DNS Client Events

Name resolution for the name xxxx timed out after none of the configured DNS servers responded.

Whenever i reboot my router or the connection goes down, i get these enteries in Event Viewer. The xxxx is a website ive never visited or heard of. I once clicked on one of the links and MSE detected a virus as soon as i did! The links are different everytime and random

I Googled it and some suggested it was to do with IPv6, but what is causing these entries to sites i dont visit?

something on your pc is attempting to contact "xxxxxxx". as the router is being rebooted it stops translating "xxxxxxx" into an IP address. It is normally your router that is the DNS server for your house.


I suggest if xxxxx is different each time, then you have a virus on your pc running in the background. when you reboot the router you see traffic from this virus to some xxxxxx destination being interrupted. I would follow some of the anti virus/malware removal instructions to clear this from you windows pc.

No virus on the PC. Run tests with MSE, Malware bytes and Superantispyware all clean

This happened when i bought the PC too even before i had a chance to install anything on it

I would take it to the cleaners and get you system scanned and cleaned by a decent AVirus/malware/rootkit detector.

Tend Micro HouseCall - Scanner

Also, If your ISP network do not yet support native dual-stack providing you with an IPv6 based service and you have not yet setup an IPv4 to IPv6 tunnel service then disable IPv6 routing in your router altogether !

Alternatively you could always configure your router to block inbound/outbound IPv6 DNS requests on (TCP/UDP port 53)

I am not well versed with IPv6 but I believe some additional routing information is included in the ipv6 packets or something to that effect - read the ipv6 spec here.

IPv6_packet

Another option maybe to create a restrictive IPv6 based ipset rules.

EDIT - I just re-read your OP and ARP poisoning attack sounds like what you are describing..

Edited by majika2007 (Fri 13-Sep-13 20:16:24)

http://social.technet.microsoft.com/wiki/contents/ar...

Thats what Microsoft say about it.

teredo.ipv6.microsoft.com and other microsoft sites is a common one i get. Im sure its something to do with ipv6

http://essenceofcode.com/2013/01/31/name-resolution-...

Dont use Chrome but interesting read

Edited by bobble_bob (Fri 13-Sep-13 20:37:29)