XP DNS problem

[QueBert]

working on a guy's PC, his internet stopped working. I went thru the normal steps with no luck, one weird thing is when I'd ping the ip it would show a funky character and the PC speaker would beep. I couldn't get it to ping out. Called Charter and everything seemed fine on their end. The guy on the phone gave me the IP for Google and it pinged fine, but it's not resolving the DNS. He had me enter Charters DNS info manually still no luck. We wern't sure if it was their end or his, so I hooked up another PC, and after a few minutes I was able to access the internet normally.

I tried running his PC in safe mode to rule out a software issue with Norton or something. I can ping any actual IP address but when I try the domain it won't work. Never seen a problem like this and was hoping somebody might have a clue for me. At this point I told him I want to try a upgrade install of XP which is super easy. But I'm not sure that will even be effective.

suggestions?

thanks

 

[Markbnj]

Wow, wierd. Well the beep is probably because of a terminal bell character being echoed to the screen (I think it is ascii 7h, or something like that). Now why that's happening is a whole 'nother question. Can you show the results of the ping, at least what will print?

Name lookup on XP works something like this: if it is a fully-qualified host name try DNS, otherwise append the local DNS search suffix, if any, and then try DNS. If DNS fails try NETBIOS if NETBIOS over TCP/IP is enabled. Lastly, try the windows\system32\drivers\etc\hosts file and see if the host is in there.

If this all fails, name lookup fails. Usually a machine connected to an ISP gets the addresses of the DNS servers via the DHCP confguration. These can be overridden in the network connection settings properties dialog for the TCP/IP protocol stack on the active adapter.

Things to check: do ipconfig /all and see what DNS servers the machine is set to use. Ping them to make sure they're alive. Try nslookup a few times and see if they respond correctly for well-known sites. Check the router config and see what DNS addresses it is set to provide to DHCP clients. Check the protocol properties for TCP/IP and see if NETBIOS over TCP/IP is enabled. Check the hosts file for suspicious entries.

 

[spidey07]

This is normally a sign of a corrupted tcp/ip stack. there should be an article on microsoft on how to manually repair or reinstall it.

There's all kinds of files and calls in your stack, gethostbyname is one of them and what looks to be broken.

 

[JackMDS]

http://www.ezlan.net/debug.html

http://www.ezlan.net/clean.html#refreshnet

 

[QueBert]

Markbnj - didn't write it down but aside from the ascii character the actual ping results looked normal. I should say the ascii char comes up for where it says "pinging [host name]" if I type PING GOOGLE it goes "pinging [funky character]" *BEEEP* but the results are normal aside.

spidey07 - I thought that, just have never seen it act like this because of a bad stack, rebuilding it slipped my mind sort of. GOOD idea I think much better than a reinstall of XP 🙂

JackMDS - perfect! I will do this and if it doesn't work report back.

I need to read up on DNS because this sure was confusing the hell out of me yesterday, I was swearing up and down it was on Charters end until I hooked up the 2nd PC and got no problem.


excellent help here as always, dunno what I'd do without Anandtech

 

[ScottMac]

Did you check things like a software firewall ... maybe a manual entry is filtering or re-directing UDP/53 for something other than DNS?

Have you done a complete and multi-layer spyware check (Ad-Aware and Spybot S&D)?

Is there some other proxy in-line somewhere (i.e., this PC is tagged for intervention, but the other you connected is not)?

Did you check the "hosts" file? For WinXP, it would be in C:\WINDOWS\SYSTEM32\DRIVERS\ETC The only entry by default is "127.0.0.1 localhost"

Verify that your Default Gateway is the correct one (compare to the system that worked).

In the interface "advanced" settings, make sure that the domain assigned to "this" interface is either blank, or the correct domain for you local / ISP services.

Good Luck

Scott

 

[QueBert]

yes I checked firewall, I did not check the hosts file, but the gateway was the same on both systems and I verified it with the Charter tech dude on the phone. I checked all installed programs and did a C+A+D to see what was running, and didn't see anything. But booting into safe mode with networking should be enough. I didn't think to check the hosts, that is also a good idea.

The weird ascii char and the BEEP when I ping is definitely a sign something is wrong. hopefully the TCP/IP reset will work. He's not home today but when I go over I will let you guys know what worked, I'm sure one of the suggestions here is going to nail it.