Network Systems Engineers Consortium
GhostFile plugin for Labtech is a Host file manager that allows a Tech to add, update or delete host file entries from within LabTech. The client console will allow management of 1, many or all systems under the client from a single interface. The plugin will write a new host file to the systems and send a DNS resolver flush command to the system so entries take effect immediately.
Version 1.0.2 now available for download
DNSWalk is a small windows application that queries all ROOT servers and all returned Top Level Domain (TLD) servers for the FQDN requested. This allows you to see what is being returned to you from all root hint servers and all Top level DNS server.
Download -> DNSWalk-1.0
If you run DNSWalk on a Windows DNS server it will automatically read in the root hints file and use that. If you want to run it on another server you can specify the root hints file to use.
To use it unzip the attachment and at the command line type DNS.exe test=www.google.com substitute www.google.com with the domain you want to test resolution of.
If you want to compare the results from a client to what were seeing, copy there root hints file to your pc and run the command like this
DNS.exe test=www.google.com hints=c:\copiedhintsfile
By default in c:\windows\system32\dns\cache.dns. The tool will output a file called report.html in the same folder it was run from. Attached is an example.
Microsoft DNS has 2 big issues I have seen with DNS
To fix: Either add a Forwarder to your DNS or at your Firewall add NAT rul to send all port 53 traffic to internal DNS server. This will then negate the firewall blocks.
A example of the DNS report DNSWalk reports back:
A.ROOT-SERVERS.NET. – 198.41.0.4
B.ROOT-SERVERS.NET. – 128.9.0.107
C.ROOT-SERVERS.NET. – 192.33.4.12
D.ROOT-SERVERS.NET. – 128.8.10.90
E.ROOT-SERVERS.NET. – 192.203.230.10
F.ROOT-SERVERS.NET. – 192.5.5.241
G.ROOT-SERVERS.NET. – 192.112.36.4
H.ROOT-SERVERS.NET. – 128.63.2.53
I.ROOT-SERVERS.NET. – 192.36.148.17
J.ROOT-SERVERS.NET. – 192.58.128.30
K.ROOT-SERVERS.NET. – 193.0.14.129
L.ROOT-SERVERS.NET. – 198.32.64.12
M.ROOT-SERVERS.NET. – 202.12.27.33
– m.gtld-servers.net
192.55.83.30
com
– l.gtld-servers.net
192.41.162.30
com
– k.gtld-servers.net
192.52.178.30
com
– j.gtld-servers.net
192.48.79.30
com
– i.gtld-servers.net
192.43.172.30
com
– h.gtld-servers.net
192.54.112.30
com
– g.gtld-servers.net
192.42.93.30
com
– f.gtld-servers.net
192.35.51.30
com
– e.gtld-servers.net
192.12.94.30
com
– d.gtld-servers.net
192.31.80.30
com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 128.9.0.107
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
– l.gtld-servers.net
192.41.162.30
com
– g.gtld-servers.net
192.42.93.30
com
– k.gtld-servers.net
192.52.178.30
com
– f.gtld-servers.net
192.35.51.30
com
– j.gtld-servers.net
192.48.79.30
com
– i.gtld-servers.net
192.43.172.30
com
– e.gtld-servers.net
192.12.94.30
com
– d.gtld-servers.net
192.31.80.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– b.gtld-servers.net
192.33.14.30
2001:503:231d::2:30
com
– c.gtld-servers.net
192.26.92.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– h.gtld-servers.net
192.54.112.30
com
– d.gtld-servers.net
192.31.80.30
com
– e.gtld-servers.net
192.12.94.30
com
– j.gtld-servers.net
192.48.79.30
com
– m.gtld-servers.net
192.55.83.30
com
– g.gtld-servers.net
192.42.93.30
com
– k.gtld-servers.net
192.52.178.30
com
– l.gtld-servers.net
192.41.162.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– i.gtld-servers.net
192.43.172.30
com
– k.gtld-servers.net
192.52.178.30
com
– l.gtld-servers.net
192.41.162.30
com
– f.gtld-servers.net
