Ill constructed SRV lookups

[Ace Fekay [MVP]]

In

Well, what I meant by AD-leveraging is any third-party or
home-grown app that uses AD-awareness. This is either
happening due to MS software, or something that wants
to locate an ldap server and knows how to go about it.
For example, any code that tries to use an ldap moniker
in an ASs or Adsi binding action, etc..

For example, the following docs a new flag added at SP1
to avoid the problem when a servername is given to an
ldap bind action. However, it is up to the developer to
use the flag, and also if you read closely, to make sure
that they no longer use GetObject, replacing those with
OpenObject.
http://support.microsoft.com/default.aspx?scid=kb;en-us;258507&Product=win2000



The records you just quoted show it (on 10.10.20.86 )
trying to find an Ldap service in its site, and then to find
one for the forestroot domain.
The problem is simply that it (whatever it is) thinks that
the forestroot domain is DC3 instead of the correct value.

The records in your original post showed the same thing
happening, except it exampled it cycling through about
8 or 9 names in place of the DC3.

The records you posted in reply to Ace elsewhere in this
thread show it doing this, following a pattern of normal
DNS suffix appending, hence first
<host>.anydomain.com is tried, then simply <host>

Now, in initial post, the salt-and-peppered about
examples, where it used for the domain such as
(3)dc1(9)adexpedia(3)com(0)
are 1) most bizzard, 2) in this example from the same
machine (10.10.20.86 ) as the DC3 records exampled
in this post, and 3) perhap a very big clue as to what is
originating this (why adexpedia.com - others like this,
or always this?).

When you look at the (non-salt-and-peppered) queries
is there any correspondance between sender's IP and
hostname ??
Ex.
here we have
10.10.20.86 DC3
or in initial post
10.10.20.97 PV3
10.10.21.41 LSSE2
192.168.1.161 P2
10.10.20.59 SQL2
10.10.21.36 LPUB1
10.10.21.30 DEVADMIN
10.10.20.45 NS2
10.10.20.83 SSE1
10.10.20.95 SSE3
We are not that lucky are we, as to have this hostname
of the sender being used in place as its domain ?
Is there any rhyme or reason why the machine indicated
by IP would be trying to ldap bind to the host they try?
From their hostnames I would guess they are not all DCs.

Following up on your stating that you have raked the
KBs over, we then need to be creative in absence of
info from relevant articles. Is there any ability to watch
(sysmon trace) a machine to profile CPU time by process
over a time period during it might be possible to timestamp
correlate with its sending to Tcp to port 53 at your DNS
server IP ? (Probably impossible to do if a given machine
just does the 4 or so malformed queries in a short time and
then does not do it again for a lengthy time).
I am just trying to get at what it is that is doing this.

Great points Roger. Glad to have another set of eyes on this. Maybe, just
maybe, if what you're surmising that something is looking for an LDAP
server, possibly a GC, and the records are incorrect, maybe suggest to
delete the SRVs, the netlogon.dns and dnb's and register everything?

Funny, I would also think, if there is a mis-registration, that it would
also show up as an NTDS or some other AD error in the Event logs, but I
think the poster said there were no other errors?

Also, that extra DNS IP that showed up in one of the ipconfigs (which Kevin
caught), shows there maybe some sort of other misconfig going on.

Do you think a dcdiag /v would catch this?

Curious, relay-denied, can you run that and post the results please?

Also curious, from what Roger is saying, are there any other LDAP or AD
aware apps that you have running (anything at all, maybe even stuff that the
dev guys are experimenting with or have running on the SQL or the other
servers)?

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Roger Abell]

Hi Ace,

I really think there is a rogue app on the loose, using
ldap:// monikers invalidly, perhaps in scripts used
to coordinate the preformance monitoring OP says is
in place, etc. when the scripter should have used other
CreateObject/GetObject forms.

That DNS is not answering what should be unanswerable
seems fine. Thus, I assume the extra IP in one of the config
outputs is just in line with OP stating that machines are all
configured with it's sites DNS service a first listed DNS.
Also, due to this I do not feel there is need to examine zone
file health. What is not there should not be, and if zone were
not in health all machines would show synptoms (one other
than what is topic of thread).

