Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Eircom DSL - DNS Lookups Slow

Options
17810121321

Comments

  • Moderators, Education Moderators, Technology & Internet Moderators, Regional South East Moderators Posts: 24,056 Mod ✭✭✭✭Sully


    romdjoll wrote: »
    Hmmm... from the above it looks more like this is Eircom again.
    My speed is varying wildly on speed tests.
    If Open DNS isn't fixing whatever DDOS Eircom is being hit with, as in, if it's MORE than their DNS servers that are affected (that could have just been a symptom), then they're in serious trouble, and their customers deserve a bit more than vague statements about "unusual volumes of traffic".

    I have a funny feeling that they don't really know what's going on themselves, but I wish they'd find out and fix it.

    Speed is not related to DNS, so it would seem that Eircom are having a generally bad day. Eircom are unlikely to be effected by a DoS and every symptom so far has just been suggestive of DNS Poisoning.
    aidanodr wrote: »
    Interesting thought for the day -

    EIRCOM still not telling us what the "Real" problem is? saying instead that it is caused by “unusual and irregular volume of traffic”.

    If in the end it turns out that their DNS servers were compromised, how many people have shopped online with credit cards, used passwords and the like during this period of “unusual and irregular volume of traffic”. Has any of this info gotten into wrong hands?? particularly if it is a DOS attack ( Denial of Service )

    So their - started the conspiracy theory and panic now havent I? :D

    Aidan

    The type of compromise was not malicious, it seems. Every report has suggested that websites went to advertising portals - not fake versions of whatever website they visited. Its revenue generating.

    Its highly unlikely Eircom will explicitly state what happened - for many reasons. What they gave maybe vague, but it confirms that something irregular happened but they wont be saying what.
    i don't care what most companys do, i expect them to be honest.

    communicating is never pointless sully. the point is to put out statement admit the problem, word would have got around, they often put statements on the radio when the mobile network goes down, (if this was happening during the worktime they probably would have with this too)

    and lets quote this now

    The problem only gained the smallest of media attention yesterday. Eircom did release a statement but its hardly news for RTE News or the Radio. Even if Eircom did send it, the odds of it being read out are very slim. "In today's news, Eircom has reported problems with their DNS server..". Its unlikely to even hit the press (printed) unless they pick up on the reporting on Boards and decide to make an article out of it. DNS issues are not newsworthy.

    A statement was released confirming a problem and stating that it was not a normal problem. I would never have expected them, for security reasons for a start, to release exactly what happened.
    don't feel the need to answer for eircom sully you'll probably be wrong

    I'm confused. You complained they never released a statement - they did, in addition to an automatic message on their telephone. You asked what it meant - I explained in simpler English what it meant. My English is fine, so its highly unlikely I did not understand the English. You said they were not honest - they were, they confirmed a problem occurred and that it was irregular. Most people are happy with that and once it works, couldn't careless what Eircom said.


  • Closed Accounts Posts: 199 ✭✭Pegasus15


    Not sure if anybody already posted this but anyway...

    http://www.siliconrepublic.com/news/article/13369/comms/eircom-blames-dns-outage-on-irregular-traffic-volumes
    The country’s largest ISP says the outage that caused a DNS outage on its servers and resulted in browsing delays and misdirected traffic was due to ‘unusual and irregular’ volumes of internet traffic.

    The outage has led to speculation that the company’s servers were hacked. However, the company’s statement neither confirms nor denies this, although it suggests the company may have been the victim of a denial of service attack.


  • Registered Users Posts: 925 ✭✭✭KoKane


    What is DNS poisoning then? Since google wont even work, and I'm confined to ventrilo with other irish people also blocked out of internet service, can you please explain it briefly?

    edit - Boards is working fine and thats IT.


  • Registered Users Posts: 1,507 ✭✭✭Finical


    Wow in a clan game and I get disconnected. So pissed off now, this is going on too long now.:mad:


  • Registered Users Posts: 1,503 ✭✭✭ElNino


    Eircom DNS has been fecked for me for the last hour. I have successfully switched to Open DNS.


  • Advertisement
  • Registered Users Posts: 925 ✭✭✭KoKane


    ElNino wrote: »
    Eircom DNS has been fecked for me for the last hour. I have successfully switched to Open DNS.

    You still get the problem while on Open DNS?


  • Registered Users Posts: 24 romdjoll


    Yes, it's still there. This evening was a mess for me even on Open DNS, after flushing, and reboots and all the rest of it.

    Look back in the thread for details on packet loss, and to go with that I ran a test here and even after things settled down a bit I was having huge packet loss within the Eircom network (42% at step 1, pinging the local BRAS), and less after moving outside it.

