Nationwide DNS problems?????

[paineinthearse]

For the past 2-3 hours I have been having high speed cable internet problems. First no service at all, now intermittent problems.

Comcast tech support says it is a Nationwide DNS problem. They have no detailed information if this is a hack, virus or whatever. There is nothing in Google news.

Anyone have any info?

[Gman]

1. Having no problems with MSN dialup

while on the road here.

[NMDemDist2]

2. my cable internet is fine

hubby and I are both surfing and no speed problems at all

:shrug:

[arissa]

3. I have comcast and have been having problems as well

But I couldn't get a live person on the phone with them if my life depended on it right now. It took me over an hour of calling before I stopped getting a busy signal. I think it may just be a comcast thing. :shrug:

[Demonaut]

46. big time, just happened that a repair guy was here today and

I've been quietly cursing him...lol first one that's been by in two years

[Ladyhawk]

4. I've noticed that the feeds from AAR have been dicey.

I've wondered about router issues, but I don't like this "nationwide" DNS talk. It sounds kind of scary.

[flamingyouth]

5. Are you on Comcast?

I've been having some problems too but it seems to be working better now.

[paineinthearse]

29. Yes. From the replies, seems to be Comcast only. nt

[htuttle]

6. I checked the ITR, but it didn't show any problems out of the ordinary

http://www.internettrafficreport.com/main.htm

It probably wouldn't show a problem with Comcast's DNS servers, though.

[indianablue]

7. I have Comcast, I have had problems too...

It is getting better now but it was bad for the last 3 hours. I think it is a DNS problem cause some sites would come in slowly some not at all but it is getting better. I was streaming AAR when it went down thought there was trouble on my end but was able to eliminate it but the problem seems to be easing.

[AlCzervik]

15. comcast here and yes problems

[TwilightZone]

8. Traffic looks pretty decent overall, so I doubt the problem is nationwide

http://www.internettrafficreport.com/main.htm

[teamster633]

9. No info but I'm having the same problems you described.

[Spider Jerusalem]

10. Must be a problem with Comcast's DNS servers.

Every ISP has its own DNS servers, so this is most likely limited to Comcast (which sucks in the extreme anyway; no one I know who's had Comcast has had a good experience with either service or support).

[virgdem]

11. It must be a problem with Comcast...

I have Cox High Speed Internet and I am not experiencing any problems.

[BattyDem]

12. No problem with my cable internet connection

My guess ... it's a Comcast problem and they're passing the buck!

On edit: I don't have Comcast.

[globalvillage]

19. I believe what they're saying

is that it's a Comcast nationwide problem, and that all of the Comcast cable markets are experiencing it, not that it's a global (all cable company) issue. That's how it was explained to me.

[BattyDem]

23. Oh I see ... I misunderstood what you meant ...

Silly me. :silly:

[MazeRat7]

13. No incident reports have been posted. Must be ISP specific (n/t)

[AlCzervik]

14. me too, i can't get IE to work so i'm on Safari

right now, glad you posted this cause i was starting to think something bad had happened to my computer.

[rodeodance]

17. tomorrow there is a sun eclipse-and the Pope is to be buried.

[Bluebear]

16. Glad it's not only me

Same story here arse

[seemslikeadream]

18. Me too!!!

Don't know anything :shrug:

Comcast - yes

[AlCzervik]

21. just got done talking to them as well, same thing

they know as much as we do.

[Nomad559]

20. Comcast

I am having problems on Comcast also, I was unable to connect to many websites.

I was able to solve the problem by using a proxy.

[Triana]

22. Been s l o w for me for days - off and on

Dunno wtf is going on. Some friends of mine have been having weird issues too. Seemed DNS related (ie: can reach some sites but not others, etc...)


?

[southlandshari]

47. Same here - several days, and not ComCast

Broadband connection runs fine for anywhere from 5-15 minutes, then everything slows to a crawl. Doesn't matter time of day. Tonight it is somewhat better, ironically, but still gets unbearably bogged down after a while.

Weird.

[Ann Arbor Dem]

24. We're having problems in SE Michigan with Comcast internet service too.

I was trying to use my cell phone earlier, and I kept getting the "all circuits are busy" message. Probably coincidence, but I haven't had that problem for a long, long time.