Rather, I am thinking they have app versioned differently on
problem machines than on non-problem machines, or not at
all present on non-problem machines. That new version
either mistakenly substitutes hostname into moniker where
it should subsitiute host's domain, or it simply uses ldap://
where it should use something else to form moniker.

 

[Ace Fekay [MVP]]

In

Hi Ace,

I really think there is a rogue app on the loose, using
ldap:// monikers invalidly, perhaps in scripts used
to coordinate the preformance monitoring OP says is
in place, etc. when the scripter should have used other
CreateObject/GetObject forms.

That DNS is not answering what should be unanswerable
seems fine. Thus, I assume the extra IP in one of the config
outputs is just in line with OP stating that machines are all
configured with it's sites DNS service a first listed DNS.
Also, due to this I do not feel there is need to examine zone
file health. What is not there should not be, and if zone were
not in health all machines would show synptoms (one other
than what is topic of thread).

Rather, I am thinking they have app versioned differently on
problem machines than on non-problem machines, or not at
all present on non-problem machines. That new version
either mistakenly substitutes hostname into moniker where
it should subsitiute host's domain, or it simply uses ldap://
where it should use something else to form moniker.

All good points and I am agreeing with your asessment and reasoning, it only
makes sense that's the case. Let's see if the poster has any additional info
to confirm this.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Roger Abell]

All good points and I am agreeing with your asessment and reasoning, it only
makes sense that's the case. Let's see if the poster has any additional info
to confirm this.

yep - if he has not given up on us !!

 

[Ace Fekay [MVP]]

In

yep - if he has not given up on us !!

I think he'll be back....

(Didn't the governator say that?)


Cheers!

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[relay_denied]

Sorry I have been away for a while, Thank you Roger for pointing that out.

10.10.20.33 is another DNS server on the entwork. I did not include it in
the config for 10.10.20.86 as a second option. I can put it back, but the
problem existed before. 10.10.20.86 I view as our first choice DNS and DC
10.10.20.33 is another as is 10.10.20.47 and 10.20.10.253 in another site.
In fact it looks as though I have configured all the DC DNS boxes as only
themselves for a DNS server leaving the second box blank. Is that box really
more than second choice server to do a lookup? I will fill in the secon box
and in fact make them all consisten with .86 first and .33 second. These
machines are in the same directory and all share a directory integrated DNS.

In Ace Fekay [MVP]

 

[relay_denied]

Dearest Roger

You may be getting somewhere here!

Yes, the machine names and the addresses do equal and the host name being put in place of the domain name is exactly what is happening. I apologize if this has not come accross before, sometimes it is hard to make these things obvious when sending bits and pieces of log files. I have however looked very closely at the domain suffix configs and are pretty confident they are correct, however would be more than happy to reassure any thought you may have and look agian.

We do run some home grown code as I believe I may ahve pointed out in one of the first messages. And looking at these host names I would be pretty sure the, well except for the DC's (DC3 .86, DC1 .33, which are pretty big offenders) that most of these do run some sort of home grown code and largely taking advantage of MSMQ which at times gives long delays.

snip from first message

"We experience odd pauses at times in some network services such as MSMQ,
mail delivery, or others that at least led me to look at the DNS logging for
any information I may find. although I am not convinced yet my problem lies
completely in DNS, there certainly is a peculiarity."

There are most definitely two different types of errors. One where domain name gets replaced by machine name, and then one where machine name is injected into the lookup string. I would love to send you an entire log file if you had any interest in spending some time combing through it. You can clearly see the two types of errors and if you look at a full packet log (big as heck ), but you can see all machine names, all forwarded requests and the full answers. You can watch the prgression from the domain lookup to as you say the forest lookup.

I will go to the Dev team with your comment regarding proper functions in the code and enquire on there need or lack thereof LDAP. I have bounced back and forth between the possibility of misconfig, a microsoft weirdness, or incorrect code. The config just ain't dat hard! It really is only autoupdate, and suffix config on the resolver side. And actually, if you are lucky enough to get the hostname right you really don't even have to configure the suffix boxes. I just wanted to be sure. Am I right??

Want a log file? yes, relay_denied works.

Well, what I meant by AD-leveraging is any third-party or
home-grown app that uses AD-awareness. This is either
happening due to MS software, or something that wants
to locate an ldap server and knows how to go about it.
For example, any code that tries to use an ldap moniker
in an ASs or Adsi binding action, etc..

