Client getting incorrect DNS server and connection specific suffix

[Fox1977]

Hi there,

can anyone help me out with this problem. I have a win xp pro workstation on our network that has recently been rebuilt. When the user switches it on it is getting the incorrect DNS server and setting the connection specific DNS suffix incorrectly.

I have checked on the network and the DNS server in question is not acting as a DHCP server (my first thought). DHCP server is switched off on the device. The IP address it gets is in the correct range and the default gateway is correct as well. Just the dns server/suffix is incorrect.

When the use runs Ipconfig /renew it sets everything correctly. The user is saying that it reverts back to the incorrect settings several times a day and it is driving him (as well as me) crazy.

I have tried removing all of the protocols and services and adding them again as well as updating the drivers for the network card. The network card is set to automatically assign ip and dns.

Is it possible it could be something in the users network profile?

I was thinking that it could be a dodgy network card. Anyone any ideas?

Any help gratefully appreciated

 

[bracadar]

I had a similar situation where the workstations were randomly picking up another DHCP server somewhere in the network. I just gave those PCs a static IP and that took care of the problem. I never could track where the stray DHCP leases were coming from.

 

[Sympology]

Has some idiot put a wireless gateway on the network and it's dishing out DCHP?

Only the truly stupid believe they know everything.
Stu.. 2004

 

[Fox1977]

Anyone any idea on a quick easy way to see if there are any other DHCP servers on the network?

It only seems to be affected this one machine

Thanks for the advice

 

[bracadar]

I used Tenable Nessus but it didn't find a hidden DHCP server. This is an awesome tool for finding ip addresses and documenting your network.

 

[bracadar]

Try NetworkView, too. It maps the network very well.

 

[Freestone]

http://www.roadkil.net/dhcpfind.html

 

[Fox1977]

Thanks,

Just had a look at that roadkill tool and there isnt any other DHCP servers on the network

 

[GrimR]

Have you check for viruses. I had one doing this.
What DNS is it getting, if it's completely the wrong address, does it end up with static addresses. [then it's a virys/trojan]

 

[ArizonaGeek]

The first thing I'd check is to see if it has a static IP address then check for additional static DNS servers listed under the advanced Network properties. Change network cables (hey stranger things have happened) and run a virus scan.

Maybe run a DNS Flush (ipconfig /flushdns) on the PC and see if that doesn't help it.

Cheers
Rob

The answer is always "PEBKAC!

 

[Fox1977]

i have tried ipconfig /flushdns. The weird thing is it is pulling out the dns suffix and address of a 2wire router on our network. I have double checked the router and the DHCP server is definitely switched off and the wireless access point is switched off.

I will try a full virus scan tomorrow when i am back in the office. Going to pickup a new network card tomorrow morning on the way into work. I will also swap the cable.

i will keep you posted.

Thanks again

 

[Fox1977]

I have just replaced the network card in the machine and all seems fine so far. It has been up and running a few hours and so far so good.

Thanks for all the help

John

 

[mini4YOU]

omg, I am having this same problem... it's driving me nuts..

I'm using DHCP from a sonicwall, but this Cisco router is dishout out it's DNS and connection suffix to all my clients...