[SOLVED] Reverse DNS Problem

[Nicko72]

Hi Everyone,

I am new to the forum so be gentle.

We use ISPCP Omega on our corporate LAN and host a couple on intranet pages and our company email. That is beside the point as I don't think this is where the problem is.

We have an intermittent reverse DNS problem. Anything that does a reverse DNS lookup is very slow, however it only happens for a day or 2 every month or so. I am at a total loss, and so is the consultant that charged us $500 to say we had a reverse DNS problem, which I told him when he first arrived.

Symptoms: Sending email messages take 20 seconds from Windows clients, its usually instant. Our older network scanner times out and can't connect to the network to send scanned documents, I can't change its timeout time, when logging in to one of our servers via Putty there is a 20 or 30 second delay from entering username to the password dialog. Nslookup from windows results in both of our internal DNS servers timing out, dig from windows works instantly and returns expected results.

I have run nmap on the network just to make sure a staff member hasn't brought in a device that could be causing a conflict. I used a packet sniffer yesterday, and will compare its logs once the network is back to normal, which I expect it will be tomorrow.

Nothing at all on our network has changed, I just don't have any idea where to look now, can anyone make any suggestions? Would a failing NIC on a workstation cause something like this?

---

I should add, symptoms remain when all workstations are shut down, and I turned off SAMBA.

[rbtux]

What Kind of Switches do you use?

[Nicko72]

We are only a small company, our switch is a single HP Procurve 2650 and our ADSL router is a Cisco 857.

I just don't understand how it can work perfectly for a couple of months and then go down for 2 or 3 days and then correct itself. Bind wouldn't contact the root servers for an internal Lan reverse lookup would it? Just wondering if maybe when we see these symptoms if our ISP, thus our domain/IP address has ended up in a blacklist.

[Nicko72]

The problem has been resolved. We can't quite understand why it was an intermittent problem, which is why it has been so difficult to diagnose. We had server A pointing to Server B in its resolve.conf and server B pointing to server A in its resolve.conf.