nslookup defaults to 127.0.0.1

[McEve]

I have a win2000 server, one of 2 DC's.

The KBarticle Q172060 describes my problem, but we do have a DNS server configured for the computer....

ping localhost returns 127.0.0.1 - fine..
ping <hostname> returns 127.0.0.1 - not so fine

nslookup:

*** Default servers are not available
Default Server: UnKnown
Address: 127.0.0.1

____________

nslookup <hostname>
*** Default servers are not available
Server: UnKnown
Address: 127.0.0.1

Name: <hostname>.qdomain.questus.no
Address: 192.168.0.45

____________

nslookup <hostname> <dns server>
Server: <dns server>.qdomain.questus.no
Address: 192.168.0.50

Name: <hostname>.qdomain.questus.no
Address: 192.168.0.45

____________

Netdiag

Failed to get information for a network adapter. The error occurred was: The pipe is being closed.
(232)[FATAL] Cannot find TCP/IP configuration from the registry.

_____________

It seems to me that the computer defaults to using 127.0.0.1 for nameresolution.... why..?


ping

http://www.whitehouse.org

Unknown host

http://www.whitehouse.org.

But it still resolves other hosts on the local network:


ping <hostname1>

Pinging <hostname1> [192.168.0.13] with 32 bytes of data:

Reply from 192.168.0.13: bytes=32 time<10ms TTL=128
Reply from 192.168.0.13: bytes=32 time<10ms TTL=128
Reply from 192.168.0.13: bytes=32 time<10ms TTL=128
Reply from 192.168.0.13: bytes=32 time<10ms TTL=128

Ping statistics for 192.168.0.13:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

This host is on the LAN as you can see.

Anybody know what's going on with this DC?

McEve

 

[ashpp]

Hi,

If you type IPCONFIG /ALL do you get the correct IP/DNS settings??

Ash.

 

[McEve]

I should have included this info as well, I'm sorry.

Here it is:

ipconfig /all

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : <hostname>
Primary DNS Suffix . . . . . . . : domain.questus.no
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : qdomain.questus.no
Description . . . . . . . . . . . : 3Com EtherLink XL 10/100 PCI TX NIC
(3C905B-TX)
Physical Address. . . . . . . . . : 00*********
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.45
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.254
DNS Servers . . . . . . . . . . . : 192.168.0.50

 

[ashpp]

This is one weird problem. No solutions more questions tho!

1. What Service Pack are you on? Did the problems occur at any particular point ie. after installing a sp?
2. What does a DCDIAG show?
3. Has the C:\winnt\system32\drivers\etc\hosts file been changed at all?
4. Have you tried reinstalling TCP/IP (or at least changing the IP address and re-testing).

It looks that somewhere in that machine the netcard IP address is being overriden by the loopback address... IPCONFIG is showing the correct details tho...

Ash.

 

[McEve]

one weird problem for sure

1: Servicepack3. The problem started after a reboot. (Forgot about last good known config ) no programs installed

2:

dcdiag

DC Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial non skippeable tests

Testing server: Default-First-Site\<hostname>
Starting test: Connectivity
An error cocured during DNS host lookup
Although the Guid DNS name
(0c056017-4d6e-4cfd-83b7-6ba7e6e9e3ed._msdcs.qdomain.questus.no)
couldn't be resolved, the server name (<hostname>.qdomain.questus.no)
resolved to the IP address (127.0.0.1) and was pingable. Check that
the IP address is registered correctly with the DNS server.
......................... <hostname> failed test Connectivity

Doing primary tests

Testing server: Default-First-Site\<hostname>
Skipping all tests, because server <hostname> is
not responding to directory service requests

Running enterprise tests on : qdomain.questus.no
Starting test: Intersite
......................... qdomain.questus.no passed test Intersite
Starting test: FsmoCheck
......................... qdomain.questus.no passed test FsmoCheck

We searched for the GUID DNS name 0c056017-4d6e-4cfd-83b7-6ba7e6e9e3ed in the registry, but it's not there. Does that mean something...?

3: No

4. Yes, as described in Q299451.

If we find out what's happened to this machine, I think we deserve a pat on the back...

McEve

 

[McEve]

Forgot to mention. I have Event ID 5782 Source Netlogon in the event log:

Dynamic registration or deregistration of one or more DNS records failed with the following error:
No DNS servers configured for local system.

 

[GlenJohnson]

Get rid of SP3, that's probably giving you part of the problem. (Please tell me you chose the option to un-install.) SP3 is NOT stable enough yet. I tried it on my pro machine and went through fits. Someone told me you have to un-install all hotfixes first, and that's what caused my problem. That was the first time I heard about that. Good luck. Glen A. Johnson
Microsoft Certified Professional
glen@nellsgiftbox.com


&quot;Great souls have wills; feeble ones have only wishes.&quot;
Chinese Proverb.

 

[ashpp]

I'll have to agree with Glen.

Your setup looks fine - I just can't understand how NETDIAG gives you that horrible error but IPCONFIG looks fine.

You've cleanly reinstalled TCP/IP so the only thing can think of is the SP3. I would be tempted to either uninstall or go to Microsoft support on this one.

