8
0
Today my machine stopped being able to access the internet. I can still access some local network resources. When I looked in the error log I saw following tcpip warning:
A request to allocate an ephemeral port number from the global UDP port space has failed due to all such ports being in use.
I ran netstat -anob and in the output DNScache is listed thousands of times (starting from port 50000 up to 65536).
This is the second time that this has happened to me. Killing the DNSClient process based on the instructions found here did work, but I would like to figure out what is causing this problem.
Update: When this problem happens I am still able to get online with programs that used DNS to resolve a hostname before the problem started. For example, I am able to continue chatting with friends with Pidgin. I am also able to connect to websites directly using the IP address.
cmorse
Posted 2013-05-02T16:40:54.937
Reputation: 1 010
Update: This has happened to me multiple times this week. I would really like some help in tracking down what is causing the problem, so I am adding a bounty. – cmorse – 2013-05-06T16:49:32.900
Check your router settings, as a number have a couple of them have a setting that limits the number of connections to the same host, try restarting the router to see if that clears the problem, if so then look in the advance settings under DoS and look for number of connections per host – Ian – 2013-05-06T17:01:38.123
@Ian I'm running dd-wrt on my router. I logged in and checked and there were 143 active IP connections (3% of maximum). I can check again tomorrow to see if the number is higher when the problem happens. I have seen the number of connections go well over 1,000 without any problems. – cmorse – 2013-05-06T17:18:51.237
1What's actually happening here is that the Dnscache service is binding all the listening ports it's permitted to use, and then failing when it tries to bind another one. I haven't found info on cause, and I don't have a Windows 8 box with which to experiment; in the meantime, I'd advise disabling the Dnscache service via the services console (Start -> Run -> services.msc, OK). Running without it will prevent name resolution results being cached, which will slow down network requests slightly as more DNS queries are necessary, but should put a stop to the much worse problem you're seeing. – Aaron Miller – 2013-05-06T17:31:07.410
@AaronMiller I have considered just disabling the DNSCache (called DNS Client, at least on windows-8) service altogether. Oddly, restarting the service does not solve the problem. I suspect that it is caching the data somewhere. Ideally, I would like to track down what is causing the problem. – cmorse – 2013-05-06T17:56:46.050
1Ideally, so would I -- but that may take some time, and disabling the service looks like it may offer a decent stopgap so that DNS resolution doesn't randomly fail, and require manual intervention to resume, between now and whenever a solution presents itself. – Aaron Miller – 2013-05-06T18:05:22.370
Of course, if disabling the service stops DNS resolution entirely, then it's not a good stopgap, but that's not the impression I've gotten from the various sources I've seen talking about how Windows DNS resolution works. I'll be back at my Windows 7 box this evening -- not the same, but close, and probably close enough to let me try that out and get results that are likely to have some validity in your situation. Unless you try it in the meantime, I'll do so, and comment then with the result. – Aaron Miller – 2013-05-06T18:15:29.550
Does
ipconfig /flushdnschange anything? Is your computer the only device on the network? I would also suggest to run some exhaustive virus checks with more than one product. If the problem just happened, try to rollback to a system restore point dating from before that. – harrymc – 2013-05-06T19:48:40.593@harrymc
ipconfig /flushdnsdoes not appear to do anything (based on the output of netstat), but I will try it for real once the problem occurs again. My computer is definitely not the only device on the network. It shares the network with multiple desktops, laptops, and other miscellaneous devices. It is difficult to tell exactly when the problem started happening because I normally leave my desktop running for weeks at a time. First time was ~2 weeks ago. – cmorse – 2013-05-06T22:41:02.093At least on Windows 7, disabling the DNS Client service does not prevent name resolution from occurring; since Windows 7 and Windows 8 are mostly the same OS under the hood (NT 6.1 vs. NT 6.2, respectively), I'd expect that you'll see the same result on your machine. The best test I can think of would be to wait for the problem to recur, then stop and disable DNS Client, and if necessary kill off the Dnscache processes by the method you've already been using -- if you don't see a recurrence after that, then the stopgap's doing what it should. – Aaron Miller – 2013-05-07T00:28:45.320
Maybe not your case, but just a remark that listening on all available UDP ports of the system is the mark of a virus attempting DNS poisoning. Which is why I suggested antivirus scans and/or system restore.
– harrymc – 2013-05-07T06:38:23.220@harrymc I wasn't aware that listening to all available UDP ports could be used for DNS poisoning! I suppose that is a possibility. I did a full scan of my system, and nothing came up. I have kept an eye on how fast the UDP ports fill up, and it goes up at around 10 per minute. – cmorse – 2013-05-07T20:29:07.907
Negative virus scan does not mean no virus, but maybe does not merit too much additional effort. Does the problem also happen when booting in Safe mode with Network? – harrymc – 2013-05-08T05:31:20.540
That's true, viruses can be very sneaky. I haven't seen any other behavior that is indicative of a virus though. I have noticed that the problem seems to be happening on my laptop as well, it just takes longer to become a problem because it is in sleep mode most of the time. I'll put my laptop in safe mode with networking this evening and see if it still happens. – cmorse – 2013-05-08T13:32:51.247
The problem didn't occur in safe mode. In fact, DNScache didn't have any open connections, probably because the service doesn't run in safe mode. – cmorse – 2013-05-09T13:36:15.433
Thanks for all the help guys. It's a big relief to know this wasn't cause by a virus! – cmorse – 2013-05-10T15:37:15.073