Eircom DSL - DNS Lookups Slow

jpfahy

aidanodr wrote: »

Interesting thought for the day -

EIRCOM still not telling us what the "Real" problem is? saying instead that it is caused by “unusual and irregular volume of traffic”.

If in the end it turns out that their DNS servers were compromised, how many people have shopped online with credit cards, used passwords and the like during this period of “unusual and irregular volume of traffic”. Has any of this info gotten into wrong hands?? particularly if it is a DOS attack ( Denial of Service )

So their - started the conspiracy theory and panic now havent I?

Aidan

Funny you should mention that, my CC was compromised last week, just after I bought something online from a reputable seller. First problem in years of buying online. Hmmmmmm...

RareVintage

aidanodr wrote: »

As I stated and others a good while back - SWITCH YOUR ROUTERS PRIMARY AND SECONDARY DNS Settings over to OPENDNS. Assuming you have the Eircom Netopia Router read the following ( ala Isaac702 a while back ):

- Open your browser. Go to your router IP address (usually 192.168.1.254) in a internet browser. Type this address in the address bar where you have http://www. whatever at the moment.
- Click Expert Mode in the left hand menu. Then click on "Yes, enter expert mode".
- Click on Configure in the left hand menu and then click Connection in the list that appears.
- On this page you get a area to type in the Primary and Secondary DNS Addresses ( maybe currently set to 0.0.0.0 for both ). This is where you type in OpenDNS's DNS Addresses:

Primary: 208.67.222.222
Secondary: 208.67.220.220

- You then click Save Changes and restart the router.
- You should now be on OpenDNS's DNS Servers. If you want to go back to using Eircom's again simply remove OpenDNS's IP Addresses.

Your problems ARE more than likely the same as everyone else.

PLEASE NOTE - their are MANY different routers on the market. RTFM and find out how to change DNS addresses for your own router to above. Impossible to cover all routers here.

LEAVING YOUR ROUTER SET TO OPENDNSes DNS IP ADDRESSES DOES NO HARM TO YOUR ROUTER OR INTERNET CONNECTION. NEITHER DOES IT INTERFERE WITH YOUR CONTRACT WITH EIRCOM. JUST LEAVE THEM THERE FROM HERE ON, THEY ARE FINE!

Aidan

Poor old Aidan is probably a bit bored with repeating the instructions...
I found this thread after the attack on Eircom last week. All the acronyms and tech talk is double dutch to me so I was reluctant to mess with anything.
And everything was fine till about 5.30 today...

Anyway I finally got fed up of having no internet except for this page and I finally felt persuaded. After I typed in the Opendns numbers and clicked 'save' it went into automatic reconnection. The login failed (twice) but I just hit the 'connect' button.
Now I have the internet back!!
Thanks Aidan (and earlier posters from a week ago) VERY MUCH INDEED!!!

G'luck from Cork

jenizzle

I just saw this thread after a WEEK of crappy broadband, convincing myself it was the useless wireless signal from the router :rolleyes: Thank you to OpenDNS and for suggesting it here, just fixed mine and my friends interwebs! *trundles off to try the Xbox*

JayeL

dacogawa wrote: »

mink_man

Open Browser and type in 192.168.1.254

Click "Expert Mode" followed by "Yes Enter Expert Mode"
Click "Configure" Then "Connection"

Change Primary DNS Server to 208.67.222.222
And Change Secondary DNS Server to 208.67.220.220

Then Click "Save and Restart Connection"


To go back to Eircoms DNS

Change Primary DNS Server to 0.0.0.0
And Change Secondary DNS Server to 0.0.0.0


Then Click "Save and Restart Connection"

Thanks a mil for that, dacogawa! Worked a charm!

aidanodr

JUST SOME GENERAL NOTEs for those interested:

As part of this Learning Curve for many here lets throw out a few things. TECHY's Look away - Dummies guide

