Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Hello recently my network has started to cause me lots of problems. I have a cable modem, connected to a tp-link router (with some port forwarding). Everything was working fine then i started to get lots of udp (port 53) "UNREPLIED" logs in the router. Now there are tcp UNREPLIED logs too. This is causing lots of latency and failed connections when trying to connect to different internet sites. Also, we run an openfire server for spark connections, and I believe its causing connectivity issues for some users who are trying to connect using Spark (some people connect fine, others don't). Please see screen shot below for packet logs. It has to be something internally, as I connected straight to the comcast modem and i was able to connect to the internet and various sites as normal. I tried to swap out the router with a different and got the same issue. I scanned both my internal dns servers for viruses or malware and it came up empty. Another anomaly is that when i try to connect to www.cnn.com, i get redirected to the different site. I scanned my own machine for hijacks. Not sure if this is related to the networking issue. Please let me know if you have any ideas for troubleshooting. enter image description here

share|improve this question

1 Answer 1

In my opinion, all your symptoms looks like hijack. Generally, your adsl router would send all dns request to your ISP Dns, not directly to target. From your screenshot, the one i tried do not looks like true dns server.

Same for the http one i tried, no webserver.

If it's windows based, do a spybot scan, and housecall online antivirus to check up.

You may do a network trace from your workstation directly, to watch all network traffic. You can use wireshark, which is free.

share|improve this answer
    
so try running the spybot on the internal dns servers (Windows Server 2008)? –  user115848 Apr 3 '12 at 16:56
    
Run it on all local Windows, as we don't know who may be infected –  Mathieu Chateau Apr 3 '12 at 17:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.