    This would imply something other than DNS poisoning, but I'm at a loss as to what.


  • Moderators, Education Moderators, Technology & Internet Moderators, Regional South East Moderators Posts: 24,056 Mod ✭✭✭✭Sully


    DNS Poisoning is where DNS entire are modified for malicious purposes. As in, pointing a domain to a different IP. Eg RTE and Facebook going to an advertising portal. I simply can't see how a DoS attack can cause the symptoms of DNS Poisoning. I can see why they think that though, in the language used, but it could mean either way.

    The newer problems are not related to the above. What, I'm not so sure but ill look into it.


  • Registered Users Posts: 17,963 ✭✭✭✭Gavin "shels"


    Deleting all cookies off my computer seems to sort it out for me.


  • Registered Users Posts: 925 ✭✭✭KoKane


    Deleting all cookies off my computer seems to sort it out for me.

    Nah its just cleared there now, same for me atm. Stay tuned....


    edit - spoke too soon. Gone again :(


  • Advertisement
  • Registered Users Posts: 315 ✭✭john__long


    It could just be Eircom attempting to correct what happened yesterday?


  • Business & Finance Moderators, Entertainment Moderators Posts: 32,387 Mod ✭✭✭✭DeVore


    I know its somewhat ironic of me to say this but thank God for Boards... I had just installed IE 8 and thought it had buggered my machine.

    Sully, it could be both a DNS poisoning attack AND a ddos... that would explain everything. It means someones is pretty annoyed with Eircom if thats so...

    Boards gets DDOSed from time to time, we arent in the same league as what must be causing this but mostly its from China or Russia... we just dev/null that traffic. This seems strange to be going on so long.

    DeV.


  • Registered Users Posts: 315 ✭✭john__long


    Half of me hopes that it's quite simply Eircom's servers rolling over in front of increased demand.

    They'd have to upgrade something then!


  • Registered Users Posts: 925 ✭✭✭KoKane


    It only happens late though, which points towards a timezone specific DDOS? hmm


  • Closed Accounts Posts: 4,222 ✭✭✭robbie_998


    KoKane wrote: »
    It only happens late though, which points towards a timezone specific DDOS? hmm

    is eircom not an auzzie or new zeland company ?

    time difference ? :rolleyes:


  • Registered Users Posts: 315 ✭✭john__long


    One guy I was chatting to on Twitter says his router can't acquire an IP address!

    Anyone else finding this?


  • Closed Accounts Posts: 10,898 ✭✭✭✭seanybiker


    john__long wrote: »
    One guy I was chatting to on Twitter says his router can't acquire an IP address!

    Anyone else finding this?
    happened me yesterday. Grand now though.


  • Registered Users Posts: 1,567 ✭✭✭aidanodr


    Everything on OpenDNS works well but my Outlook Express won't work!! How do people who are always on OpenDNS get around this other than using webmail?

    Michael,

    Go to TOOLS, Accounts, then select your email address acount and properties. Now select the SERVERS tab. Your POP and SMTP settings, what are they?

    mail1.eircom.net for both or similar? Since Eircom upgraded their mail system one should probably make sure this is webmail.eircom.net, at least for the POP.

    This may solve your problem, which again has nothing to do with OPENDNS. Your email app is using POP and SMTP servers not DNS.

    Also worth doodling with while there is the OUTGOING MAIL SERVER setting, tick the My server requires authentication, then Settings button. Leave it at "use same settings ... " OR try add your email addy username / password. Only do this if difficulty occurs when SENDING an email.

    Cheers
    Aidan


  • Registered Users Posts: 925 ✭✭✭KoKane


    is eircom not an auzzie or new zeland company ?

    time difference ?
    As in, it could very well be a DDoS attack again, from a specific country, since its all kicked off around the same time again.


  • Registered Users Posts: 1,567 ✭✭✭aidanodr


    robbie_998 wrote: »
    is eircom not an auzzie or new zeland company ?

    time difference ? :rolleyes:

    Babcock and Browne own OR owned eircom, a financial type company from Oz. They in big trouble though, went into administration last March - "teetering under $3.1 billion in debt"

    Ref: http://www.theage.com.au/small-business/babcock-extends-suspension-20090619-cqsa.html

    Interesting other article too:

    Eircom closes Golden Pages chapter
    http://business.theage.com.au/business/eircom-closes-golden-pages-chapter-20090708-dcsv.html

    This article implies that Eircom is now owned by Eircom Holdings .. (ERC), the Australian vehicle that controls over 57pc of Eircom.

