I (a non-admin) have been asked to fix a network that has slow domain logins and poor performance on several other network related functions.
I discovered the following:
- All workstations are set up to automatically determine the DNS server.
- All workstations are receiving the address of the network's broadband router as the DNS server.
- When pinging the server from a workstation by name (ping FREDSERVER) the workstation receives an outside IP address starting with 208. not the correct internal address starting with 172.
When I place an entry into the hosts file for FREDSERVER all or most of the performance issues disappear.
My question (in several parts) is:
- What happened to cause this address to resolve outside the local network?
- Is this an indication that the network may have been hacked?
- What is the correct DNS setup on this small network (I assume the workstations should be set to use the one-and-only server for DNS, and that server should be pointed to either the router or Comcast's DNS server (Comcast is the ISP)?