For example, the following docs a new flag added at SP1
to avoid the problem when a servername is given to an
ldap bind action. However, it is up to the developer to
use the flag, and also if you read closely, to make sure
that they no longer use GetObject, replacing those with
OpenObject.
http://support.microsoft.com/default.aspx?scid=kb;en-us;258507&Product=win2000



The records you just quoted show it (on 10.10.20.86 )
trying to find an Ldap service in its site, and then to find
one for the forestroot domain.
The problem is simply that it (whatever it is) thinks that
the forestroot domain is DC3 instead of the correct value.

The records in your original post showed the same thing
happening, except it exampled it cycling through about
8 or 9 names in place of the DC3.

The records you posted in reply to Ace elsewhere in this
thread show it doing this, following a pattern of normal
DNS suffix appending, hence first
<host>.anydomain.com is tried, then simply <host>

Now, in initial post, the salt-and-peppered about
examples, where it used for the domain such as
(3)dc1(9)adexpedia(3)com(0)
are 1) most bizzard, 2) in this example from the same
machine (10.10.20.86 ) as the DC3 records exampled
in this post, and 3) perhap a very big clue as to what is
originating this (why adexpedia.com - others like this,
or always this?).

When you look at the (non-salt-and-peppered) queries
is there any correspondance between sender's IP and
hostname ??
Ex.
here we have
10.10.20.86 DC3
or in initial post
10.10.20.97 PV3
10.10.21.41 LSSE2
192.168.1.161 P2
10.10.20.59 SQL2
10.10.21.36 LPUB1
10.10.21.30 DEVADMIN
10.10.20.45 NS2
10.10.20.83 SSE1
10.10.20.95 SSE3
We are not that lucky are we, as to have this hostname
of the sender being used in place as its domain ?
Is there any rhyme or reason why the machine indicated
by IP would be trying to ldap bind to the host they try?
From their hostnames I would guess they are not all DCs.

Following up on your stating that you have raked the
KBs over, we then need to be creative in absence of
info from relevant articles. Is there any ability to watch
(sysmon trace) a machine to profile CPU time by process
over a time period during it might be possible to timestamp
correlate with its sending to Tcp to port 53 at your DNS
server IP ? (Probably impossible to do if a given machine
just does the 4 or so malformed queries in a short time and
then does not do it again for a lengthy time).
I am just trying to get at what it is that is doing this.

--
Roger

These requests are coming from multiple machines. There seems to be very
little common ground between them other than W2K, SP4, all latest updates
installed (we try to stay on top of this). The type of ill formation that
gets no domain name at the end do get forwarded to root servers (no fowarder
set). The ill formation that injects the machines name in the center of SRV
lookup stay local but just never get a correct response. I have even seen
the machines change the request, working farther up the folder structure of
the SRV records. Seems like they keep trying for some sort of an answer to
no avail.

Rcv 10.10.20.86 bdba Q [0001 D NOERROR]
(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)DC3(0)
Snd 202.12.27.33 3c64 Q [0000 NOERROR]
(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)DC3(0)
Rcv 10.10.20.86 5abc Q [0001 D NOERROR]
(5)_ldap(4)_tcp(2)dc(6)_msdcs(3)DC3(0)
Snd 202.12.27.33 1c6d Q [0000 NOERROR]
(5)_ldap(4)_tcp(2)dc(6)_msdcs(3)DC3(0)

Nothing really strange in the services list, a couple have some home grown
services but not consistant across all machines. Some certainly get used
more than others. We collect performance statistics every 15 minutes and
query it at the end of the day. Most machines stay below our thresholds:
Processor 50%, Paging 20%, commited RAM in use 50%, etc... . These are
mainly HP DL320 and DL380s.

I am not sure what you mean by AD leveraging application?

Really wish I was listing something really weird here, but we are a pretty
straight forward shop. Have you given you anything you can use? any ideas?
This at times really generates a lot of traffic.

Hi Paul,

It looked as if you have multiple machines sending these requests
that in turn were forwarded.
Can you generalize what is the same in terms of the software load
between these machines ? OS versions ? Services started ?
AD leveraging application installed ?

Roger
I apologize, maybe I should rephrase my response and question. If the
requests are coming from the W2K servers on the local network, and I know
the address of the offender, what would be the next step to figuring out
why
this is happening.

