LinNeighborhood uses a wrong IP address

foxy123 · 07-29-2007, 02:51 PM

Recently I have encountered a strange problem accessing Samba shares. My desktop computer's IP is 192.168.11.4. But when I try to access my samba share there from my laptp I've got the following problem:

Code:

 LinNeighborhood 
timeout connecting to 212.68.205.86:445
Error connecting to 212.68.205.86 (Connection refused)
timeout connecting to 212.68.205.86:445
Error connecting to 212.68.205.86 (Connection refused)

I tried to do it in terminal but no luck as well:

Code:

~$ sudo mount -t smbfs -o username=myname,password=mypass,uid=`whoami`,gid=`whoami`,fmask=000,dmask=000  //DESKTOP/myname /home/`whoami`/network
Password:
timeout connecting to 212.68.205.86:445
Error connecting to 212.68.205.86 (Connection refused)
8187: Connection to DESKTOP failed
SMB connection failed

I have no idea why it tries to connect to 212.68.205.86 instead of 192.168.11.4. I can mount it manually using IP address instead of name. However I cannot print to my network printer either because of this problem.
This is findsmb:

Code:

$ findsmb

                                *=DMB
                                +=LMB
IP ADDR         NETBIOS NAME     WORKGROUP/OS/VERSION 
---------------------------------------------------------------------
192.168.11.2    LAPTOP      [WORKGROUP] [Unix] [Samba 3.0.24]
192.168.11.4    DESKTOP       +[WORKGROUP] [Unix] [Samba 3.0.24]

and this is ping:

Code:

:~$ ping DESKTOP
PING DESKTOP (212.68.205.66) 56(84) bytes of data.
From 212.68.205.58 icmp_seq=1 Destination Host Unreachable

Networking is fine on Windows though.

Any help please?

acid_kewpie · 07-29-2007, 04:14 PM

ok, well celarly nothign to do wtih linneighbordhoor in the slightest, just a DNS issue... what does your /etc/resolv.conf file say? are you searching for a domain without realising? what does "dig DESKTOP" say?

foxy123 · 07-29-2007, 04:33 PM

Quote:

Originally Posted by acid_kewpie

ok, well celarly nothign to do wtih linneighbordhoor in the slightest, just a DNS issue... what does your /etc/resolv.conf file say? are you searching for a domain without realising? what does "dig DESKTOP" say?

/etc/resolv.conf

Code:

nameserver 192.168.11.1

Code:

 dig DESKTOP

; <<>> DiG 9.3.4 <<>> DESKTOP
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50869
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;DESKTOP.                       IN      A

;; ANSWER SECTION:
DESKTOP.                10000   IN      A       212.68.205.66
DESKTOP.                10000   IN      TXT     "NXDOMAIN"

;; Query time: 2763 msec
;; SERVER: 192.168.11.1#53(192.168.11.1)
;; WHEN: Sun Jul 29 22:32:06 2007
;; MSG SIZE  rcvd: 62

acid_kewpie · 07-30-2007, 02:52 AM

ok, so what is that nameserver? it has an A record right there for it... is it serving that from local files of forwarding to another server online?

foxy123 · 07-30-2007, 03:06 AM

Quote:

Originally Posted by acid_kewpie

ok, so what is that nameserver? it has an A record right there for it... is it serving that from local files of forwarding to another server online?

it is router's gateway. I do not have an answer to your second questions unfortunately as I do not really understand it. As I can see, something wrong in my DNS settings, but I have no idea where.

BTW, I have changed DNS from auto to those given by ISP, but it did not fix a problem.

My relolv.conf now looks like this:

Code:

nameserver 62.24.199.13
nameserver 62.24.199.23

acid_kewpie · 07-30-2007, 03:22 AM

so with those nameservers a "dig desktop @62.24.199.13" still gives that detail? I know that it can't... maybe it's cached, but there's apparently somethign screwy in the chain of nameservers your router is using, unless it has somehow accepted a local update for another machine...

foxy123 · 07-30-2007, 07:43 AM

Quote:

Originally Posted by acid_kewpie

so with those nameservers a "dig desktop @62.24.199.13" still gives that detail? I know that it can't... maybe it's cached, but there's apparently somethign screwy in the chain of nameservers your router is using, unless it has somehow accepted a local update for another machine...