192.35.51.30
com
– d.gtld-servers.net
192.31.80.30
com
– j.gtld-servers.net
192.48.79.30
com
– c.gtld-servers.net
192.26.92.30
com
– e.gtld-servers.net
192.12.94.30
com
– h.gtld-servers.net
192.54.112.30
com
– m.gtld-servers.net
192.55.83.30
com
– i.gtld-servers.net
192.43.172.30
com
– e.gtld-servers.net
192.12.94.30
com
– f.gtld-servers.net
192.35.51.30
com
– d.gtld-servers.net
192.31.80.30
com
– b.gtld-servers.net
192.33.14.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– l.gtld-servers.net
192.41.162.30
com
– g.gtld-servers.net
192.42.93.30
com
– c.gtld-servers.net
192.26.92.30
com
– e.gtld-servers.net
192.12.94.30
com
– g.gtld-servers.net
192.42.93.30
com
– b.gtld-servers.net
192.33.14.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– j.gtld-servers.net
192.48.79.30
com
– h.gtld-servers.net
192.54.112.30
com
– m.gtld-servers.net
192.55.83.30
com
– d.gtld-servers.net
192.31.80.30
com
– c.gtld-servers.net
192.26.92.30
com
– l.gtld-servers.net
192.41.162.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– b.gtld-servers.net
192.33.14.30
com
– c.gtld-servers.net
192.26.92.30
com
– d.gtld-servers.net
192.31.80.30
com
– e.gtld-servers.net
192.12.94.30
com
– f.gtld-servers.net
192.35.51.30
com
– g.gtld-servers.net
192.42.93.30
com
– h.gtld-servers.net
192.54.112.30
com
– i.gtld-servers.net
192.43.172.30
com
– j.gtld-servers.net
192.48.79.30
com
– c.gtld-servers.net
192.26.92.30
com
– f.gtld-servers.net
192.35.51.30
com
– j.gtld-servers.net
192.48.79.30
com
– l.gtld-servers.net
192.41.162.30
com
– e.gtld-servers.net
192.12.94.30
com
– h.gtld-servers.net
192.54.112.30
com
– m.gtld-servers.net
com
– i.gtld-servers.net
192.43.172.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– b.gtld-servers.net
192.33.14.30
2001:503:231d::2:30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– b.gtld-servers.net
192.33.14.30
com
– c.gtld-servers.net
192.26.92.30
com
– d.gtld-servers.net
192.31.80.30
com
– e.gtld-servers.net
192.12.94.30
com
– f.gtld-servers.net
192.35.51.30
com
– g.gtld-servers.net
192.42.93.30
com
– h.gtld-servers.net
192.54.112.30
com
– i.gtld-servers.net
192.43.172.30
com
– j.gtld-servers.net
192.48.79.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– b.gtld-servers.net
192.33.14.30
com
– c.gtld-servers.net
192.26.92.30
com
– d.gtld-servers.net
192.31.80.30
com
– e.gtld-servers.net
192.12.94.30
com
– f.gtld-servers.net
192.35.51.30
com
– g.gtld-servers.net
192.42.93.30
com
– h.gtld-servers.net
192.54.112.30
com
– i.gtld-servers.net
192.43.172.30
com
– j.gtld-servers.net
192.48.79.30
com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 198.32.64.12
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
– l.gtld-servers.net
192.41.162.30
com
– g.gtld-servers.net
192.42.93.30
com
– j.gtld-servers.net
192.48.79.30
com
– a.gtld-servers.net
192.5.6.30
2001:503:a83e::2:30
com
– b.gtld-servers.net
192.33.14.30
com
– c.gtld-servers.net
192.26.92.30
com
– d.gtld-servers.net
192.31.80.30
com
– k.gtld-servers.net
192.52.178.30
com
– m.gtld-servers.net
192.55.83.30
com
– f.gtld-servers.net
192.35.51.30
com
192.55.83.30
192.41.162.30
192.52.178.30
192.48.79.30
192.43.172.30
192.54.112.30
192.42.93.30
192.35.51.30
192.12.94.30
192.31.80.30
192.5.6.30
192.33.14.30
192.26.92.30
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
– ns2.google.com
216.239.34.10
google.com
– ns1.google.com
216.239.32.10
google.com
– ns3.google.com
216.239.36.10
google.com
– ns4.google.com
216.239.38.10
google.com
I wanted to send out a little blurb about the latest attack on Spamhaus this week and to enlighten you on just how something like this is done. Don’t we all love to learn new things!