Thank You,

Paul


In my mind, I would first want to track down where these are comming
from.
I would start with NetMon (or other) and filter on DNS packets and try
catch
some of these comming or going on the DNS server. You should then be
able
to determine the IP address (and hence box) where these are comming
from.

--
William Stacey, MVP

First of all thank you for reading and especially for any assistance.

We experience odd pauses at times in some network services such as
MSMQ,
mail delivery, or others that at least led me to look at the DNS
logging
for
any information I may find. although I am not convinced yet my problem
lies
completely in DNS, there certainly is a peculiarity.

I first starting seeing misconfigured SRV lookups scattered about, but
I
now
have seen little storms of these like as many as 150 or so right

in

a
row.
It is not only a nuisance to us but these get forwarded to root
servers
since the lookup ends in a machine name instead of a known domain
name.

I have looked quite exhaustively for an explanation or even an
explanation
of what I am looking at when I have complete logging on. There seems
to
be
very little describing the logs and nothing on these misconfigured
lookups.

I have included just a few examples, it is just a few from the top of
one
of
the storms. There are two types of error.

Machine name at end instead of domain name, these come in storms

Rcv 10.10.20.97 26e4 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)PV3(0)
Snd 202.12.27.33 188d Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)PV3(0)
Rcv 10.10.21.41 4e2e Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(5)LSSE2(0)

Snd 202.12.27.33 2094 Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(5)LSSE2(0)

Rcv 192.168.1.161 93a6 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(2)P2(0)
Snd 202.12.27.33 289a Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(2)P2(0)
Rcv 10.10.20.59 93fa Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SQL2(0)

Snd 202.12.27.33 18a0 Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SQL2(0)

Rcv 10.10.21.36 e1e0 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(5)LPUB1(0)

Snd 202.12.27.33 28ac Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(5)LPUB1(0)

Rcv 10.10.21.30 476f Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(8)DEVADMIN

(0)
Snd 202.12.27.33 38b6 Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(8)DEVADMIN

(0)
Rcv 10.10.20.45 b01a Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)NS2(0)
Snd 202.12.27.33 38bd Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)NS2(0)
Rcv 10.10.20.83 0b53 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SSE1(0)

Snd 202.12.27.33 28c0 Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SSE1(0)

Rcv 10.10.20.95 1ba1 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SSE3(0)

Machine name injected into path, dc1(9) these are scattered about:

Rcv 10.10.20.86 ca9b Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)dc1(9)ad

expedia(3)com(0)
Snd 10.10.20.86 ca9b R Q [8385 A DR NXDOMAIN]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)dc1(9)ad

expedia(3)com(0)
Rcv 10.10.20.86 209d Q [0001 D NOERROR]
(5)_ldap(4)_tcp(2)dc(6)_msdcs(3)dc1(9)adexpedia(3)com(0)
Snd 10.10.20.86 209d R Q [8385 A DR NXDOMAIN]
(5)_ldap(4)_tcp(2)dc(6)_msdcs(3)dc1(9)adexpedia(3)com(0)

Any assistance with an explanation and possibly a fix would be greatly
appreciated. If there is a good source for troubleshooting W2K DNS or
reading the logs I would welcome the reading.

 

[relay_denied]

In the words of Eddy Van Halen, "One break comin up' Here You Go"

DC Diagnosis

Performing initial setup:
* Verifing that the local machine dc3, is a DC.
* Connecting to directory service on server dc3.
* Collecting site info.
* Identifying all servers.
* Found 4 DC(s). Testing 1 of them.
Done gathering initial info.