A SERVER is a PC, thats all, a big huge spec'ed PC, but a PC all the same. Its got special software on it. In large organisations like Eircom they have many many server machines. Each of them do different things based on what specialist software is installed on them. So:

A DNS Server is a Domain Name Server - it does one thing, translates plain english domain names / www type names that you and I understand to unique sets of numbers that the internet understands - the IP Address xxx.xxx.xxx.xxx

A Server for Mail - Can be POP/SMTP and or IMAPI. Commonly if you have an Eircom Address - xxxxx@eircom.net - more than likely this is a POP/SMTP address. POP is for incoming mail, SMTP is for outgoing. Eircom calls both either mail.eircom.net or webmail.eircom.net. Again MORE Machines.

After that you might have File Servers for handling files and file transfers, Print Servers for handling ... YES .. printing and so on and so on.

So in a large NETWORK inside a large organisation you might have ALL of these servers in the Communications room OR some of them. In smaller organisations one may tend to have ONE Server with ALL or SOME of the above software installed on it. When it comes down to it what a server PC does all depends on what server software applications are installed on it. Larger firms tend to seperate out functions to seperate systems rather than all on one PC due to workload / number of people using the network.

In a way, the WORLD WIDE WEB is basically one big company network managed and delivered to us by the likes of Eircom, BT etc - the service providers.

Others may add to this - bare in mind I have tried to keep this low low tech and taken some liberties in the explanation.

One last thing about the DNS Server explanation above - if you understood my explanation - it is reckoned in some circles that the EIRCOM DNS servers got hacked. Picture this ( my little DNS Server ):

www.abcde.com ==> TRANSLATE TO ==> 111.222.333.444
www.fghij.com ==> TRANSLATE TO ==> 555.666.777.888

So it gets hacked by Fred the Hacker. Fred has a porn site at 323.434.545.656 called www.fredsgazubaas.com

He edits my little DNS server database above and changes:

www.fghij.com ==> TRANSLATE TO ==> 555.666.777.888

to

www.fghij.com ==> TRANSLATE TO ==> 323.434.545.656 ( freds porn site IP )

Now when I type www.fghij.com into my browser, my hacked DNS Server above redirects me to Freds Porn Site

Enjoy

Aidan

Mr.Nice Guy

Switched to DNS and things are working much smoother. Cheers for that.

PS Fred the Hacker really pisses me off.

aidanodr

Mr.Nice Guy wrote: »

Switched to DNS and things are working much smoother. Cheers for that.

PS Fred the Hacker really pisses me off.

Actually we should be really more pissed off with Fred the Eircom Network Guru who may not have patched the Eircom DNS Servers and left Fred the Hacker do his thing - thats of course IF they got hacked. But then Eircom are staying shtum on all this it seems! Wouldnt be doing the share price any good OR its sale value ...

Again - if interested - read these:

1st - http://software.silicon.com/security/0,39024655,39122803,00.htm
2nd - http://www.securosis.com/blog/dan-kaminsky-discovers-fundamental-issue-in-dns-massive-multivendor-patch-r

Aidan

ronnie3585

Thanks for your time and patience in explaining this stuff to us lads, changed the DNS nos and everything is back to normal.

Only thing is when ever I click on a PDF file to open it downloads straight into my downloads file and not open it on a new page like it used to. Any ideas?

BigEejit

Download and install a different pdf viewer, I can recommend foxit (http://www.foxitsoftware.com/downloads/index.php - its 3.5MB). Its free and its not bloated like acrobat is (25MB).

When you install it there will be google toolbar or similar selected to be installed, just untick the box(es) while installing and you just get the bare pdf viewer.