As a lot of you have been hearing, Spamhaus was attacked this week by the group Anonymous with what is commonly known as a DNS Reflection attack. What is a DNS reflection attack you ask? Let’s me explain. DNS reflection AKA DNS Amplification is a process where an attacker makes requests to open DNS servers on the internet (4.2.2.2) using spoofed IP address as the address the request comes from. This in turn generates a set of packets back to the spoofed address (the victim) with the results of the DNS query. On the top this would look to be fairly harmless, the only thing really being done here is a fake requests that spawn a reply from the public DNS server back to the victim.
The attack come in the form of the “Amplification effect” that these queries have on your network. The “amplification” in DNS amplification attacks is generated by the size of those responses. While a DNS lookup request itself is fairly small, the resulting response of a recursive DNS lookup can be much larger. A relatively small number of attacking systems sending a trickle of forged UDP packets to open DNS servers can result in a firehose of data being blasted at the victim. A DNS query consisting of a 60 byte request can be answered with responses of over 4000 bytes, amplifying the response packet by a factor of 60 so you can quickly see that with a few systems under ones control you could drop a DDOS on any network that would cripple their router and take down their network access.
So now you know, enjoy the knowledge.
Cubert. 😎
You run DCDiag and it returns a failure that names can not be resolved.
testing server: default-first-site-name\mydomain
starting test: connectivity
the host 7397e120-1c8d-4f2d-b8cb-d829d16d949a._msdcs.mydomain.local could not be resolved to an
ip address. check the dns server, dhcp, server name, etc
although the guid dns name
(7397e120-1c8d-4f2d-b8cb-d829d16d949a._msdcs.mydomain.local) couldn't be
resolved, the server name (myhost.mydomain.local) resolved to the ip
address (192.168.1.5) and was pingable. check that the ip address
is registered correctly with the dns server.
......................... myhost failed test connectivity
This is mainly due to bad or non existent DNS records on your AD server. Here are the steps to run through to make sure your Active Directory DNS has the correct records needed to allow Active Directory to function correctly in a Windows 2003 or Windows 2008 environment.
Testing server: Default-First-Site-Name\MYDOMAIN
Starting test: Connectivity
*** Warning: could not confirm the identity of this server in
the directory versus the names returned by DNS servers.
If there are problems accessing this directory server then
you may need to check that this server is correctly registered
with DNS
……………………. MYHOST passed test Connectivity
If DNS resolves a users system and that system is no longer at that IP then you may see a Event ID 10009 in the systems event logs. Check DNS for duplicate entries first… If you have the same computer name in DNS twice with 1 IP being correct and IP not, remove the wrong IP address.
This was a recurring error regarding a particular laptop on our network. This computer had not actually been on the network in months, but the error was showing up every thirty minutes in ten-error bursts.
What I eventually realized was that a laptop was not on the network but a Iphone had taken the IP address that was last associated with the laptop. However, nothing in DHCP showed anything out of order.
Finally I took a look in DNS, and sure enough there was an entry for that laptop associated with the IP address of the Iphone.
Seemingly, DCOM saw something at that IP address and was trying to communicate with it as if it were the laptop. Once I had deleted the laptop from the DNS the error was no longer appearing.
If you are seeing DCOM related to a computer that is NOT currently on the network, this might offer a fix.