Doing initial non skippeable tests

Testing server: Default-First-Site-Name\DC3
Starting test: Connectivity
* Active Directory LDAP Services Check
* Active Directory RPC Services Check
......................... DC3 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\DC3
Starting test: Replications
* Replications Check
......................... DC3 passed test Replications
Test omitted by user request: Topology
Test omitted by user request: CutoffServers
Starting test: NCSecDesc
* Security Permissions Check for
CN=Schema,CN=Configuration,DC=anydomain,DC=com
* Security Permissions Check for
CN=Configuration,DC=anydomain,DC=com
* Security Permissions Check for
DC=anydomain,DC=com
......................... DC3 passed test NCSecDesc
Starting test: NetLogons
* Network Logons Privileges Check
......................... DC3 passed test NetLogons
Starting test: Advertising
The DC DC3 is advertising itself as a DC and having a DS.
The DC DC3 is advertising as an LDAP server
The DC DC3 is advertising as having a writeable directory
The DC DC3 is advertising as a Key Distribution Center
The DC DC3 is advertising as a time server
The DS DC3 is advertising as a GC.
......................... DC3 passed test Advertising
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS
Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurat
ion,DC=anydomain,DC=com
Role Domain Owner = CN=NTDS
Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurat
ion,DC=anydomain,DC=com
Role PDC Owner = CN=NTDS
Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurat
ion,DC=anydomain,DC=com
Role Rid Owner = CN=NTDS
Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurat
ion,DC=anydomain,DC=com
Role Infrastructure Update Owner = CN=NTDS
Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurat
ion,DC=anydomain,DC=com
......................... DC3 passed test KnowsOfRoleHolders
Starting test: RidManager
* Available RID Pool for the Domain is 18130 to 1073741823
* DC1.anydomain.com is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 17630 to 18129
* rIDNextRID: 17660
* rIDPreviousAllocationPool is 17630 to 18129
......................... DC3 passed test RidManager
Starting test: MachineAccount
* SPN found :LDAP/dc3.anydomain.com/anydomain.com
* SPN found :LDAP/dc3.anydomain.com
* SPN found :LDAP/DC3
* SPN found :LDAP/dc3.anydomain.com/ADXP
* SPN found
:LDAP/97dbcce1-2795-41df-ae7a-227be33543ca._msdcs.anydomain.com
* SPN found
:E3514235-4B06-11D1-AB04-00C04FC2DCD2/97dbcce1-2795-41df-ae7a-227be33543ca/a
nydomain.com
* SPN found :HOST/dc3.anydomain.com/anydomain.com
* SPN found :HOST/dc3.anydomain.com
* SPN found :HOST/DC3
* SPN found :HOST/dc3.anydomain.com/ADXP
* SPN found :GC/dc3.anydomain.com/anydomain.com
......................... DC3 passed test MachineAccount
Starting test: Services
* Checking Service: Dnscache
* Checking Service: NtFrs
* Checking Service: IsmServ
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: RpcSs
* Checking Service: RPCLOCATOR
* Checking Service: w32time
* Checking Service: TrkWks
* Checking Service: TrkSvr
* Checking Service: NETLOGON
......................... DC3 passed test Services
Test omitted by user request: OutboundSecureChannels
Starting test: ObjectsReplicated
DC3 is in domain DC=anydomain,DC=com
Checking for CN=DC3,OU=Domain Controllers,DC=anydomain,DC=com in
domain DC=anydomain,DC=com on 1 servers
Object is up-to-date on all servers.
Checking for CN=NTDS
Settings,CN=DC3,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurat
ion,DC=anydomain,DC=com in domain CN=Configuration,DC=anydomain,DC=com on 1
servers
Object is up-to-date on all servers.
......................... DC3 passed test ObjectsReplicated
Starting test: frssysvol
* The File Replication Service Event log test
The SYSVOL has been shared, and the AD is no longer
prevented from starting by the File Replication Service.
......................... DC3 passed test frssysvol
Starting test: kccevent
* The KCC Event log test
Found no KCC errors in Directory Service Event log in the last 15
minutes.
......................... DC3 passed test kccevent
Starting test: systemlog
* The System Event log test
An Error Event occured. EventID: 0x00000457
Time Generated: 01/27/2004 23:08:08
Event String: Driver HP LaserJet 4100 PS required for printer

__admin2_HP LaserJet 4100 PS is unknown. Contact

the administrator to install the driver before

you log in again.
An Error Event occured. EventID: 0x00000452
Time Generated: 01/27/2004 23:08:08
Event String: The printer could not be installed.
An Error Event occured. EventID: 0x00000457
Time Generated: 01/27/2004 23:08:09
Event String: Driver HP Color LaserJet 4500 PCL 6 required for

printer __admin2_HP Color LaserJet 4500 PCL 6 is

unknown. Contact the administrator to install the

driver before you log in again.
An Error Event occured. EventID: 0x00000452
Time Generated: 01/27/2004 23:08:09
Event String: The printer could not be installed.
An Error Event occured. EventID: 0x00000457
Time Generated: 01/27/2004 23:08:09
Event String: Driver Canon iR600-550-60 PCL required for

printer __admin2_600-605 is unknown. Contact the

administrator to install the driver before you

log in again.
An Error Event occured. EventID: 0x00000452
Time Generated: 01/27/2004 23:08:09
Event String: The printer could not be installed.
......................... DC3 failed test systemlog