    BUT WAIT - theirs more:

    "In the meantime, investors are awaiting an announcement from the company about a possible takeover bid by a Singapore telecommunications group which would be preceded by a capital return already being planned by the Australian fund."

    Cheers
    Aidan


  • Advertisement
  • Closed Accounts Posts: 649 ✭✭✭Jeebus


    Having problems for a while now. OpenDNS fixed it a bit.

    Pain in the arse, to be honest.


  • Closed Accounts Posts: 9,082 ✭✭✭lostexpectation


    aidanodr wrote: »
    Babcock and Browne own OR owned eircom, a financial type company from Oz. They in big trouble though, went into administration last March - "teetering under $3.1 billion in debt"

    Ref: http://www.theage.com.au/small-business/babcock-extends-suspension-20090619-cqsa.html

    Interesting other article too:

    Eircom closes Golden Pages chapter
    http://business.theage.com.au/business/eircom-closes-golden-pages-chapter-20090708-dcsv.html

    This article implies that Eircom is now owned by Eircom Holdings .. (ERC), the Australian vehicle that controls over 57pc of Eircom.

    BUT WAIT - theirs more:

    "In the meantime, investors are awaiting an announcement from the company about a possible takeover bid by a Singapore telecommunications group which would be preceded by a capital return already being planned by the Australian fund."

    Cheers
    Aidan
    how is this helping? whats with the trolling aidanodr?


  • Registered Users Posts: 605 ✭✭✭PaddyTheNth


    Sully wrote: »
    The type of compromise was not malicious, it seems. Every report has suggested that websites went to advertising portals - not fake versions of whatever website they visited. Its revenue generating.
    That's still pretty malicious from the point of view of those business whose customers couldn't get to their websites...


  • Registered Users Posts: 1,828 ✭✭✭ven0m


    Since it happened again last night - I do wonder if eircom (holder of one of the biggest transit & connectivity infrastructures in the country) is ACTUALLY going to state that they haven't enough capacity & in that case, what is that saying about Ireland as a whole then if they are going to use that as their excuse .......

    This is either

    (a) an attack on eircom over what happened with the music labels court case
    (b) A cyber-terrorism attack as eircom is the largest connectivity provider & service provider in ireland,
    (c) Someone realising eircom doesn't know how to secure jack s**t & here's how to make a few quick bucks

    The problem is, eircom's statement doesn't tally with the realities of what happened. If it was an 'unusually high amount of traffic (READ: DOS attack), then it would purely be about flooding all it's routes & it would take a huge amount of zombies to achieve this given the levels they peer at, but this was purely about DNS injection - redirecting people to fake sites where in some cases, people got no DNS resolution or it was a hit & miss over what sites they did get redirected to, which could also be dependant on their own local machine's DNS caching.

    either way & even if you don't wanna take a wild stab at conspiracies, eircom need to be forced to come clean about what happened, as this issue has affected its userbase countrywide now for the last 3 days, meaning a huge proportion of Irish internet users have effectively been forced offline.


  • Registered Users Posts: 1,927 ✭✭✭keith_d99


    Yep my router has lost it's connection - can't connect this morning
    john__long wrote: »
    One guy I was chatting to on Twitter says his router can't acquire an IP address!

    Anyone else finding this?


  • Closed Accounts Posts: 238 ✭✭coadyj


    Simple solution for all problems with eircom dns

    Open Browser and type in 192.168.1.254

    Click "Expert Mode" followed by "Yes Enter Expert Mode"
    Click "Configure" Then "Connection"

    Change Primary DNS Server to 208.67.222.222
    And Change Secondary DNS Server to 208.67.220.220

    Then Click "Save and Restart Connection"

    This will fix all DNS problems, if you have any problems message me


  • Registered Users Posts: 1,486 ✭✭✭dowtchaboy


    Maybe - We Are Not Alone.......:)
    Federal Web sites hit hard by cyber attacks
    Assault targets several agencies; South Korean sites also paralyzed

    By Lolita C. Baldor

    updated 12:01 a.m. ET July 8, 2009
    WASHINGTON - A widespread and unusually resilient computer attack that began July 4 knocked out the Web sites of several government agencies, including some that are responsible for fighting cyber crime, The Associated Press has learned.

    The Treasury Department, Secret Service, Federal Trade Commission and Transportation Department Web sites were all down at varying points over the holiday weekend and into this week, according to officials inside and outside the government. Some of the sites were still experiencing problems Tuesday evening. Cyber attacks on South Korean government and private sites also may be linked, officials there said.

