RVS4000 > Network devices cannot resolve NETBIOS names when...

[aaron.martinas]

okay, so i've b!tched about this before already. i'd just like someone to properly explain to me why the following scenario doesn't work.

before i even GET to the scenario, please see the youtube video i posted so you can FULLY UNDERSTAND EXACTLY what's going on:

[The YouTube Video link has been removed because it had the F-bomb in it... ISN'T THAT SILLY??] - removed by Cindy Toy, Cisco Small Business Support Community Manager

What you will see in that video is the details on my window's boxes network configuration. you'll initially see that my address is from the private scope as "10.10.10.111". You'll see that my subnet mask is "255.255.255.0". You'll see that my default gateway and DHCP server are set to "10.10.10.1". This is my RVS4000. then you'll see that i have 2 dns servers start with the "208" address. these are OPENDNS servers. i get these addresses from my DHCP server (because i've set up my RVS4000 to use custom DNS - these 208 addressess - which actually means that the RVS will simply send my DHCP clients custom DNS servers)

At this point, it's important to recognize that my windows client in the video is using the "208..." addresses for DNS queries. i then attempt to ping a NETBIOS name "nas". the address comes back with an ip of "67.215.65.132". This address is the "ooops cant resolve that DNS name for opendns" portal page. that is to say that when i tried to do an NETBIOS lookup of the name nas, the DNS servers attempted to find "nas", couldn't and sent me to a portal page. simple.

i then go back to my network properties of my adapter. from here we confirm that i got my DNS servers from my DHCP server, the RVS4000. i then change my DNS server to the RVS4000. we all know that the RVS4000 isn't a DNS server. it will simply forward the DNS requests out the door to my ISP's DNS servers (because the RVS4000 itself is a DHCP client to my ISPs network and has received it's own set of DNS entries).

i verify the network configuration in the video at this point. you can clearly see that my RVS4000 is my gateway, my DHCP server, and my DNS server (the latter in which i showed you i manually configured).

i then attempt to ping the netbios name "nas". holy @#$% it works. i clear the screen and do it again. still works. so i change back to my DHCP server giving me custom DNS servers. i verify the change. IMMEDIATLY, i stop being able to resolve the netbios name. and basically the rest of the video is just me proving again that netbios works, but ONLY IF I DONT HAVE CUSTOM DNS servers.

after all that, what is my issue you ask??

WHY is it that NETBIOS fails when the RVS4000 sends my clients custom DNS servers???

lets consider the name resolution order on a windows PC:

here's a picture

and here's the technical overview

summary:

1. Windows checks whether the host name is the same as the  local host name.

2. If the host name and local host name are not the same, Windows  searches the DNS client resolver cache.

3. If the host name cannot be resolved using the DNS client resolver  cache, Windows sends DNS Name Query Request messages to its configured  DNS servers.

4. If the host name is a single-label name (such as server1) and cannot  be resolved using the configured DNS servers, Windows converts the host  name to a NetBIOS name and checks its local NetBIOS name cache.

   Windows creates the 16-byte NetBIOS name by converting the host name,  which must be less than 16 bytes long, to uppercase and padding it with  space characters if needed to create the first 15 bytes of the NetBIOS  name. Then, Windows adds 0x00 as the last byte. Every Windows-based  computer running the Workstation service registers its computer name  with a 0x00 as the last byte. Therefore, the NetBIOS form of the host  name will typically resolve to the IPv4 address of the computer that has  a NetBIOS computer name that matches the host name.

   If the host name is 16 characters or longer or an FQDN, Windows does  not convert it to a NetBIOS name or try to resolve the host name using  NetBIOS techniques.

5. If Windows cannot find the NetBIOS name in the NetBIOS name cache,  Windows contacts its configured WINS servers.

6. If Windows cannot resolve the NetBIOS name by querying its configured  WINS servers, Windows broadcasts as many as three NetBIOS Name Query  Request messages on the directly attached subnet.

7. If there is no reply to the NetBIOS Name Query Request messages,  Windows searches the local Lmhosts file.

SO I RESTATE:

why can't my network devices (in this case, a laptop but it's network wide dont worry) perform a netbios lookup when my router passes a client a DNS server that is not the router itself???

someone PLEASE EXPLAIN THIS TO ME!!!!! you saw netbios work when the client sends its DNS requests to my router (10.10.10.1), but it FAILS when my client has a DNS server given to it by the router, where that DNS server is not the router itself!!!!

