top of page

DNS Timeout Only on One VLAN: dig +trace When the Forwarder Is the Fault

  • 3 days ago
  • 2 min read
SOC / packet analysis network security troubleshooting lab
SOC / packet analysis · Techclick CLI troubleshooting lab
Users on VLAN 40 cannot resolve names. VLAN 10 is fine. The AD DNS servers are up.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on SOC / packet analysis for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

dig from a VLAN 40 host. If it times out to the forwarder but works when pointed at 8.8.8.8, the path to the corporate DNS is filtered or the helper is wrong.

Why this ticket shows up

DHCP often hands out a DNS IP that is not reachable from the new VLAN. The servers being 'up' is not the same as reachable.

Symptoms operators actually see

  • dig @AD times out

  • dig @8.8.8.8 works

  • New VLAN

  • ip helper missing or wrong

CLI first — copy this block

Run these on the SOC / packet analysis device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

dig @10.0.0.10 www.microsoft.com +time=2
dig @8.8.8.8 www.microsoft.com
dig +trace www.microsoft.com
ipconfig /all
show ip route 10.0.0.10

How to read that output

Timeout to AD plus success to public DNS is a reachability or ACL problem on UDP/TCP 53, not a broken AD zone.

Triage order

  1. dig at the configured DNS

  2. Compare with a public resolver

  3. Trace routing/ACL to the AD DNS

  4. Fix helper or ACL

  5. Do not set 8.8.8.8 as the corporate default

Classic traps

What you see

Real cause

Fix

Change AD zones

Packet never arrived

Fix path

Give users 8.8.8.8

You break internal names

Fix reachability

Rebuild the DC

Other VLANs work

It is this VLAN

Proof the ticket is closed

  • dig @AD works on VLAN 40

  • Internal FQDNs resolve

  • No public DNS on DHCP

Say this in an interview

DNS 'down' on one VLAN is path to the resolver. I prove it with two digs.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments


bottom of page