Running enterprise tests on : anydomain.com
Starting test: Intersite
Skipping site 2bdel, this site is outside the scope provided by the

command line arguments provided.
Skipping site Default-First-Site-Name, this site is outside the
scope

provided by the command line arguments provided.
Skipping site AirPark, this site is outside the scope provided by
the

command line arguments provided.
......................... anydomain.com passed test Intersite
Starting test: FsmoCheck
GC Name: \\dc3.anydomain.com
Locator Flags: 0xe00001fc
PDC Name: \\DC1.anydomain.com
Locator Flags: 0xe00001fd
Time Server Name: \\dc3.anydomain.com
Locator Flags: 0xe00001fc
Preferred Time Server Name: \\dc3.anydomain.com
Locator Flags: 0xe00001fc
KDC Name: \\dc3.anydomain.com
Locator Flags: 0xe00001fc
......................... anydomain.com passed test FsmoCheck





"Ace Fekay [MVP]"

 

[relay_denied]

NEVER, you haven't given up on me ))

yep - if he has not given up on us !!

 

[Roger Abell]

I do not think at this point pawing through the extended log tracing
will be as productive as waiting out word from your dev group. This
is especially so now that you have confirmed the clients seem to be
attempting to resolve from and ldap:// bind against their own hostname.

What the tracing parts you have posted show is an attempt with the
explicitly set domain appended followed by one with the bare hostname.
This is exactly the behavior your config on those resolving boxes should
be showing.

If I were you I would be really pressing the devs to verify their code, and
in the meantime I would be checking my service levels for MSMQ and COM+
in case this is something in the MS code that has had a rev'ing released.

Roger

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
Dearest Roger

You may be getting somewhere here!

Yes, the machine names and the addresses do equal and the host name being
put in place of the domain name is exactly what is happening. I apologize if
this has not come accross before, sometimes it is hard to make these things
obvious when sending bits and pieces of log files. I have however looked
very closely at the domain suffix configs and are pretty confident they are
correct, however would be more than happy to reassure any thought you may
have and look agian.

We do run some home grown code as I believe I may ahve pointed out in one of
the first messages. And looking at these host names I would be pretty sure
the, well except for the DC's (DC3 .86, DC1 .33, which are pretty big
offenders) that most of these do run some sort of home grown code and
largely taking advantage of MSMQ which at times gives long delays.

snip from first message

"We experience odd pauses at times in some network
services such as MSMQ,
mail delivery, or others that at least led me to look at
the DNS logging for
any information I may find. although I am not convinced
yet my problem lies
completely in DNS, there certainly is a peculiarity."

There are most definitely two different types of errors. One where domain
name gets replaced by machine name, and then one where machine name is
injected into the lookup string. I would love to send you an entire log file
if you had any interest in spending some time combing through it. You can
clearly see the two types of errors and if you look at a full packet log
(big as heck ), but you can see all machine names, all forwarded requests
and the full answers. You can watch the prgression from the domain lookup to
as you say the forest lookup.

I will go to the Dev team with your comment regarding proper functions in
the code and enquire on there need or lack thereof LDAP. I have bounced back
and forth between the possibility of misconfig, a microsoft weirdness, or
incorrect code. The config just ain't dat hard! It really is only
autoupdate, and suffix config on the resolver side. And actually, if you are
lucky enough to get the hostname right you really don't even have to
configure the suffix boxes. I just wanted to be sure. Am I right??

Want a log file? yes, relay_denied works.

Well, what I meant by AD-leveraging is any third-party or
home-grown app that uses AD-awareness. This is either
happening due to MS software, or something that wants
to locate an ldap server and knows how to go about it.
For example, any code that tries to use an ldap moniker
in an ASs or Adsi binding action, etc..