[Feron]

25. Maybe this will help....

http://www.dslreports.com/forum/remark,13114138

[paineinthearse]

31. Feron

Thanks.

My computer needs viagra, can't get your site up!

:hi: welcome to DU

[Nomad559]

33. Thanks Feron

The 4.2.2.2 and 4.2.2.1 servers are working great for me.

How do I change what DNS server my computer uses
http://www.dslreports.com/faq/8164

:)

[Bluebear]

37. Thank you feron, you rock

4.2.2.2 is flying for me.

[purr]

26. I'm from Pa

The tech told me (about 2 hrs ago) that it was in Pa, Oh, spreading down into Kentucky and some north eastern states. Said no est of fix or why the DNS servers are down.

THE AGONY!!

[kittykitty]

30. I'm in PA, too. Trouble since afternoon--mostly off, a few minutes on. NT

[RC]

27. I did!

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=104x3430844

It slowly cleared up last night. It started at 2:20 AM on April 5th. for approx 2 1/2 days they were out or not working very well. Mostly out. Something happened, but no one will admit what.

Today it has been ok except Netscape has the below message for the local online News Paper. FireFox does it on Google. IE works ok.
You are not authorized to view this page
You do not have permission to view this directory or page from the Internet address of your Web browser.

If you believe you should be able to view this directory or page, please contact the Web site administrator by using the e-mail address or phone number listed on the newsignup.cableone.net home page.
HTTP 403.6 - Forbidden: IP address rejected
Internet Information Services

Technical Information (for support personnel)

* Background:
This error is caused when the server has a list of IP addresses that are not allowed to access the site, and the IP address you are using is in this list.

* More information:
Microsoft Support

[TreasonousBastard]

28. No problem with Verizon DSL around here.

[wisteria]

32. I've been having problems also. I am on Comcast. n/t

[PassingFair]

41. Just now it seems better.

We have Comcast in Michigan. It's been flakey all day.

[lala_rawraw]

34. Massive problems

I have been having massive problems and BellSouth said the same thing. Very odd, no? We did sell our broadband to India, right, was it India? I don't know enough about such technical things, but can India control the pipeline and bandwidth? In fact, can anyone? Just curious.

[Redstone]

38. No, nobody can.

Redstone

[lala_rawraw]

40. So what could be causing it on different servers?

I don't get this stuff. Tell it to me as though speaking to a child, a child raised in a cave. Otherwise, it makes no sense to me:D

[eaglenetsupport]

42. This isn't a comcast issue per-say, it's

the backbone flowing through a router at NETSRV about thirteen hops away from me. This should effect any ISP that's using NETSRV as a bandwidth provider or any that are handing off there packets through NETSRV routers. Here is a trace route that will show the broken router. This is ridiculous that it has gone down this long. When a router goes down in the backbone (just means large bandwidth haulers well down the line from your ISP) bells and whistles go off all over the place. For comcast to tell people that it's a DNS problem is their tech support folks needing a different profession. Phone support folks don't understand this stuff or they wouldn't be stuck answering tech support phones for 10 Bucks an hour. It's a five second procedure to diagnose networking problems. Somebody at NETSRV doesn't want to call someone in and thinks that it is best to wait till morning, probably a time and a half excuse.

milliseconds per packet are smooth and consistent times for each of the three packets sent in the test, indicating not a data collision problem which is usually what you would see when a problem is actually an Internet wide problem.