yes, it still shows this 212.68.205.66 IP address

The same thing if I do

Code:

dig LAPTOP@62.24.199.13

it shows 212.68.205.66 for itself...

foxy123 · 07-30-2007, 05:14 PM

any advice how it can be fixed?

acid_kewpie · 07-31-2007, 01:00 AM

well there's clearly something a bit screwey somwhere, and it'll be silly and obvious once found, but right now i've no idea... what if you search for other no fqdn entries?

foxy123 · 07-31-2007, 03:04 PM

Quote:

Originally Posted by acid_kewpie

well there's clearly something a bit screwey somwhere, and it'll be silly and obvious once found, but right now i've no idea... what if you search for other no fqdn entries?

I tried livecd (Elive) and got the same 212.68.205.66 address. I have no idea where it comes from

acid_kewpie · 07-31-2007, 03:51 PM

well the only next step i'd look towards myself is a packet capture of the dns request to ensure that it's definitely the remote server replying... run "tcpdump -vn port 53" then do the dig again.

foxy123 · 08-01-2007, 12:58 PM

Quote:

Originally Posted by acid_kewpie

well the only next step i'd look towards myself is a packet capture of the dns request to ensure that it's definitely the remote server replying... run "tcpdump -vn port 53" then do the dig again.

here it is:

Code:

~$ sudo tcpdump -vn port 53
Password:
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
18:55:05.630484 IP (tos 0x0, ttl  64, id 25948, offset 0, flags [DF], proto: UDP (17), length: 51) 192.168.11.2.32782 > 62.24.199.13.53:  39175+ A? AC-PC. (23)
18:55:05.665483 IP (tos 0x0, ttl  57, id 42944, offset 0, flags [DF], proto: UDP (17), length: 88) 62.24.199.13.53 > 192.168.11.2.32782:  39175 2/0/0 AC-PC. A 212.68.205.86, AC-PC. TXT[|domain]
18:55:14.417913 IP (tos 0x0, ttl  64, id 34747, offset 0, flags [DF], proto: UDP (17), length: 51) 192.168.11.2.32782 > 62.24.199.13.53:  62887+ A? AC-PC. (23)
18:55:14.457056 IP (tos 0x0, ttl  57, id 45507, offset 0, flags [DF], proto: UDP (17), length: 88) 62.24.199.13.53 > 192.168.11.2.32782:  62887 2/0/0 AC-PC. A 212.68.205.86, AC-PC. TXT[|domain]
18:55:23.206922 IP (tos 0x0, ttl  64, id 43538, offset 0, flags [DF], proto: UDP (17), length: 51) 192.168.11.2.32782 > 62.24.199.13.53:  4970+ A? AC-PC. (23)
18:55:23.247695 IP (tos 0x0, ttl  57, id 47960, offset 0, flags [DF], proto: UDP (17), length: 88) 62.24.199.13.53 > 192.168.11.2.32782:  4970 2/0/0 AC-PC. A 212.68.205.86, AC-PC. TXT[|domain]

Code:

~$ dig AC-PC

; <<>> DiG 9.3.4 <<>> AC-PC
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4233
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;AC-PC.                         IN      A

;; ANSWER SECTION:
AC-PC.                  10000   IN      A       212.68.205.86
AC-PC.                  10000   IN      TXT     "NXDOMAIN"

;; Query time: 40 msec
;; SERVER: 62.24.199.13#53(62.24.199.13)
;; WHEN: Wed Aug  1 18:57:36 2007
;; MSG SIZE  rcvd: 60

Code:

$ findsmb

                                *=DMB
                                +=LMB
IP ADDR         NETBIOS NAME     WORKGROUP/OS/VERSION 
---------------------------------------------------------------------
192.168.11.2    LAPTOP         [WORKGROUP] [Unix] [Samba 3.0.24]
192.168.11.11   AC-PC         +[AC-PC] [Windows 5.1] [Windows 2000 LAN Manager]

acid_kewpie · 08-01-2007, 02:16 PM

OK, nothing more to add really, but googling for that IP http://www.google.co.uk/search?q=212.68.205.66 gives a number of other random things being resolved to that IP, which is owned by a belgian telco i think.

in terms of how to avoid it, if you set up a local dns service, even somethign as simple as dnsmasq and use that service as the first port of call you wouldn't encounter this problem, but i'm really intrigued as to what's actually going on now though.