Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been having intermittent Internet slowness for some time. It has been really challenging to me, and I have tried so many things. I replaced the modem, tried 3 routers, replaced a smart switch with a dumb one just in case it was a bottleneck, tried messing with QOS, etc. I am on the verge of adding a second IP and a dual wan router to see if that can help, but I am confused. When the Internet is slow, my Modem and Router pages are also slow. That made me think that there is some internal problem.

Today as soon as more than 15 users or so went on, things went south again. I tried using wireshark to see if I could figure anything out. I saw DNS Server Failed messages all over the DNS servers' wireshark trace. I tried nslookup from my local machine. Timed out. Tried from server, timed out. Tried nslookup google.com 208.67.222.222, instant reply. Suddenly I am thinking, this isn't an Internet problem at all. I just don't have internal DNS. Looked carefully at the Nslookup. It is pulling the IPv6 address of the server and failing. Then I tried nslookup google.com 192.168.1.6. That failed too. I disabled IPv6 (the protocol in network on the adapters) on the servers, and nslookup started working again, as did the Internet. However, I hear that is not a good practice.

What am I doing wrong? What should I do? Thanks so much if you can help.

Note added next day below: When many devices were on today, the Internet died again. I contacted ATT, and was told things seem fine from them to the modem. Wireshark isn't picking up anything that looks wrong to me. I found a mangaged switch to put between our Proxy and the rest of the lan and recorded all traffic to and from the proxy for a while. DNS requests were mostly working, although some timed out, but I think just because the Internet was terrible. Rebooting the proxy server seemed to fix things today. So, the last thing that seemed to fix things, turning off IPv6, may not have really done anything at all. DNS was just timing out, and happened to stop timing out at the same time I disabled it?

share|improve this question
1  
Did you get an IPv6 DNS server from somewhere? What server gave it to you? Is it valid? Do you have any of Teredo, 6to4 or ISATAP enabled? (None of those three should be enabled.) –  Michael Hampton Sep 24 '13 at 17:15
    
I don't believe that I have any of those enabled. Would those show up in network settings where ipv4 and ipv6 and so on are? They are not there. The IPv6 DNS server that was sending no response were my internal DNS servers. I tried nslookup google.com and it failed, saying it queried dnsnameserver.domain.local at its ipv6 address. I tried nslookup google.com 192.168.1.6 (same internal DNS server's ipv4) and it failed as well. Putting in one of the forwarders for that DNS server (208.67.222.222) worked fine. I disabled IPv6 and the DNS server worked. I disabled it on the backup. It did too. –  Karl Henselin Sep 24 '13 at 21:54
    
So it had nothing to do with IPv6, your internal DNS server was just misconfigured? –  Michael Hampton Sep 24 '13 at 22:06
    
I don't think that is was, I followed the MS guide on DNS setup. The DNS servers that were there were their own IPs. I don't have an external DNS server, and I didn't have one listed. Maybe I misunderstood something in the guide. –  Karl Henselin Sep 25 '13 at 13:07
    
AT&T is rolling out IPv6 in some areas right now. This may have something to do with it. –  Michael Hampton Sep 26 '13 at 3:52

2 Answers 2

It might be that some device on your network is pretending to be an IPv6 gateway without actually having a working IPv6 uplink. For example: Broken routers and systems with internet connection sharing sometimes do this.

You can check the routing table and neighbour discovery table on your server to see where it tries to send IPv6 traffic. In wireshark you might see ICMPv6 messages if type RA or Router Advertisement. The source MAC address might tell you which system is causing this.

For a more structural solution: some switches have a feature called RA-Guard to block unwanted RA messages. Otherwise tools like NDPmon can detect and counter them.

share|improve this answer
1  
You can compare this to someone connecting an unwanted IPv4 DHCP server to your network. The protocol is completely different, but maybe the comparison makes it easier to understand for those that don't know IPv6 yet :) –  Sander Steffann Sep 24 '13 at 20:25
    
Thanks for the answer and comment. I don't run linux or BSD or mac at this time, so I can't run NDPmon, but I will run a wireshark capture of arp and icmp6 for a couple days and see if I find anything interesting. I also tried the route print command. The backup server says this: –  Karl Henselin Sep 24 '13 at 22:41
    
IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 1 306 ::1/128 On-link 1 306 ff00::/8 On-link =========================================================================== Persistent Routes: If Metric Network Destination Gateway 0 4294967295 ::/0 fc00:1234:5678:9abc::1 0 4294967295 fc00:1234:5678:9abc::/64 On-link and the primary has 0 4294967295 ::/0 fc00:1234:5678:9abc::6 (its ipv6) –  Karl Henselin Sep 24 '13 at 22:43
    
fc00:1234:5678:9abc::1 doesn't exist, and I don't know where it is getting that from. I have IPv6 DHCP off, but I had tried it a long time ago. I looked in its settings, and I hadn't put in a gateway. I looked in the IPv6 settings inside network, and I didn't see it there either. I don't know if that is part of the trouble? –  Karl Henselin Sep 24 '13 at 22:44
    
I did route delete ::/0 on the one with the address that is invalid. It said ok, and route print no longer shows it. I think I will leave ipv6 disabled for a couple days though in case it fixes all my Internet woes. Then I will turn it on again and see if they come back. –  Karl Henselin Sep 24 '13 at 22:48

Microsoft doesn't recommend this, but you can either disable IPv6, disable specific IPv6 features or simply force Windows to prefer IPv4 over IPv6:

(This is a workaround, I'd go about troubleshooting some more first)

KB929852: How to disable IP version 6 or its specific components in Windows:

Go to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters

Edit the DWORD value named DisabledComponents to one of these (table ruthlessly stolen from the article):

     Value - Effects
         0 - Enable all IPv6 components. (Windows default setting)
0xffffffff - Disable all IPv6 components except the IPv6 loopback interface
             Prefer using IPv4 over IPv6
      0x20 - Prefer IPv4 over IPv6
      0x10 - Disable IPv6 on all nontunnel interfaces
      0x01 - Disable IPv6 on all tunnel interfaces, including ISATAP , 6to4, and Teredo.
      0x11 - Disable all IPv6 interfaces except for the IPv6 loopback interface.

And reboot the computer.

If you have RRAS installed on a server, only 0 and 0x20 are supported values

share|improve this answer
    
I have run the prefer IPv4 Microsoft support thing on my servers a few different times, and this issue happened afterwards. I don't know if the Internet was so slow that they gave up on IPv4 and switched or what. –  Karl Henselin Sep 24 '13 at 21:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.