalls)  configured to allow DNS resolution requests out and in (UDP port 53)?
DwciAuthor Commented:
192.168.1.1 is the router
192.168.1.5 is a server setup with DNS
I have tried both with forwarders and not but still no luck.
As for the firewalls etc this is one computer that doesn't work all the rest in the network are fine.
giltjrCommented:
If possible can you install Wireshark and do a packet capture to see what it may be sending out to the network when it attempts to do name resolution.

Do you have any VPN client software installed on that computer?
Does it have the same anti-virus software as the rest of the computers?
DwciAuthor Commented:
NO VPN Client that I am aware of.  It had the same anti-virus as the others.  I even removed that this morning as a test.
I am not a wireshark expert so not sure what to look for.

What I will tell you is that network shares using names works fine just no outside dns lookups.
giltjrCommented:
Network share are most likely using WINS if you are in an Active Directory environment or NetBIOS name lookup, which is a UDP broadcast, if you are not a AD environment.

With Wireshark you want to see where the lookup is failing.  When working you should see  UDP packet going to your DNS server with a destination port of 53.   Then a response from your DNS server from port 53.

You can use the display filter of "udp.port == 53", but don't put the quotes in.
DwciAuthor Commented:
Using the udp.port==53 I get no data from wireshark.
giltjrCommented:
That implies that no DNS queries are leaving your computer.

Please do ipconfig /all again and at the top will be "Windows IP Configuration."  What does it have for Node Type?
DwciAuthor Commented:
Hybrid is the node type.
footechCommented:
I'm wondering if you ever did this last test.
nslookup
server 8.8.8.8
set vc
set type=txt
rs.dns-oarc.net

Open in new window

It's not a bad idea to run the last command a few times if necessary.  I've experienced some timeouts myself.

It might be worth checking that you don't have any proxy settings in place.
Can you browse to a site using an IP address?  Like http://216.58.217.36/ (a Google IP).
DwciAuthor Commented:
I have run the commands multiple times and everytime it says it cannot find rs.dns-oarc.net

It will not browse to the IP either.

I don't see any obvious proxy settings but do you have any good places to look?
footechCommented:
Control Panel > Internet Options > Connections tab > LAN Settings.

Since it won't browse, it's more than DNS that isn't working.
Can you check your local firewall to make sure Outbound traffic is allowed?
Might try a repair of the TCP/IP stack and Winsock.
netsh int ip reset C:\resetlog.txt
netsh winsock reset

Open in new window

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DwciAuthor Commented:
the repair of the TCP/IP Stack and winsock fixed the problem.  Thanks
footechCommented:
Super!
wolfgangmehlCommented:
Thanks, helped super with windows vista 32-bit
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DNS

From novice to tech pro — start learning today.