Star Bingo

christ.. reading back, eircom have massive issues. btw this DNS delay doesn't feel too new does it - but when i saw the ask.com search hijack and after i did laborious scans with the usual spyware/adware programs.. then dropped by here i thought man if they can do this by hijacking your provider's servers, who knows whAt i read someone had the alarm raised over the security of a transaction.. :eek: n read the links... :eek::eek:*<"thatmonkeywiththehairraised">

..and we've not had a speed increase in a while! get with the times? reimbuse us for this massive comprimise we are obedient people.. we should march them down with 'raise 7mb to 10mb' placards :rolleyes:

steamjetjoe

Thanks for the DNS settings lads. Just changed mine and im speed is back to normal, Although it is 01:36am.

''we should march them down with 'raise 7mb to 10mb' placards ''

I would be happy if I reached the 7mb speed in the first place:rolleyes:

Star Bingo

that'd be with the idea of actually geting it to 7! haha

..i dunno maybe my Toshiba Satellite M30 wi-fi card is outdated. tried everything, finally the newer model Netopia - only increased it to 4.6mb.

EDIT: like f*ck is my pc taking the rap - its eircom!!

JMcCR

From http://www.rte.ie/news/2009/0714/eircom.html

A number of Eircom customers had no internet access or experienced delays in browsing due to a suspected attack by hackers last night.

It is the second time recently that Eircom services have been affected by an 'unusual and irregular volume' of traffic directed at the site.

Eircom acknowledged many of its customers have recently experienced significant congestion while trying to log onto the internet.

Advertisement
Service was down for some customers from yesterday afternoon, but the company said it was fully restored by 11.15pm.

Eircom said it is too early to confirm an attack by hackers, but it believes that an unprecedented volume of traffic was deliberately directed at its network in recent days.

In the US, the Department of the Treasury and the Secret Service experienced similar problems when high volumes of traffic were directed towards its sites on 4 July - in what is believed to have been a coordinated cyber attack.

Eircom said its technical specialists have and are continuing to work to restore service and determine the source of the problem.

Sar!

Well finally after listening to eircoms BS for 15 days now they finally admit it:

http://www.irishtimes.com/newspaper/breaking/2009/0714/breaking15.html

Unbelievable really....

Jip

An Eircom spokesman was on Morning Ireland this morning but didn't give any specific details claiming the tech experts were working on it at the moment, no mention whatsoever of it being a DOS attack. TBH the first think I thought of was the attack was retribution for Eircom captitulating to IRMA.

Pablod

Its a load of balls to be honest, and you call Eircom and get the same thing 'Oh yes we are aware of the problem it is problem all over Ireland adn it is being worked on'

In Athy, it was down from 7pm last night, even up to this morning it still was not working!!!

Heard it finally making some headlines on the news and radio
98 said a spokesperson from Eircom stated that Eircom's DNS servers are being specifically targeted by hackers, and they can't confirm anymore!!!

mobius42

Jip wrote: »

An Eircom spokesman was on Morning Ireland this morning but didn't give any specific details claiming the tech experts were working on it at the moment, no mention whatsoever of it being a DOS attack. TBH the first think I thought of was the attack was retribution for Eircom captitulating to IRMA.

The Eircom guy didn't say it was a DOS attack, but he did say that traffic was "10 times normal levels". It's hardly script kiddies with that level of traffic; probably a bot net. The deal with the record companies was the first thing I thought of too but it could just be someone doing it for the lulz.

cpu-dude

Looks like Eircom have been over logging...



http://www.southparkstudios.com/episodes/166179

dubtom

I suffered a down last week and last night but only on firefox, infact it kept locking up and hanging. I managed to log with IE amazingly,infact I checked my isp speed at about 10pm thinking it was my connection and it came back at 98%. Was this 'hack' aimed at specific browsers?

lostexpectation

its great how eircom claims its has restored services this moring, er no nobody attacking you right now.

cpu-dude

dubtom wrote: »

I suffered a down last week and last night but only on firefox, infact it kept locking up and hanging. I managed to log with IE amazingly,infact I checked my isp speed at about 10pm thinking it was my connection and it came back at 98%. Was this 'hack' aimed at specific browsers?