As for SP3 being unstable I have no idea. I haven't installed it anywhere yet. I usually wait 3-6 months before implementing them. That way everyone else does the testing for me

Ash.

 

[GlenJohnson]

People at work look to me for awnsers, so I'm always playing the devels advocate and testing stuff on my machine first. Learned to be carefull, had to f-disk 3 times.
1)Something hosed my registry, couldn't figure it out. I would be working, machine would re-boot. Kept getting worse. This is in my early days, didn't know about the option to &quot;Automatically re-boot&quot; Got so bad, machine would come up, then re-boot. Last known didn't work, f-disk.
2)Boss tells me &quot;Check out this new fingerprint scanner.&quot; Worked great for about a week, then forgot who I was. f-disk.
3)Don't remember.
I have a scheduled backup of my system state daily to the network. Get rid of sp3 and good luck. Glen A. Johnson
Microsoft Certified Professional
glen@nellsgiftbox.com


&quot;Great souls have wills; feeble ones have only wishes.&quot;
Chinese Proverb.

 

[McEve]

hmmm... here's a ipconfig /all from a healthy computer:

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : <hostname>
Primary DNS Suffix . . . . . . . : qdomain.questus.no
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : qdomain.questus.no
questus.no

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/100+ Management Adapter

Physical Address. . . . . . . . . : 00-*****
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.50
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.254
DNS Servers . . . . . . . . . . . : 192.168.0.50
192.168.0.45

And the one from our not so healthy friend:


Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : <hostname>
Primary DNS Suffix . . . . . . . : qdomain.questus.no
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : qdomain.questus.no
Description . . . . . . . . . . . : 3Com EtherLink XL 10/100 PCI TX NIC
(3C905B-TX) #2
Physical Address. . . . . . . . . : 00-**********
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.45
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.254
DNS Servers . . . . . . . . . . . : 192.168.0.50
192.168.0.45

The difference here is healthy has got a DNS Suffix Search List, while sick has Connection-specific DNS Suffix.

On to something here?

 

[Seizure]

Either DNS service communication problems or general IP communication problems. Make sure the driver for the NIC is absoultely correct, the SP may have damaged it. Update it with a known good driver set.
What is providing DNS at 192.168.9.50?? Is it a standard primary, secondary, or integrated AD? Is the sick server also a name server. Look at the name for the domain in the local DNS console and make sure it matches the AD domain that the server belongs to. In the first IP/CONFIG sample for the sick server, the primary domain suffix name does not match the connection specific. Is this a typo? - Probably.
The local machines are being resolved by netbios broadcasts.
The sick machine cannot communicate with the DNS server at x.x.x.50 which is necessary for registering its name record, and is vital for service location.
If this server is a DNS server(other than cache only), then point it to itself for DNS resolution and see if the problem changes. Look at the bindings for IP.
If the sick machine has 2 nics (1 disabled) make sure the lan cable is plugged to the correct one. This sounds stupid - but you wouldn't believe what I went through a couple of months ago. Server actually was sending packets through the card that wasn't configured with the ip stack from the configured card!?! Good luck!
Jim - Synnex Info Tech

 

[McEve]

The drivers for the NIC is updated (didn't think about that one ) but no change. We moved the NIC to a different slot to force a new connection, but no change.

There's only one NIC on the server, and yes, the domain suffux was a typo, it says qdomain in ipconfig.

Onlu Tcp/Ip is installed and there's only one nic, so there's nothing much to do about the bindings?

.50 is an integrated AD DNS server, with forwarders configured. This DNS server seem to work as it should, I rather tend to think that somehow the loopback interface has taken precedence over the NIC interface..??


Look:

ipconfig /displaydns

Windows 2000 IP Configuration

localhost.
------------------------------------------------------
Record Name . . . . . : localhost
Record Type . . . . . : 1
Time To Live . . . . : 31491367
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . :
127.0.0.1


1.0.0.127.in-addr.arpa.
------------------------------------------------------
Record Name . . . . . : 1.0.0.127.in-addr.arpa
Record Type . . . . . : 12
Time To Live . . . . : 31491367
Data Length . . . . . : 4
Section . . . . . . . : Answer
PTR Record . . . . . :
localhost

 

[McEve]

ok - did a repair install and back in business. Still like to know what happened though..

Terminal services are unhappy, and we have a mix of IE5 and IE6 - but that's no big fuzz compared to what we had...

Thanks for taking the time to help out on this one!

 

[Seizure]

Why did it happen? I assume the SP3 install did not complete properly. I suspect that the SP3 install failed to overwrite some files - causing a mixed set of SP2 and SP3 system files. If you don't have a complete set of either, things go bad. Thanks for helping with the SP3 debug project. ...just kidding.
Have a nice day! Jim - Synnex Info Tech

 

[McEve]

I'm not so sure that was the case here. We installed SP3 immediately when it was released, and the server has worked perfectly since.

We did have one server where we had to uninstall SP3, this server had SQL server installed, and SQL didn't like SP3 one bit....

Part from that, we have installed SP3 on 20+ servers - and had no problem with it.