Firewall filtering problem

[JoeMoreno]

I'm staying at a hotel for a couple weeks which is using this router:
http://173-11-135-253-houston.txt.hf...tbusiness.net/

For some reason, network connectivity on Mac OS X has problems. Pages begin to load and then stop (I'm using both Safari and Firefox). Sometimes I have to click reload, several times, in order to get a page to even begin to load. This problem is definitely not a bandwidth congestion issue.

Here's the strange part, if I fire up Windows XP using Parallels on my Mac then all web pages load fast, without any problems, in Internet Explorer and Firefox on XP.

I need to point the tech support team to something specific to troubleshoot otherwise they'll continue to conclude that it's a problem with my computer since they haven't received any other complaints.

Any idea would be greatly appreciated.

[fracai]

First, create and login under a new user account so you can confirm that it is indeed some interaction between Mac OS X and the network, rather than a configuration issue with your user account.

[JoeMoreno]

Fracai,

Good suggestion. I tried it under a different user account on the same machine, but I still see the problem. I don't find anything useful in /var/system/log, either.

- Joe

[Las_Vegas]

Create a new location for that hotel. In the Network preference pane, take note of the router address and enter that number into the DNS settings. If this doesn't work out, setup your DNS with OpenDNS.

[JoeMoreno]

I tried using different DNS servers but that didn't help.

What is so different about how Windows XP does a DNS lookup compared to Mac OS X such that XP works fine but OS X only works intermittently.

[hayne]

Do you have some evidence that this is a DNS problem? (True, DNS problems are common, but since different DNS servers aren't helping...)

It might be useful to cut the visual parts of the browser out of the equation by using a text-only browser as a test to see what part of the HTTP transaction is causing a problem.
Try the 'debug_http' script that I outlined in this old thread:
http://forums.macosxhints.com/showpo...91&postcount=7
Show us the results and we can help interpret.

[JoeMoreno]

It appears to be a DNS issue because, when I run "host google.com" or "host yahoo.com" from the command line, it sometimes takes more than 30 seconds to respond, or sometimes it fails with a "server unreachable" response.

The odd part is that I'll type "host google.com" and receive a response; then, I'll rerun the same command just a few seconds later and it times out. I'd expect that info to be cached.

[JoeMoreno]

This trouble shooting info might help - I'm not sure why I get back the correct IP and then a "Host ... not found" error:

jmoreno% host urlpuppy.com
urlpuppy.com has address 67.121.212.61
Host urlpuppy.com not found: 3(NXDOMAIN)

[JoeMoreno]

Also, here's an example of two Host requests sent right after each other. The first one timesout and the second returns the correct info (again, this is only a problem on Mac OS X - XP works fine to resolve all of the domain names):

jmoreno% host signonsandiego.com
;; connection timed out; no servers could be reached

jmoreno% host signonsandiego.com
signonsandiego.com has address 69.43.137.203
signonsandiego.com mail is handled by 20 mail2.uniontrib.com.
signonsandiego.com mail is handled by 10 mail1.uniontrib.com.
signonsandiego.com mail is handled by 20 mail4.uniontrib.com.
signonsandiego.com mail is handled by 10 mail3.uniontrib.com.

[hayne]

Using the "-v" option with 'host' might provide more clues.

[JoeMoreno]

host -v sometimes return NXDOMAIN and sometimes it returns the IP (using OpenDNS servers for DNS):

Example 1:
jmoreno% host -v urlpuppy.com
Trying "urlpuppy.com"
Received 30 bytes from 208.67.222.222#53 in 90 ms
Trying "urlpuppy.com"
Host urlpuppy.com not found: 3(NXDOMAIN)
Received 30 bytes from 208.67.222.222#53 in 91 ms

Example 2:
jmoreno% host -v urlpuppy.com
Trying "urlpuppy.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16073
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;urlpuppy.com. IN A

;; ANSWER SECTION:
urlpuppy.com. 1 IN A 67.121.212.61

Received 46 bytes from 208.67.222.222#53 in 1 ms
Trying "urlpuppy.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39437
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;urlpuppy.com. IN AAAA

Received 30 bytes from 208.67.222.222#53 in 1 ms
Trying "urlpuppy.com"
Received 30 bytes from 208.67.222.222#53 in 92 ms
Trying "urlpuppy.com"
Host urlpuppy.com not found: 3(NXDOMAIN)
Received 30 bytes from 208.67.222.222#53 in 97 ms

[JoeMoreno]

Here are two examples of Host queries, each run a few seconds apart, with a running TCP dump of the DNS traffic (in the second example, the NXDomain seems to be the result of a failed MX record lookup - all I care about, for now, is the why the A record lookup sometimes fails):

Example 1:
jmoreno% host urlpuppy.com
Host urlpuppy.com not found: 3(NXDOMAIN)

23:04:11.539513 IP 192.168.1.180.49758 > resolver1.opendns.com.domain: 17306+ A? urlpuppy.com. (30)
23:04:11.665857 IP resolver1.opendns.com.domain > 192.168.1.180.49758: 17306 NXDomain 0/0/0 (30)
23:04:11.666382 IP 192.168.1.180.49759 > resolver1.opendns.com.domain: 1972+ A? urlpuppy.com. (30)
23:04:11.820160 IP resolver1.opendns.com.domain > 192.168.1.180.49759: 1972 NXDomain 0/0/0 (30)


Example 2:
jmoreno% host urlpuppy.com
urlpuppy.com has address 67.121.212.61
Host urlpuppy.com not found: 3(NXDOMAIN)

23:09:57.811175 IP 192.168.1.180.49819 > resolver1.opendns.com.domain: 33597+ A? urlpuppy.com. (30)
23:09:57.812403 IP resolver1.opendns.com.domain > 192.168.1.180.49819: 33597 1/0/0 A adsl-67-121-212-61.dsl.sndg02.pacbell.net (46)
23:09:57.812873 IP 192.168.1.180.49820 > resolver1.opendns.com.domain: 14608+ AAAA? urlpuppy.com. (30)
23:09:57.814144 IP resolver1.opendns.com.domain > 192.168.1.180.49820: 14608 0/0/0 (30)
23:09:57.814395 IP 192.168.1.180.49821 > resolver1.opendns.com.domain: 24299+ MX? urlpuppy.com. (30)
23:09:57.904844 IP resolver1.opendns.com.domain > 192.168.1.180.49821: 24299 NXDomain 0/0/0 (30)
23:09:57.905306 IP 192.168.1.180.49822 > resolver1.opendns.com.domain: 48570+ MX? urlpuppy.com. (30)
23:09:57.994955 IP resolver1.opendns.com.domain > 192.168.1.180.49822: 48570 NXDomain 0/0/0 (30)