Message was edited by: Cindy Toy

[aaron.martinas]

... where's cisco support?!

[Eric Moyers]

Sir My name is Eric Moyers from the Cisco Small Business Support Center, I apologize that no one has posted any reply back to you before this moment. I am looking at your post and will gather some information, In the mean time, can you email me your router serial number and Cisco UserID ao that I can create a case for you to document our efforts. Thnk you for your time and patience in this matter, but rest assured we will do everything to find you a resolution or explanation.

Eric Moyers

Cisco Network Support Engineer

[Eric Moyers]

I will send you a private message with my email.

[Eric Moyers]

Sir, I have review the issue that you are having and you actually answered your question within your summary.

If you are resolving your DNS to an external DNS like OpenDNS, and if OpenDNS has a NETBIOS name of "nas" in it DNS Cache, then NAS is going to resolve to the external first, not internal. The best way to resolve this issue that you are having is either to setup your own DNS servers or a dynamic DNS name. Or even better yet change your hostname from "nas" to something unique and this should resolve locally on the network.

If you would like to explore the options further, I welcome you to call into the Small business Suport Center and open a ticket with one of our agents. Any of them will be happy to assist you in resolving this issue for you.

In order to open a ticket please have your RVS4000 Serial Number handy and a Cisco User ID. If you do not have one it is easy to set one up, just go to the Cisco website and setup an account.

Thank you for your question

[aaron.martinas]

emoyers wrote:
If you are resolving your DNS to an external DNS like OpenDNS, and if OpenDNS has a NETBIOS name of "nas" in it DNS Cache, then NAS is going to resolve to the external first, not internal.

emoyers wrote:
Or even better yet change your hostname from "nas" to something unique and this should resolve locally on the network.

i am one hundred and five thousand percent sure that if i ping "sadflkjasdf8892837923824732jhasdf", openDNS will still resolve this name. like i said, openDNS is set up to always provide some type of response for all DNS queries, even if the domain doesnt exist. in that case, it sends back an "oops" page.

............hrm.........

you may have inadvertantly stumbled onto the solution. and no, the solution isn't that " 'nas' name in the dns cache" speculative nonsense... as i write this, i'm starting to suspect that any DNS provider that uses "can't find it, here's a suggestion" portals will by that very nature ALWAYS break netbios since it will either return an IP of the valid domain, or if it can't find the domain, it returns the IP of the searchportal page.

therefore, if it ALWAYS grabs the name, netbios never occurs because computer xyz is ALWAYS given a "positive" dns response (wether the domain actually exists or not) preventing a netbios broadcast from ever being sent.

that would explain why netbios works when i manually set my DNS server to my router. my router receives the request, forwards it to my ISPs DNS servers, and my ISP sends back a "negative" response. i long ago opted out of roadrunner's "DNS suggestion" portal garbage. since there was a circumstance that allowed netbios to work in all my extensive testing, i assumed the RVS4000 was the culprit. it may turn out that all my b!tching had nothing to do with cisco

if all this shakes out, it adds just another reason why it's a VERY BAD IDEA for DNS services to return search portal pages during DNS queries. it f%#ks up networking theory. ill post back on sunday when i get back from my business trip.

[aaron.martinas]

i have in fact confirmed that OpenDNS has all along been the culprit for all my netbios problems. The reason things work when i point to my ISPs DNS servers (that is, when i don't use custom DNS) is because they seem to do business smarter. When my ISP receives a lookup request for a name that isn't fully qualified (e.g. netbios names), it doesn't attempt to resolve them. therefore, netbios can occur.

on the other hand, OpenDNS screws up netbios by appending my ISP-provided DNS suffix to the name and then attemping resolution. when resolution fails, it sends back the IP of OpenDNS's portal page. Netbios never occurs because resolution "succeeded".

can someone mark my answer as the solution, and more importantly help me eat a lot of crow now that i've figured this out?

[Eric Moyers]

Mr. Martinas,

Thank you for letting us know about the results.  And no need to eat crow, we all learn things everyday. That only makes us better.

I just appreciate you sharing the results, now we all can learn.

Eric