Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

recently out corporate network had some speed problems. My guess is a DNS Problem, so I wrote a batch script which calls nslookup 1000 times on a client. About every 100th call fails with a timeout.

What are the possible reasons for this behavior?

I ran Wireshark on the Windows 2003 SB Server. I located the failing DNS call but I'm not able to interpret that. The failing DNS request has 4 Packets, the successfull has 6 Packets. Is there anything I could look for?

Here are the relevant packets in wireshark. Screenshot wireshark Packets 2709 to 2712 belong to a failed request (timeout). Packets 2768 to 2773 belong to a successfull request. I used ping to distinguish between subsequent requests.

Regards Michael

share|improve this question
Please note that this question is related to an old question of me, which was closed because it is too local. – Michael Stoll May 5 '11 at 11:59
what makes you think the speed problem is related to DNS? If you just do one nslookup to your DNS server, what is the response time? – HostBits May 5 '11 at 12:33
I checked the DNS because DanBig answered this to my first question, which is linked in the first comment. How can I get the DNS response time? – Michael Stoll May 5 '11 at 13:19
Yes, I read that. However, IS there slow response time from your DNS server? Generally speaking unless your DNS load is extremely high or you are having other network issues, DNS should not be the root cause. – HostBits May 5 '11 at 14:06
Well, I don't how to measure the response time of the DNS server, but when I enter the nslookup command the answert does appear immediately. See the comment on RedGrittyBrick's answer. That might support your thesis. – Michael Stoll May 5 '11 at 15:01
up vote 1 down vote accepted

Is there anything I could look for?

  • Severe packet loss due to network congestion.
  • Excess load on the DNS server (does it perform other tasks too?)

On my LAN, a typical nslookup produces a DNS request in a single UDP packet of length 46. If you are seeing four or six packets per request, perhaps you can post some wireshark output?

Wireshark DNS query packet

share|improve this answer
The CPU load of the server is at about 5%, Network load is below 1% so this shouldn't be an issuse. RAM is about 100%, so this might slow down some tasks, but that hasn't been an issue yet. – Michael Stoll May 5 '11 at 14:18
How can I check if there are packets lost? Ping is working fine (less than 1% loss rate), even parallel to the DNS test. – Michael Stoll May 5 '11 at 14:20
I use ping to check for packet loss. try using larger packet sizes and larger counts e.g. ping -n 100 -l 512 (Windows) or ping -c 100 -s 512 (Unix/GNU-Linux). – RedGrittyBrick May 5 '11 at 14:29
Great hint! I used "ping -n 100 -l 2048 host". This works from each client to each client. But as soon as I use it to ping from or to the server it fails at about 4% of the packages. Is this evidence to a hardware failure or could it be a software problem? – Michael Stoll May 5 '11 at 14:57
4% packet loss isn't catastrophic but it something that I'd look further into. To narrow down the point where packets are lost, I'd try plugging in a client at various places (maybe you have multiple ethernet switches between client and server) and - during acceptable sevice downtime - swap out patch cables at the server, use a different switch port etc. – RedGrittyBrick May 5 '11 at 15:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.