Windows 8 DNS lookup fails but wireshark shows that the query completes

Question

I'm having a very weird problem. My dad recently purchased a new wireless router. We have at least 8 devices connected wirelessly, and all of them continued working just as they had before, except one. On this particular Windows 8.1 laptop, it's acting like the DNS lookup is failing. Ping says "could not find host", and nslookup says "DNS request timed out". However, when I look at the traffic in wireshark, it looks like the DNS request is completing just fine. If I copy the ip address returned and paste it into chrome, or ping, it works. Here's a screenshot summarizing the problem:

enter image description here

Here's a summary of the facts:

The old router works.
A wired connection to the new router works.
Every other computer connected to the new router still works, ~~including 2 other Windows 8.1 laptops~~ (edited - the two computers I was thinking of actually have Windows 7).
Raw ip addresses in ping or chrome work.
Using wireshark, it looks to me like the DNS request is succeeding.

Does anyone have an idea what's going on?

Edit: Here's the "ipconfig /all" and "route PRINT" output:

Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Walker10
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Local Area Connection* 5:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Hosted Network Virtual Adapter
   Physical Address. . . . . . . . . : 86-A6-C8-5A-59-D4
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
#2
   Physical Address. . . . . . . . . : 84-A6-C8-5A-59-D7
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 12:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : 84-A6-C8-5A-59-D4
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) Centrino(R) Wireless-N 2230
   Physical Address. . . . . . . . . : 84-A6-C8-5A-59-D3
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.1.9(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Saturday, December 13, 2014 1:28:24 PM
   Lease Expires . . . . . . . . . . : Sunday, December 14, 2014 1:28:24 PM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 8.8.8.8
                                       8.8.4.4
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek PCIe FE Family Controller
   Physical Address. . . . . . . . . : 5C-F9-DD-4F-7F-CC
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{EDE41C57-BC07-42C8-B753-FC106F3FD6BC}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #10
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

C:\WINDOWS\system32>route PRINT
===========================================================================
Interface List
 16...86 a6 c8 5a 59 d4 ......Microsoft Hosted Network Virtual Adapter
 14...84 a6 c8 5a 59 d7 ......Bluetooth Device (Personal Area Network) #2
  9...84 a6 c8 5a 59 d4 ......Microsoft Wi-Fi Direct Virtual Adapter
  4...84 a6 c8 5a 59 d3 ......Intel(R) Centrino(R) Wireless-N 2230
  3...5c f9 dd 4f 7f cc ......Realtek PCIe FE Family Controller
  1...........................Software Loopback Interface 1
 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #10
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.9     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link       192.168.1.9    281
      192.168.1.9  255.255.255.255         On-link       192.168.1.9    281
    192.168.1.255  255.255.255.255         On-link       192.168.1.9    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link       192.168.1.9    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link       192.168.1.9    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
  1    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

I can't tell based on the picture, but do you see multiple DNS queries sent, and what happens if you run nslookup twice in succession? — prateek61, Dec 13, 2014 at 13:15
@prateek61 Yes, for each nslookup, I see an ipv4 request, then an ipv6, then ipv4, then ipv6. Each completes successfully. I also see a PTR request at the beginning - not sure what that is. Running nslookup twice is exactly the same - no difference as far as I can see. I've uploaded a screenshot here: i.stack.imgur.com/0p2vw.png — Joel, Dec 13, 2014 at 20:01
@Joel, can it be due to a malware installed in your system ?. In case if possible can you reinstall the machine and check it. — Kannan Mohan, Dec 14, 2014 at 14:56

Joel · Accepted Answer · 2014-12-14 22:34:01Z

1

I finally resolved this issue by changing the DNS server to automatic (previously it was set to use the google DNS servers 8.8.8.8 and 8.8.4.4). The new router is running OpenDNS, and apparently didn't like clients connecting to other DNS servers.

