Problem with Telnet and FTP

[George Doller]

Just last week we started having a problem with slow response time to get into telnet or ftp from a pc to any 1 of our 3 HP's. We've determined that if we have an entry in the host file on the HP and do a telnet or ftp 192.1.1.xxx the response comes right up. If we don't have an entry in the servers host file, it takes like 90 seconds. This just started happening last Wednesday. Before that things were fine. Everyone in systems and Networks say they didn't change anything. Has anyone experienced anything like this. Thank you

[Dwyane Everts_1]

George,

I have experienced this before, and found that someone changed the DNS. This really sounds like a DNS timing (resolution) issue. That is where I would start.

D

[Jeff Schussele]

Hi George,

By default, telnet & ftp will attempt name resolution on any system accessing it. IF the PCs from which these users are coming is not in DNS, the wait time experienced is the timeout value for DNS - approx 30 seconds per DNS server queried. When the entry is in the hosts files that satisfies the resolution inquiry.

Rgds,
Jeff

[Michael Schulte zur Sur]

Hi,

that looks like a dns resolution problem too me. If you telnet to the machine, what does w report to you, any hostname or just an ip? What is the sequence of hostname resolution?

greetings,

Michael

[Helen French]

It might be a network issue itself. Take a look at your nsswitch.conf and resolv.conf files (under /etc) and see your name resolution lookup. If the host cannot reach your DNS server (when the target system is not identified in /etc/hosts file) for any reason, that will slow the response.

[Uday_S_Ankolekar]

Check /etc/resolv.conf and /etc/nsswitch.conf file.

I guess it's resolv.conf

It should have entries like.

domain yourdomain.com
nameserver x.x.x.x (ipaddress of nameserver1)
nameserver x.x.x.x (ipaddress of nameserver2)

[Ron Kinner]

test your DNS by:

nslookup
set debug
hp.com (or one of your own sites that is slow)

See how well it works when it has a name and has to return an IP address. Then feed it an IP address and see if it can return a name. This last is what telnet has to do so if it has problems then you know hwere to look.

Ron

[Bill Hassell]

Classic DNS problem. Your nameservers either not functional or cannot be reached. ping is not enough to verify a nameserver--you need to run a query for a specific address. To do this, use the syntax:

nslookup 192.1.1.123 nameserver1

If nameserver1 is dead or unreachable, it will take about 30 seconds before it comes back. telnet, ftp, and the remsh/rcp/rlogin commands do a rudimentary security check on each new connection by asking for the IP and the hostname. There must be both entries available from the nameserver. /etc/hosts provides both but many DNS admins do not provide both records. And if the PC is getting a dynamic IP address through DHCP, the DNS server may not have any of the addresses defined. If the DNS administrator can't help, just put all the IP addresses in /etc/hosts and give each IP address a dummy name like pc001, pc002, etc.

[George Doller]

Thank you everyone. We do realize it is a DNS problem, but nothing has changed. It just started happening. The DNS is up (windows server) but can anyone tell me what I can look for on it that may be corrupt or not functioning properly. Thanks again

[Ron Kinner]

When was the last time the Windows DNS was rebooted? Perhaps a memory leak has slowed it down to a crawl?

I assume you can ping your Windows DNS OK. Can it ping all of its upstream servers? Perhaps one or more of them has gone down or the network is having problems?

Ron

[George Doller]

Yes, we have booted it and yes I can ping it.

[Rory R Hammond]

you might do an nslookup on you addresses to see how it is getting resolved.

Since you added the address to your host file it probably resolves to FILE.
So you will have to first comment out your host file entries.
If you haven't changed "anything" I would check the dates on:
resolv.conf,
named.boot,
nsswitch.conf

You might also check your "forwarder" addresses.

nslookup -swdebug host
if you have "dig"
it might help.

Rory

[Tom Danzig]

A classic DNS issue. Check DNS. The fact that the local /etc/hosts entry fixes the issue confirms.

[Brian Lee_4]

after you configure DNS in /etc/resolve.conf correctly,
check if /etc/nsswitch.conf file contains the following line.

hosts: files[NOTFOUND=continue UNAVAIL=return] dns