DNS issues on 2003 network

scottalanmiller

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change

Of course it can be that! That product is downright famous for doing stuff like this. That should have been mentioned immediately. Is that the problem here? Less than likely. Is it a possibility? Certainly.

You should get that removed, although it's difficult to remove and that's why it is sometimes classified as malware. You would be better off running with the OS' own AV than that. But of course, something like Webroot or Cylance would be far better still. But SEP... not a viable option IMHO.

scottalanmiller

Could it be a firewall with UDP throttling on and these machines are just getting caught at random?

wirestyle22

@scottalanmiller said in DNS issues on 2003 network:

Could it be a firewall with UDP throttling on and these machines are just getting caught at random?

Wouldn't that make the issue intermittent though?

BRRABill

@wirestyle22 said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change

Many times I have uninstalled AV from Symantec (or McAfee) that suddenly fixed all Internet issues.

thwr

@wirestyle22 said in DNS issues on 2003 network:

@scottalanmiller said in DNS issues on 2003 network:

Could it be a firewall with UDP throttling on and these machines are just getting caught at random?

Wouldn't that make the issue intermittent though?

Maybe just turn it off for a second and see if you can do some lookup

BRRABill

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

@scottalanmiller said in DNS issues on 2003 network:

Could it be a firewall with UDP throttling on and these machines are just getting caught at random?

Wouldn't that make the issue intermittent though?

Maybe just turn it off for a second and see if you can do some lookup

I've seen that not even work. Because the innards of it are messed up.

thwr

@BRRABill said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

@scottalanmiller said in DNS issues on 2003 network:

Could it be a firewall with UDP throttling on and these machines are just getting caught at random?

Wouldn't that make the issue intermittent though?

Maybe just turn it off for a second and see if you can do some lookup

I've seen that not even work. Because the innards of it are messed up.

NB: Would never install that on my servers, not even on workstations, but that's just IMHO.

wirestyle22

@BRRABill said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change
Many times I have uninstalled AV from Symantec (or McAfee) that suddenly fixed all Internet issues.

Symantec isn't on any of the servers but the DC though. If that were the issue wouldn't everything be triggered?

thwr

@wirestyle22 said in DNS issues on 2003 network:

@BRRABill said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change
Many times I have uninstalled AV from Symantec (or McAfee) that suddenly fixed all Internet issues.
Symantec isn't on any of the servers but the DC though. If that were the issue wouldn't everything be triggered?

Not nessecarily

Just imagine a "ban" added to the filter set because the fileserver asked the DNS too many times. For example because the fileserver queries the DNS about a client, which may happen very often within a small time window on a fileserver, usually early in the morning.

scottalanmiller

@wirestyle22 said in DNS issues on 2003 network:

@BRRABill said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change
Many times I have uninstalled AV from Symantec (or McAfee) that suddenly fixed all Internet issues.
Symantec isn't on any of the servers but the DC though. If that were the issue wouldn't everything be triggered?

It gets complex. It could do any number of things depending on what factor was causing this to happen.

thwr

@wirestyle22 said in DNS issues on 2003 network:

@BRRABill said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change
Many times I have uninstalled AV from Symantec (or McAfee) that suddenly fixed all Internet issues.
Symantec isn't on any of the servers but the DC though. If that were the issue wouldn't everything be triggered?

BUT please think twice before you are going to uninstall SEP Have seen weird things after an uninstall of Symantec products.

thwr

@scottalanmiller said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:
@BRRABill said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change
Many times I have uninstalled AV from Symantec (or McAfee) that suddenly fixed all Internet issues.
Symantec isn't on any of the servers but the DC though. If that were the issue wouldn't everything be triggered?
It gets complex. It could do any number of things depending on what factor was causing this to happen.

Yup. Like disaster-bingo.

wirestyle22

So what are my options here? Are there any other tests I can run?

coliver

Yep... Symantec will do this even if it isn't broken it just decides that all the things are wrong. This is bottom of the barrel along with Norton and McAfee.

scottalanmiller

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:
@BRRABill said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
@wirestyle22 said in DNS issues on 2003 network:
@thwr said in DNS issues on 2003 network:
Weird. And what about
nslookup www.cnn.com 8.8.8.8
from your print- or fileserver?

Should look like this:
nslookup www.cnn.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Nicht autorisierende Antwort:
Name:    prod.turner.map.fastlylb.net
Address:  151.101.36.73
Aliases:  www.cnn.com
          turner.map.fastly.net
Received the same error.
Any firewall in between? Some local AV with firewall included?
We use Symantec endpoint protection, but can It really be that? Based on yesterday I can't think of anything that would cause any of those settings to change
Many times I have uninstalled AV from Symantec (or McAfee) that suddenly fixed all Internet issues.
Symantec isn't on any of the servers but the DC though. If that were the issue wouldn't everything be triggered?
BUT please think twice before you are going to uninstall SEP Have seen weird things after an uninstall of Symantec products.

Yes, you need to uninstall, but you can't do it casually. SEP is "designed" to destroy systems as it is removed. It's how they get people to keep it around. It's why it is on our blacklist, our people can't recommend or install it. We consider it malware. It might be that they are just idiots and don't care that they do damage, it might be intentional, we have no idea. But the result is the same, SEP is a danger to install and should never happen. And you want to remove it, but it's dangerous even after removed. We always do clear rebuild if we find a machine with SEP on it. Have to be sure.

Thank goodness for virtualization. You can snapshot before attempting anything so you can just roll back.

thwr

@wirestyle22 said in DNS issues on 2003 network:

So what are my options here? Are there any other tests I can run?

You could add another DC and DNS to your domain, 2003 is out of support anyway

scottalanmiller

@coliver said in DNS issues on 2003 network:

Yep... Symantec will do this even if it isn't broken it just decides that all the things are wrong. This is bottom of the barrel along with Norton and McAfee.

Well, SEP is Norton. Two names, same product (SEP has more "features" that break your environment.) McAfee is bad, but far better than either of those. All three are worse than "just using nothing" though.

scottalanmiller

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

So what are my options here? Are there any other tests I can run?

You could add another DC and DNS to your domain, 2003 is out of support anyway

Probably the way to go. This system is suspect. You need clean builds and new systems. Why fix what is broken when you could actually fix the problems?

coliver

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

So what are my options here? Are there any other tests I can run?

You could add another DC and DNS to your domain, 2003 is out of support anyway

Yep, this would probably be your best bet.

wirestyle22

@scottalanmiller said in DNS issues on 2003 network:

@thwr said in DNS issues on 2003 network:

@wirestyle22 said in DNS issues on 2003 network:

So what are my options here? Are there any other tests I can run?

You could add another DC and DNS to your domain, 2003 is out of support anyway

Probably the way to go. This system is suspect. You need clean builds and new systems. Why fix what is broken when you could actually fix the problems?

I would be going from 2003 - 2012 R2. I wanted to do it on my test environment before I did it in a live environment