I'm still not sure why the computer wasn't accepting the replies it was obviously receiving from the google DNS. The ubuntu computer I'm posting with right now is using google DNS through the same router and is working just fine.

answered Dec 14, 2014 at 22:34

Joel

1518 bronze badges

Had the same problem. It seems like the issue of Link Local Multicast Name Resolution (LLMNR), so it accepts the first DNS response arrived. In your case response arrives faster from your router and it doesn't have the ip needed.
– nazikus
Aug 20, 2015 at 7:04

Add a comment |

Jonathon Anderson · Accepted Answer · 2014-12-13 04:56:25Z

0

An over simplistic approach is to reboot the computer. It flushes a lot of configurations and caches that Windows is sometimes terrible at managing. If that doesn't work put up a couple screen shots with your ipconfig /all and route -print

Also, it's hard to tell what the system is trying to do with the response because the packets immediately following the response are missing.

answered Dec 13, 2014 at 4:56

Jonathon Anderson

1765 bronze badges

I've restarted the computer multiple times. I'll post the result of those commands in a couple of seconds. You mentioned that some packets were missing - could you elaborate on that?
– Joel
Dec 13, 2014 at 19:31
Just that you filtered to see only dns. It would be useful to say if, for example, a ping Google.com command resolved properly and tried to send a couple pings or not
– Jonathon Anderson
Dec 13, 2014 at 23:59
Actually, the only filter I applied was "ip.src == 192.168.1.9 or ip.dst == 192.168.1.9". There are actually some non-DNS packets further down the list.
– Joel
Dec 14, 2014 at 0:59
Interesting. Check that the 'client' and 'server' service are running in your services, along with anything related top the dns client
– Jonathon Anderson
Dec 14, 2014 at 1:51
There's a "DNS Client" and a "Server" service, both running. That's all I can see related to DNS.
– Joel
Dec 14, 2014 at 3:20

| Show 3 more comments

prateek61 · Accepted Answer · 2014-12-13 13:37:49Z

I ran into a similar issue a couple years ago where DNS on my computers were timing out too quickly and would not function correctly. I found the following TechNet article at the time to configure DNSQueryTimeouts: http://technet.microsoft.com/library/Cc977482

You have to create/modify HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\ParametersDNSQueryTimeouts as a REG_MULTI_SZ. The default values for the key are 1 2 2 4 8 0. The means for the values are somewhat confusing - but make some sense upon reflection.

1st limit    1 second    Query the preferred DNS server on the primary connection.
2nd limit    2 seconds   Query the preferred DNS server on all connections.
3rd limit    2 seconds   Query all DNS servers on all connections (1st attempt).
4th limit    4 seconds   Query all DNS servers on all connections (2nd attempt).
5th limit    8 seconds   Query all DNS servers on all connections (3rd attempt).
6th                      Must be 0 (indicates the end of a string).

However, I did a little digging and I found this post: http://answers.microsoft.com/en-us/windows/forum/windows_8-networking/windows-8-will-not-resolve-dns/034de50d-a8ef-4bff-b627-76182dc07646?page=3&tm=1418477135870

Where the user mentions that s/he had to change this key: HKLM\System\CurrentControlSet\Services\dnscache\Parameters\DNSQueryTimeouts for a Windows 8 box.

But do these limits apply to nslookup? AFAIK it doesn’t use the Windows DNS resolver but does DNS directly. — Daniel B, Dec 13, 2014 at 14:04
You bring up an excellent point. Have you tried a ip and winsock reset? — prateek61, Dec 13, 2014 at 14:06
Thanks for the suggestions. I added those two registry keys, and done an ip and winsock reset, but it's still not working. — Joel, Dec 13, 2014 at 19:32

Stack Exchange Network

Windows 8 DNS lookup fails but wireshark shows that the query completes

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
networking
wireless-networking
router
dns
wireshark
.

Hot Network Questions

Windows 8 DNS lookup fails but wireshark shows that the query completes

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged networkingwireless-networkingrouterdnswireshark.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
networking
wireless-networking
router
dns
wireshark
.