    U.S. officials refused to publicly discuss details of the cyber attack. But Amy Kudwa, spokeswoman for the Homeland Security Department, said the agency’s U.S. Computer Emergency Readiness Team issued a notice to federal departments and other partner organizations about the problems and “advised them of steps to take to help mitigate against such attacks.”

    She said the U.S. government sees attacks on its networks every day, and measures have been put in place to minimize the impact on federal Web sites. It was not clear whether other federal government sites also were attacked.

    Others familiar with the U.S. outage, which is called a denial-of-service attack, said that the fact that the government Web sites were still being affected three days after it began signaled an unusually lengthy and sophisticated attack. The officials spoke on condition of anonymity because they were not authorized to speak on the matter.

    Korean attacks apparently linked
    Web sites of major South Korean government agencies, banks and Internet sites also were paralyzed in a suspected cyber attack Tuesday. Ahn Jeong-eun, a spokeswoman at the Korea Information Security Agency, said the U.S. and South Korean attacks appeared to be linked.

    The South Korean sites included the presidential Blue House, the Defense Ministry, the National Assembly, Shinhan Bank, Korea Exchange Bank and top Internet portal Naver. They went down or had access problems since late Tuesday, Ahn said.

    The Homeland Security Department's Kudwa had no comment on the South Korean attacks.

    Two government officials acknowledged that the Treasury and Secret Service sites were brought down, and said the agencies were working with their Internet service provider to resolve the problem.

    ‘Massive outage’ detected
    Ben Rushlo, director of Internet technologies at Keynote Systems, called it a “massive outage” and said problems with the Transportation Department site began Saturday and continued until Monday, while the FTC site was down Sunday and Monday.

    Keynote Systems is a mobile and Web site monitoring company based in San Mateo, Calif. The company publishes data detailing outages on Web sites, including 40 government sites it watches.

    According to Rushlo, the Transportation Web site was “100 percent down” for two days, so that no Internet users could get through to it. The FTC site, meanwhile, started to come back online late Sunday, but even on Tuesday Internet users still were unable to get to the site 70 percent of the time.

    “This is very strange. You don’t see this,” he said. “Having something 100 percent down for a 24-hour-plus period is a pretty significant event.”

    He added that, “The fact that it lasted for so long and that it was so significant in its ability to bring the site down says something about the site’s ability to fend off [an attack] or about the severity of the attack.”

    Deluged by data
    Denial-of-service attacks against Web sites are not uncommon, and are usually caused when sites are deluged with Internet traffic so as to effectively take them offline. Mounting such an attack can be relatively easy using widely available hacking programs, and they can be made far more serious if hackers infect and use thousands of computers tied together into “botnets.”

    For instance, last summer, in the weeks leading up to the war between Russia and Georgia, Georgian government and corporate Web sites began to see denial-of-service attacks. The Kremlin denied involvement, but a group of independent Western computer experts traced domain names and Web site registration data to conclude that the Russian security and military intelligence agencies were involved.....


  • Closed Accounts Posts: 19 tooley


    Go to http://twitition.com/8g935 and sign the petition

    We the undersigned petition Eircom to provide a usable broadband service

    (1) Eircom should inform customers of outages (2) Eircom should inform customers of scheduled maintenances (3) Eircom should perform broadband maintenance between 3:00 AM and 6:00 AM (4) Eircom should consider using OpenDNS (5) Eircom should consider outsourcing its Customer Support Centre to someone who cares

    Go to http://twitition.com/8g935 and sign the petition


  • Registered Users Posts: 1,503 ✭✭✭ElNino


    KoKane wrote: »
    You still get the problem while on Open DNS?

    No, Open DNS is working fine for me.


  • Advertisement
  • Moderators, Education Moderators, Technology & Internet Moderators, Regional South East Moderators Posts: 24,056 Mod ✭✭✭✭Sully


    DeVore wrote: »
    I know its somewhat ironic of me to say this but thank God for Boards... I had just installed IE 8 and thought it had buggered my machine.

    It still might have :p
    Sully, it could be both a DNS poisoning attack AND a ddos... that would explain everything. It means someones is pretty annoyed with Eircom if thats so...

    Aye well it would explain last nights problems, but everything prior to that suggested DNS Posioning for the simple reason the service was online and was just redirected elsewhere (advertising portals). I doubt anyone over here could put that much power into knocking Eircom, kinda weird someone from overseas would bother.
    That's still pretty malicious from the point of view of those business whose customers couldn't get to their websites...

    True, but they could have redirected you to websites which downloaded malware of viruses etc. :)


This discussion has been closed.
Advertisement