dns questions

[NewToo]

Hello

My company have two DNS server that we are host our clients domain for. My question is...when i check in our primary DNS server event viewer i notice that it keeps comming up with a error of " The DNS server encountered apacket address to iself ip address xxx.xxx.xxx.xxx this situation usually indicates a configuration error". I have two NIC in this server one public nic that have 2 public ip address and the other nic is a private ip address.


Thank You for the Help

Newtoo

 

[SgtB]

The IP in the event log, I'm assuming that its the IP of one of the external IPs correct?

Questions, even though errors are present, is DNS still functioning?
You mentioned that his is your primary DNS server, is zone replication functioning properly with the secondary server?
Is that the entire error message you gave in your post?

In your port you say that your DNS server has public IP's. Is there any firewall in place? Is the ssrver up to date on patches? I'm not very familiar with DNS exploits, but I know there are some out there. I'm not saying this is what your problem is, but there is a chance that your DNS server has been compromised. Maybe possibly....

Let me know, hope I can help some more!

 

[NewToo]

SgtB

DNS is working fine all zone replication functioning properly with the secondary server. No firwall, all updates are install. Even if DNS is working fine I know i mess up somewhere!!!!


Thanks
Newtoo

 

[SgtB]

Whats the entire entry in the log viewer? Cut and paste if you can (excluding you pbulic IP of course). Also include the event ID from the entry as well.

How frequent is the error? Is it flooding your event logs? Is it sporadic? Or is there a certain time between entries?

 

[NewToo]

SgtB

The error is flooding every a couple of mins.
Here's the error:

Event Type: Warning
Event Source: DNS
Event Category: None
Event ID: 7062
Date: 10/11/2002
Time: 7:16:10 AM
User: N/A
Computer: OC02SNS01
Description:
The DNS server encountered a packet addressed to itself -- IP address xxx.xxx.xxx.xxx

The DNS server should never be sending a packet to itself. This situation usually indicates a configuration error.

Example of self-delegation:
-> This DNS server dns1.foo.com is the primary for the zone foo.com.
-> The foo.com zone contains a delegation of bar.foo.com to dns1.foo.com,
(bar.foo.com NS dns1.foo.com)
-> BUT the bar.foo.com zone is NOT on this server.

Note, you should make this delegation check (with nslookup or DNS manager) both on this DNS server and on the server(s) you delegated the subzone to. It is possible that the delegation was done correctly, but that the primary DNS for the subzone, has any incorrect NS record pointing back at this server. If this incorrect NS record is cached at this server, then the self-send could result. If found, the subzone DNS server admin should remove the offending NS record.
Data:
00002550

 

[SgtB]

As per the event log, do you have any sub-zones? Have you delegated to any of your sub-zones?

I won't re-type the entire log, but have you looked into any of the things mentioned in the event log?

I'm also curious as to why you have two external IP's bound to the one NIC. I'm really thinking this may have something to do with the problem, but its just a guess.
If you get a chance, try disabling one of the IP's on the external NIC.

Also, what IP is the A record for the server? Is it one of the external IP's? If you choose to disable one of the external IP's, make sure its not the one the A record is bound to.

 

[NewToo]

SgtB

when the old admin register the dns server he register it with one of the public ip address so that our client point Netsol can their domani name to us. But when our company try to surf the internet we us the other public ip address.




Thanks
Newtoo

 

[SgtB]

You could contact the registering service, and let them know about the IP change of your DNS server, giving you the opportunity to simplify things, and cut some cost too since you could ditch that old IP all together.

Just my thoughts on it.

I'm at my limits though. I'm not too sure what the problem could be other than what the event log says. I'm still stuck on the idea that it might be beacuse of the two IP's on the one nic. If you get a chance on the weekend, try getting rid of one of the IP's. See if that gets rid of the errors.

Sorry I couldn't be of more help to you.

 

[NewToo]

SgtB

i can't really turn off one nic because we have people that use that during the weekend.

Thanks for the help

Newtoo

 

[GlenJohnson]

Don't know if this will help, but it's worth looking at.

http://www.eventid.net/display.asp?eventid=7062&source=dns

Glen A. Johnson
Microsoft Certified Professional
glen@nellsgiftbox.com


"A person often meets his destiny on the road he took to avoid it."
Jean de La Fontaine (1621-1695); French poet.