I hope this helps someone out there
Cubert
Window’s Netsh.exe command-line scripting utility allows you to display or modify the network configurations of any computer that is currently running a resent flavor of Windows. Netsh.exe also provides a scripting feature that allows you to run a group of commands in batch mode against a computer both locally and remotely. You can also use Netsh.exe to save a configuration script in a text file for archival purposes or to help you configure
Window’s Netsh.exe command-line scripting utility allows you to display or modify the network configurations of any computer that is currently running a resent flavor of Windows. Netsh.exe also provides a scripting feature that allows you to run a group of commands in batch mode against a computer both locally and remotely. You can also use Netsh.exe to save a configuration script in a text file for archival purposes or to help you configure network information when changing networks.
Here are your commands and what they can do.
View your TCP/IP settings.
netsh interface ip show config
Configure your computer’s IP address and other TCP/IP related settings.
This command configures the interface named Local Area Connection with the static IP address 192.168.0.101, the subnet mask of 255.255.255.0, and a default gateway of 192.168.0.1:
netsh interface ip set address name="Local Area Connection" static 192.168.0.101 255.255.255.0 192.168.0.1 1
Configure your NIC to automatically obtain an IP address from a DHCP server
netsh interface ip set address "Local Area Connection" dhcp
To configure DNS and WINS addresses from the Command Prompt
netsh interface ip set dns "Local Area Connection" static 192.168.0.101netsh interface ip set wins "Local Area Connection" static 192.168.0.101
To configure your NIC to dynamically obtain it’s DNS settings
netsh interface ip set dns "Local Area Connection" dhcpNow let’s say you have a laptop and it travels between 2 separate networks and you need to maintain separate static configurations for each network. There is a simple way to flip back and forth between networks by creating a simple batch file. Here is how it’s done.
First we export your current IP settings to a text file:
netsh -c interface dump > c:\network1.txtNext we change the settings manually on the interface to the second network and then export it as well:
netsh -c interface dump > c:\network2.txtNow we have 2 text files, each file represents a network location. Whenever you need to quickly change your IP settings to switch between networks you can run the following commands
netsh -f c:\network1.txtornetsh -f c:\network2.txtNow to make a batch file to execute the command just create a file called network1.bat and network2.bat and add the perspective line to that file. You can also use the global EXEC switch instead of “-f ” switch in the batch file with the same results.
Here are all the options available to netsh.exe
Usage: netsh [-a AliasFile] [-c Context] [-r RemoteMachine] [-u [DomainName\]UserName] [-p Password| *]
Commands available:
? – Displays a list of commands.
add – Adds a configuration entry to a list of entries.
advfirewall – Changes to the `netsh advfirewall’ context.
branchcache – Changes to the `netsh branchcache’ context.
bridge – Changes to the `netsh bridge’ context.
delete – Deletes a configuration entry from a list of entries.
dhcp – Changes to the `netsh dhcp’ context.
dhcpclient – Changes to the `netsh dhcpclient’ context.
dnsclient – Changes to the `netsh dnsclient’ context.
dump – Displays a configuration script.
exec – Runs a script file.
firewall – Changes to the `netsh firewall’ context.
help – Displays a list of commands.
http – Changes to the `netsh http’ context.
interface – Changes to the `netsh interface’ context.
ipsec – Changes to the `netsh ipsec’ context.
lan – Changes to the `netsh lan’ context.
mbn – Changes to the `netsh mbn’ context.
namespace – Changes to the `netsh namespace’ context.
nap – Changes to the `netsh nap’ context.
netio – Changes to the `netsh netio’ context.
p2p – Changes to the `netsh p2p’ context.
ras – Changes to the `netsh ras’ context.
rpc – Changes to the `netsh rpc’ context.
set – Updates configuration settings.
show – Displays information.
trace – Changes to the `netsh trace’ context.
wcn – Changes to the `netsh wcn’ context.
wfp – Changes to the `netsh wfp’ context.
winhttp – Changes to the `netsh winhttp’ context.
winsock – Changes to the `netsh winsock’ context.
wlan – Changes to the `netsh wlan’ context.
Enjoy
Cubert