For example, the following docs a new flag added at SP1
to avoid the problem when a servername is given to an
ldap bind action. However, it is up to the developer to
use the flag, and also if you read closely, to make sure
that they no longer use GetObject, replacing those with
OpenObject.
http://support.microsoft.com/default.aspx?scid=kb;en-us;258507&Product=win2000



The records you just quoted show it (on 10.10.20.86 )
trying to find an Ldap service in its site, and then to find
one for the forestroot domain.
The problem is simply that it (whatever it is) thinks that
the forestroot domain is DC3 instead of the correct value.

The records in your original post showed the same thing
happening, except it exampled it cycling through about
8 or 9 names in place of the DC3.

The records you posted in reply to Ace elsewhere in this
thread show it doing this, following a pattern of normal
DNS suffix appending, hence first
<host>.anydomain.com is tried, then simply <host>

Now, in initial post, the salt-and-peppered about
examples, where it used for the domain such as
(3)dc1(9)adexpedia(3)com(0)
are 1) most bizzard, 2) in this example from the same
machine (10.10.20.86 ) as the DC3 records exampled
in this post, and 3) perhap a very big clue as to what is
originating this (why adexpedia.com - others like this,
or always this?).

When you look at the (non-salt-and-peppered) queries
is there any correspondance between sender's IP and
hostname ??
Ex.
here we have
10.10.20.86 DC3
or in initial post
10.10.20.97 PV3
10.10.21.41 LSSE2
192.168.1.161 P2
10.10.20.59 SQL2
10.10.21.36 LPUB1
10.10.21.30 DEVADMIN
10.10.20.45 NS2
10.10.20.83 SSE1
10.10.20.95 SSE3
We are not that lucky are we, as to have this hostname
of the sender being used in place as its domain ?
Is there any rhyme or reason why the machine indicated
by IP would be trying to ldap bind to the host they try?
From their hostnames I would guess they are not all DCs.

Following up on your stating that you have raked the
KBs over, we then need to be creative in absence of
info from relevant articles. Is there any ability to watch
(sysmon trace) a machine to profile CPU time by process
over a time period during it might be possible to timestamp
correlate with its sending to Tcp to port 53 at your DNS
server IP ? (Probably impossible to do if a given machine
just does the 4 or so malformed queries in a short time and
then does not do it again for a lengthy time).
I am just trying to get at what it is that is doing this.

--
Roger

These requests are coming from multiple machines. There seems to be very
little common ground between them other than W2K, SP4, all latest updates
installed (we try to stay on top of this). The type of ill formation that
gets no domain name at the end do get forwarded to root servers (no fowarder
set). The ill formation that injects the machines name in the center of SRV
lookup stay local but just never get a correct response. I have even seen
the machines change the request, working farther up the folder structure of
the SRV records. Seems like they keep trying for some sort of an answer to
no avail.

Rcv 10.10.20.86 bdba Q [0001 D NOERROR]
(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)DC3(0)
Snd 202.12.27.33 3c64 Q [0000 NOERROR]
(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)DC3(0)
Rcv 10.10.20.86 5abc Q [0001 D NOERROR]
(5)_ldap(4)_tcp(2)dc(6)_msdcs(3)DC3(0)
Snd 202.12.27.33 1c6d Q [0000 NOERROR]
(5)_ldap(4)_tcp(2)dc(6)_msdcs(3)DC3(0)

Nothing really strange in the services list, a couple have some home grown
services but not consistant across all machines. Some certainly get used
more than others. We collect performance statistics every 15 minutes and
query it at the end of the day. Most machines stay below our thresholds:
Processor 50%, Paging 20%, commited RAM in use 50%, etc... . These are
mainly HP DL320 and DL380s.

I am not sure what you mean by AD leveraging application?

Really wish I was listing something really weird here, but we are a pretty
straight forward shop. Have you given you anything you can use? any ideas?
This at times really generates a lot of traffic.

Hi Paul,

It looked as if you have multiple machines sending these requests
that in turn were forwarded.
Can you generalize what is the same in terms of the software load
between these machines ? OS versions ? Services started ?
AD leveraging application installed ?

Roger
I apologize, maybe I should rephrase my response and question. If the
requests are coming from the W2K servers on the local network, and I know
the address of the offender, what would be the next step to figuring out
why
this is happening.

Thank You,

Paul


In my mind, I would first want to track down where these are comming
from.
I would start with NetMon (or other) and filter on DNS packets and try
catch
some of these comming or going on the DNS server. You should then be
able
to determine the IP address (and hence box) where these are comming
from.

