[DM-MUG] What is going on - apple.com gives me wierd message

[Jerry Weida]

This is not a virus on the Mediacom servers.  This is simply a case  
of a wildcard DNS entry getting put to use where it shouldn't be.  I  
used to work for Mediacom until this month, and I was working to get  
that wildcard removed, but no one else there seems to realize what  
kind of problem it is.

Generally, a DNS look is done with a fully qualified name (i.e.  
www.apple.com) as opposed to a non fully qualified domain (i.e.  
www).  Mediacom decided that a wildcard entry would serve well and  
redirect people to the www.mchsionline.com website, but they messed  
up the redirection and so you get their test page that says "Welcome  
to the new Web3" (web3 is the hostname of the server).

Now, when your computer tries to do a lookup for www.apple.com it  
passes this request to the Mediacom DNS servers.  Those servers then  
try to do the lookup for you since they do not know this piece of  
information.  The problem comes in where these servers' requests do  
not get responded to, so they then pass back a NOT FOUND message to  
your computer.  Your computer then thinks that maybe this request was  
a non-fully qualified request and sticks your domain name on the end,  
making it www.apple.com.mchsi.com.  This request gets picked up by  
the Mediacom DNS servers which are configured to match *.mchsi.com to  
their webserver which it does so faithfully and returns the address  
of the webserver.  Your machine connects to the server and tells it  
that www.apple.com.mchsi.com was the virutal host it was trying to  
get to which should cause the redirection to take you to the actual  
webpage at www.mchsionline.com, but the redirection isn't working  
right, so you get the default website which only has the welcome  
page.  Your computer then caches this response as the correct one  
since it did appear to get a good result.

Now, after all this explaination, you probably want to know a quick  
way to fix this?  Well, the root cause needs to be fixed by Mediacom,  
but you can usually get rid of the caching that your computer has  
done.  Unfortunately, I'm fairly new to the world of Mac  
administration, so I can't really help out there except to say to  
restart your Internet router (if you have one) then restart your  
computer.  This should clear out your cache and the whole process  
will start over again.  This time however, hopefully,  the original  
request that Mediacom's servers send out on your behalf will return a  
proper response.

If you are on another OS, then you can always attempt the restart  
option as well, but there are ways to flush the DNS cache manually  
without the restart (useful if you have a website or something that  
you are hosting).  This usually involves restarting the caching  
service (nscd on Solaris and FreeBSD), or just issuing a flush  
command (i.e. ipconfig /flushdns on Windows).

You should still call or email Mediacom to try to get them to resolve  
this problem as it is obviously a nuisance on their service.

Jerry


On Feb 25, 2006, at 4:00 PM, Ray Bowler wrote:

> Vicki,
>
> I had this problem and called Apple Support. They did a Google  
> search on that phrase and found information about it.  Its seems to  
> be a virus on the MediaCom server but they refuse to admit it or  
> don't know about it. I switched from Airport to built-in-ethernet  
> and it solved the problem. The Ethernet IP is 10.0.1.3 and the  
> Airport's is 10.0.1.4. I can use Airport most of the time but when  
> I get this message I turn ethernet back on. It is an intermittent  
> problem so hard to check out. I'll watch replies. Matt's seems  
> interesting.
>
> At 11:32 AM -0600 2/25/06, Victoria L. Herring wrote:
>> I put in www.apple.com in Safari browser and get the following  
>> message, bold black font on white page, nothing ref Apple =  
>> "Hello, I am the new Web~db3!!!"
>>
>> I can get .Mac but I can't get Google's Gmail.
>>
>> Ideas???
>> --
>> Victoria L. Herring, Attorney, <http://www.HerringLaw.com>
>> Travel research and planning, <http://www.JourneyZing.com>
>> Photographs at Borders Cafe [West Des Moines, Iowa] through mid- 
>> March.
>> Newest photographs from Venice & Burano, Italy:  http:// 
>> victoriajz.smugmug.com
>> _______________________________________________
>> Dmmug mailing list
>> Use this Address to send mail to the list:
>> Dmmug at dmmug.org
>> Use this page to modify subscription options:
>> http://cialug.org/mailman/listinfo/dmmug
>
>
> -- 
> Ray
>
> Des Moines, IA Mac Users Group
> Fourth Tues of the month.
> See
>
>    <WWW.DMMUG.ORG>
> _______________________________________________
> Dmmug mailing list
> Use this Address to send mail to the list:
> Dmmug at dmmug.org
> Use this page to modify subscription options:
> http://cialug.org/mailman/listinfo/dmmug