It's nothing to do with peoples browsers or computers of any sort, their DNS servers were hacked. That's your own computers problem.

They change http://www.google.ie/ in http://66.102.9.99/ but because of the traffic and hacking, Google could redivert to any other IP address when you try visit it or mostly in Eircoms case, not complete at all. That's why everyone is using the very good OpenDNS servers.

Jip

mobius42 wrote: »

The Eircom guy didn't say it was a DOS attack, but he did say that traffic was "10 times normal levels". It's hardly script kiddies with that level of traffic; probably a bot net.

Anybody with a bit of tech knowledge would come to that conclusion, the general public wouldn't. The impression I got was that he was purposely avoiding referring to this as a DOS and was just saying that they had more traffic than usual.

cargo

aidanodr wrote: »

One last thing about the DNS Server explanation above - if you understood my explanation - it is reckoned in some circles that the EIRCOM DNS servers got hacked. Picture this ( my little DNS Server ):

www.abcde.com ==> TRANSLATE TO ==> 111.222.333.444
www.fghij.com ==> TRANSLATE TO ==> 555.666.777.888

So it gets hacked by Fred the Hacker. Fred has a porn site at 323.434.545.656 called www.fredsgazubaas.com

He edits my little DNS server database above and changes:

www.fghij.com ==> TRANSLATE TO ==> 555.666.777.888

to

www.fghij.com ==> TRANSLATE TO ==> 323.434.545.656 ( freds porn site IP )

Now when I type www.fghij.com into my browser, my hacked DNS Server above redirects me to Freds Porn Site

Enjoy

Aidan

Hi Aidan,

I can't get into www.fredsgazubaas.com Any idea whats wrong????? Looks like it's been hacked

Jammyc

dubtom wrote: »

I suffered a down last week and last night but only on firefox, infact it kept locking up and hanging. I managed to log with IE amazingly,infact I checked my isp speed at about 10pm thinking it was my connection and it came back at 98%. Was this 'hack' aimed at specific browsers?

I suffered the exact same thing. I couldnt open anything in Firefox, but when I tried IE I could get boards open and thats about it. When I changed to OpenDNS, Firefox resumed service. It was a strang'un alright

the_syco

So far I've swapped 6 people to OpenDNS. All worked straight away, bar one, who didn't get full access back, but was able to game again, so he was happy with that. I know of one person who had actually booked an engineer to come out and look at their router...

I wonder how many people are charging €50 for a nixer, and simply changing the DNS to OpenDNS, for people who don't know about the DNS problem?

Open dns was slow for me so switched back to Eircom dns today and its better.

prof_frink_2000

Eircom have for years left their DNS servers open to DNS requests from IP addresses outside of their network. This leaves them open to DOS attacks. They should have them isolated to only their customers that way an attack has to come from within their network giving them more control over stopping it. I imagine eircom engineers have probably been asking for the funds to address their list of security flaws for years and judging by the crap the Consumer Markets Director was talking on Radio 1 this morning I reckon management didn't even understand. Once again the MBAs of this world screwing up technology companies.

Loveless

Glad to hear Eircom are finally getting it in the ear on the news today, this problem has been going on since May.

here's what the WindowsUpdate site redirected to last week..

Badboy1977

I could not get onto FireFox -it kept saying that perhaps I had wrong address. Nor Could I upload Internet explorer. I spent four hours trying to fix it-could they not have got something on nine o'clock news?

Im convinced I fixed problem myself!! My wife is laughing at me when she heard news.

KeRbDoG

blubloblu wrote: »

I would highly recommend that everyone take one minute to switch to OpenDNS. http://www.opendns.com/

They're much faster and have loads of features that are actually useful.

I wouldn't use OpenDNS - they seem to hijack www.google.com queries. they put the searches through their servers first then tunnel them to Google.com.

FYI