Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a simple and typical network configuration consisting of an ISP-provided cable modem connected through a SonicWALL router/firewall to a single switch that has been operating flawlessly for years. Suddenly all users on the network are experiencing intermittent inability to connect to specific WAN URLs (e.g., server unavailable, no response to pings, etc.,) which change over time while others are accessible.

Often I'm simply unable to connect to a page (without any delay or struggle, the page simply isn't there):

This happens while I'm able to connect without difficulty to other URLs (with no delays or degradation in speed at all). In fact, it's common to be be able to connect to a page, but be unable to access the resources linked to that page on other domains

When this happens, I get "hostname can't be found" errors for the missing content, as if it simply didn't exist on the Web:

Again, this failure is by domain: some domains are reachable without a hitch, while others are simply "not there". It is never the case that I can reach some resources on a domain, and not others. Moreover, when a domain is not found, it remains that way for a several minutes: multiple attempts to reach it report the same "not found" error, until it "reappears" and is then accessible as usual.

My ISP has been to the site multiple times and run diagnostics, and has found no problems. They replaced the cablemodem, and I've replaced the router/firewall with a new one running default settings. But the problem persists. Oddly, it seems to be worse during certain periods: I can go for several hours without any issues, and then have a patch of an hour or more where various URLs become unreachable for 20 minutes at a time.

I have no clues in my router logs, which are generally quiet and show nothing that correlates with the occurrence of this behavior, and I have this problem when there is no traffic on my network.

What could be causing this and how might I address this? I'm at a loss since this is essentially an out-of-the box basic small-business/home network setup. Could my switch need replacing too? Is there something that could be happening on my ISPs end?

share|improve this question
1  
Try and narrow down the problem by connecting a computer to the modem cable directly and see if it experiences the problem to rule out or pinpoint to a problem in the router or switch. Check also the DNS server settings in the computers, change to 8.8.8.8 for ex when the problem is happening in one of them and see if there's a difference. –  LinuxDevOps Mar 27 at 16:01
    
@LinuxDevOps: My ISP says it did that. I don't know what diagnostics they ran, and since the problem is intermittent they may have missed it. But assuming they're right, what might it be. Can a switch "go bad", and if it did could it cause what I'm seeing? –  raxacoricofallapatorius Mar 27 at 16:52
    
although unlikely (compared to other possible causes) a switch can "go bad", it's rare but a hardware issue where it drops packets is possible, to determine where the problem is you need to simplify and isolate the problem, that's why I suggested connecting a computer as directly as possible. –  LinuxDevOps Mar 27 at 17:07
    
While experiencing this problem for some site, could you run eg dig www.example.com (if it was http://www.example.com/ that you had a problem with) in the command line and share the full output? –  Håkan Lindqvist Mar 29 at 18:06
    
@HåkanLindqvist: Thanks for the suggestion (I and no idea about 'dig'). I've posted an example. –  raxacoricofallapatorius Mar 29 at 18:19
show 3 more comments

2 Answers 2

up vote 0 down vote accepted
+100

What can be seen in the dig output posted by @raxacoricofallapatorius in a comment is that their configured resolver server 207.172.3.8 (ISP-provided?) from time to time is responding with the error code SERVFAIL.

SERVFAIL ("Server Failure") is a general error code that means this nameserver had an unexpected type of problem that prevented it from fulfilling its duties. The operator of that server may be able to provide more information based on information logged on their end.

What you can do is to essentially either talk to the operator and try to have them resolve the problem or configure your operating system to use a different resolver server (eg 8.8.8.8)

share|improve this answer
    
How can I best determine if this is a problem on my end, or with the ISP (without wiring changes). Where, for example, should I look to determine if the "resolver server" is me or them? –  raxacoricofallapatorius Mar 29 at 19:10
    
207.172.3.8 is also known as ns1.dns.rcn.net (reverse dns entry for that IP) and is almost certainly not yours. I assume that RCN would be your ISP? –  Håkan Lindqvist Mar 29 at 19:12
    
Yes. So it IS THEM!? If I call them and tell them what I'm seeing, what do I need to say to make it clear that the problem lies on there end? Will the first sentence of this answer be enough? –  raxacoricofallapatorius Mar 29 at 19:14
    
In theory, yes. In practice it is unfortunately common that large consumer-oriented ISPs do not have qualified personnel dealing the calls to customer support which can pose a problem in making them understand it is an actual problem until they get swamped by calls about it. Using a different server may be your way out if this if that turns out to be the case. –  Håkan Lindqvist Mar 29 at 19:19
    
Thanks. Is there any reason not to use 8.8.8.8? How might I set that for all users on my network? –  raxacoricofallapatorius Mar 29 at 19:25
show 2 more comments

You can try to run speedtests to check if you are getting the bandwidth you subscribed for. Just make sure that the CIR of your connection is the same as the declared bandwidth on your contract. There are times that the CIR (Committed Information Rate) or the actual bandwidth is far much lower thant declared on your contract.

It would be best as well if you would install a network monitoring tool like Cacti or NTOP. Any bandwidth monitoring that will make you aware of the utilization on your network. You may also use Paessler or Netflow Analyzer (comes with 30day trial) which can determine which IP address within the network has much bandwidth utilization and what protocols are running on their computers. That way, you can determine if someone is consuming all your internet outbound/inbound traffic.

share|improve this answer
    
I have access to all devices connected to he network and have experienced this with all of the (but mine) disconnected. I've done the usual speed checks, and get the expected results. This happens when other URL are reached at excellent speeds, it's just that some are simply "not there". –  raxacoricofallapatorius Mar 28 at 23:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.