# traceroute comcast.com
traceroute to comcast.com (164.109.28.3), 30 hops max, 38 byte packets
1 router (206.168.38.62) 0.557 ms 0.364 ms 0.319 ms
2 165.236.232.13 (165.236.232.13) 1.746 ms 1.582 ms 1.631 ms
3 170.147.161.94 (170.147.161.94) 1.799 ms 1.761 ms 1.794 ms
4 dvr-edge-09.inet.qwest.net (65.121.56.105) 1.632 ms 1.721 ms 1.634 ms
5 dia-core-01.inet.qwest.net (205.171.10.37) 1.957 ms 1.736 ms 1.797 ms
6 dal-core-02.inet.qwest.net (205.171.8.141) 23.585 ms 23.351 ms 23.248 ms
7 dap-brdr-01.inet.qwest.net (205.171.225.53) 23.569 ms 23.355 ms 24.593 ms
8 POS1-1.BR2.LAX9.ALTER.NET (204.255.168.37) 34.385 ms 34.369 ms 33.857 ms
9 0.so-3-3-0.XL2.DFW9.ALTER.NET (152.63.103.77) 33.396 ms 35.971 ms 36.002 ms
10 0.so-6-0-0.XL2.DCA6.ALTER.NET (152.63.38.74) 55.019 ms 58.945 ms 54.799 ms
11 0.so-7-0-0.GW6.DCA6.ALTER.NET (152.63.41.225) 54.532 ms 58.246 ms 55.683 ms
12 digex-gw.customer.alter.net (157.130.214.102) 58.180 ms 56.441 ms 59.127 ms
13 vlan39.dca2a-fdisa-sw1-msfc1.netsrv.digex.net (164.109.3.149) 57.527 ms 59.903 ms 61.
751 ms
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *

[lala_rawraw]

45. Did I not say explain this to me as though I were a child?

An idiot child at that. You must be thinking of Mozart at age 9, because the above makes no sense to me silly. Never mind, maybe the Internets need a nap from the unbearable lightness of being, who knows. :D

[merh]

35. bellsouth and cablenet have been messed up since last

night.

yahoo groups are slow

:hi:

[Fescue4u]

36. Yes..no...maybe..

Here's a posting from NANOG (A list that the big ISPs communicate via)

http://www.nanog.org/mailinglist.html



ISC SANS has recently disclosed yet another suspected DNS cache
poisoning attack. I reach a different conclusion. based on publicly
available data. Maybe there is unpublished information which suggests
a different view.

Unofficial name servers which pose as authoritative for well-known
zones have been around for ages. An astonishingly large number is
officially authoritative for (at least somewhat) frequented zones, and
from time to time, your resolvers receive authority sections
containing leaked unofficial data. I noticed this unfortunate fact
back in July 2004, when I looked more closely at DNS packet captures
for debugging purposes. Even in my limited sample, the number leaking
name servers was so high that systematically contacting their
operators and convincing them to change their configurations seemed
unfeasible (and many of them were located in regions which are not
exactly known for their cooperative spirit when it comes to such
matters).

Today, I looked again at a few unofficial servers. Quite a few of
them are operated by apparently respectable organizations with an AS
number etc. (definitely not the backyard servers behind a cable modem
I would expect in an attack). It is hard to tell if the more shady
ones legitimately redirect customer traffic, and unintentionally leak
these records to the general Internet, or attempt an actual attack.
(I'm not sure how to tell them apart at the protocol level. Maybe I'm
missing something.) Many of the unofficial records have been
unchanged for quite some (i.e. predating the current "pharming"
craze). Even the DNS cache poisoning case described in the ISC diary
could be the unwanted consequence of an oversimplified DNS
configuration (wildcard RRs for *.com instead of a proper DNS zone).

Are any ISPs actually willing to disconnect customer name servers
which serve unofficial zones? I don't believe that many ISPs would
try to exercise this much control over the packets their customers
send. Furthermore, there are apparently some reasons for running such
servers which generally are considered legitimate.

Should we monitor for evidence of hijacks (unofficial NS and SOA
records are good indicators)? Should we actively scan for
authoritative name servers which return unofficial data? I don't
think this makes sense, even if we could strongly discourage the
practice. Right now, I suspect that many people rediscovered the
relative weakness of the domain name system and started looking for
anomalies, and that's why we see an increasing number of reports --
not because of an increasing number of actual attacks.

[natrat]

39. ca. 8pm comcast- bad internet-send help -sos

[high density]

43. It looks like a Comcast issue

http://isc.sans.org/diary.php?date=2005-04-08
http://www.dslreports.com/forum/remark,13115953
http://www.dslreports.com/forum/remark,13114138~root=comcast~mode=flat

[Cadence]

44. I have comcast cable internet and I've been having the

same problems. I could tell it was DNS and it started at about 5:00 p.m. seemed to be intermittent but I couldn't get things working long enough to really do anything until about 1/2 hour ago.