--
William Stacey, MVP

First of all thank you for reading and especially for any assistance.

We experience odd pauses at times in some network services such as
MSMQ,
mail delivery, or others that at least led me to look at the DNS
logging
for
any information I may find. although I am not convinced yet my problem
lies
completely in DNS, there certainly is a peculiarity.

I first starting seeing misconfigured SRV lookups scattered

about,
but

I
now
have seen little storms of these like as many as 150 or so right

in

a
row.
It is not only a nuisance to us but these get forwarded to root
servers
since the lookup ends in a machine name instead of a known domain
name.

I have looked quite exhaustively for an explanation or even an
explanation
of what I am looking at when I have complete logging on. There seems
to
be
very little describing the logs and nothing on these misconfigured
lookups.

I have included just a few examples, it is just a few from the

top
of

one
of
the storms. There are two types of error.

Machine name at end instead of domain name, these come in storms

Rcv 10.10.20.97 26e4 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)PV3(0)

Snd 202.12.27.33 188d Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)PV3(0)

Rcv 10.10.21.41 4e2e Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(5)LSSE2(0)

Snd 202.12.27.33 2094 Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(5)LSSE2(0)

Rcv 192.168.1.161 93a6 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(2)P2(0)

Snd 202.12.27.33 289a Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(2)P2(0)

Rcv 10.10.20.59 93fa Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SQL2(0)

Snd 202.12.27.33 18a0 Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SQL2(0)

Rcv 10.10.21.36 e1e0 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(5)LPUB1(0)

Snd 202.12.27.33 28ac Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(5)LPUB1(0)

Rcv 10.10.21.30 476f Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(8)DEVADMIN

(0)
Snd 202.12.27.33 38b6 Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(8)DEVADMIN

(0)
Rcv 10.10.20.45 b01a Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)NS2(0)

Snd 202.12.27.33 38bd Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)NS2(0)

Rcv 10.10.20.83 0b53 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SSE1(0)

Snd 202.12.27.33 28c0 Q [0000 NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SSE1(0)

Rcv 10.10.20.95 1ba1 Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(4)SSE3(0)

Machine name injected into path, dc1(9) these are scattered about:

Rcv 10.10.20.86 ca9b Q [0001 D NOERROR]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)dc1(9)ad

expedia(3)com(0)
Snd 10.10.20.86 ca9b R Q [8385 A DR NXDOMAIN]

(5)_ldap(4)_tcp(23)Default-First-Site-Name(6)_sites(2)dc(6)_msdcs(3)dc1(9)ad

expedia(3)com(0)
Rcv 10.10.20.86 209d Q [0001 D NOERROR]
(5)_ldap(4)_tcp(2)dc(6)_msdcs(3)dc1(9)adexpedia(3)com(0)
Snd 10.10.20.86 209d R Q [8385 A DR NXDOMAIN]
(5)_ldap(4)_tcp(2)dc(6)_msdcs(3)dc1(9)adexpedia(3)com(0)

Any assistance with an explanation and possibly a fix would be greatly
appreciated. If there is a good source for troubleshooting W2K

DNS
or

reading the logs I would welcome the reading.

 

[Kevin D. Goodknecht [MVP]]

In relay_denied <[email protected]> posted a question
Then Kevin replied below:
: Sorry I have been away for a while, Thank you Roger for pointing that
: out.
:
: 10.10.20.33 is another DNS server on the entwork. I did not include
: it in the config for 10.10.20.86 as a second option. I can put it
: back, but the problem existed before. 10.10.20.86 I view as our first
: choice DNS and DC
: 10.10.20.33 is another as is 10.10.20.47 and 10.20.10.253 in another
: site. In fact it looks as though I have configured all the DC DNS
: boxes as only themselves for a DNS server leaving the second box
: blank. Is that box really more than second choice server to do a
: lookup? I will fill in the secon box and in fact make them all
: consisten with .86 first and .33 second. These machines are in the
: same directory and all share a directory integrated DNS.
:
:
Another DNS server on your network?
Does that DNS server have a zone in it for your AD Domain?
Does it have the same zones?

If it doesn't you'll have to remove it or replicate the zones to it.

 

[relay_denied]

4 DNS servers all DC's all AD Integrated.