Why is my DNS Server Address Constantly Changing? For BirdDog, Gwalk or Corrosive...and others, too....

[GabeU]

I can't remember who it was that posted a month or two back about how their Glasswire app showed very few of the little warning bubbles on the graph.  Mine is full of them, and most of them are DNS address changes.  Sometimes two or three a day.  I think it may have been BirdDog that talked about this, but I wasn't sure, so I figured I'd ask the three of you knowledgeable folks, and anyone else who might know.  If I've missed anyone else just as knowledgeable, sorry.  LOL. 

Any ideas about what's going on, or how to stop it if it's a problem?  It's always changing TO 192.168.0.1.  When clicking on the "+ 2 more" box on the right, it gives two old DNS server addresses, and they are the same with every instance of changing. The two are exactly the same as what it shows the old one was, which is fec0:0:0:ffff::1, but with a 2 and 3 after them instead of a 1, i.e. fec0:0:0:ffff::2 and fec0:0:0:ffff::3.  This is a bit ridiculous, isn't it?  Or, again, is this normal?  Thanks for the help. 

BTW, this is with my desktop connected directly to the modem.  No router. 

[C0RR0SIVE]

Not a clue as to why that would happen...  I can guess it's due to DHCP renewal and the modem getting a new IPv6 address every now and then?  That or it's losing IPv6 connectivity and assigning just an IPv4 address for DNS... No clue to be honest.

[Amanda]

Oh, that is weird. I have glasswire running on the computer in the lab, I'll go see if the same thing is happening. 

[Amanda]

Hey Gabe

Just checked ours and I don't see anything like that. Is your DNS set to automatic on computer/router? The fec0:0:0:ffff::1/2/3 listings are link local so I think this might have something to do with your status meter? Can you check the app history on the Status Meter to see if the times match for anything the Status Meter is tracked for on GlassWire?

Amanda

[BirdDog]

What is your lease time set to on the router? I normally set it to something near the max allowed.

[Old Labs]

As I recall (it's been far to long and the details have long faded), it's probably part of IPV6 local area network discovery. When no router's in the picture it keeps trying periodically and the last digit represents a priority sequence or something like that. With a router in the picture it knows not to try unless the connection drops (again or sumpin' like that).          

[BirdDog]

Yea, IPv6 is still a bit of a strange duck to me, things about it I'm still trying to grasp.

[Old Labs]

Wouldn't be surprised to find a corresponding error or warning in the system event logs - you know, the ones where James from Microsoft Windows who sounds like he's from somewhere else, wants to show them to you as evidence that your "compootah" is infected, and will gladly clean things up for you by simply downloading his application and a small credit card fee 😉            

[BirdDog]

Oh yea, "James".....lol.

[Gwalk900]

Here is mine:

I agree with corrosive that it is likely DHCP renewal related.

In mine above I was using my old Netgear WNR2000v.1 router. It was IPv4 only with DNS set to Google until late yesterday.

Now on the Asus 3100 and that is IPv6 compatible.

[brianj1313]

Just Google static vs dynamic ip addresses and it will explain it

[GabeU]

Amanda,

If you are speaking about the IPv4 and IPv6 settings, yes, they are both set to obtain the DNS server address automatically.   I do see on Glasswire where, under the Status Meter app, it shows that address as a host.  Sometimes I do restart my computer, especially when it has that recent freezing problem, and when it restarts the status meter connects again, of course.  

For the next few days I'll write down the time when I start the computer, plus the times when I have to restart.  I'll check to see if that start, and the restarts, correspond to the DNS address changes.  If it turns out that this is what's causing them, then it's actually nothing to worry about.   

I appreciate the help. 

[GabeU]

I was wondering if that's what was causing it, too.  Amanda mentioned the possibility of it being tied to the Status Meter, and I have had to restart quite often lately (since the anniversary update), so I'm going to see if the address changes correspond to the initial startup and any times that I have to restart. 

[GabeU]

No router with this setup.  I have yet to check my laptop to see if it does it when I do use the router.  I only connect the router and power it up when using my laptop.  I might do that later tonight, during Bonus Bytes time, as I have to update the laptop anyway.  Actually, my seldom used notebook, as well.   

[GabeU]

Ah.  So yours is doing the same,  though to a considerably lesser extent.  Interesting. 

[GabeU]

I don't believe this has anything to do with dynamic IP addresses, which Hughesnet uses. 

[GabeU]

Well, I've discovered that it's definitely tied to this computer, alone.  Neither my laptop, nor more seldom used notebook, have had one single instance of the DNS server changing.  When I connected the router and plugged my desktop into one of the LAN connections on it, sure enough, another DNS change, but this time to 192.168.1.1, instead of 192.168.0.1.  I think that's because the router has that first DNS locked into it.

Should I try setting both IPv4 and IPv6 to manual and use 192.168.0.1, or could not having them set to automatic cause problems?   

All of this fiddling around did prompt me to finally downgrade my notebook from W10 to W8.1, though.  It's just too weak to run W10 well.  It only has an AMD A4-1250 at 1Ghz and 4GB of memory, so it was very slow, and forget trying to do more than one thing at a time with it.  Even with an SSD it was still dreadfully inadequate in the speed and multitasking departments.  I know it runs W8.1 halfway decently, so at least I got something good done with this whole adventure, though I had to install W8, update everything, then upgrade to W8.1, and again, update everything, plus reinstalling all of my programs, and I'm still in the process of all of this.  At least it will run better, though.

[C0RR0SIVE]

Having it not automatic will cause issues as you shouldn't be assigned a 192.x.x.x address on your LAN when directly attached and the private address they do give you can change at any moment.

[GabeU]

Ah.  Good to know.

[GabeU]

Just as I figured it would, the constant warnings of DNS changes from Glasswire stopped since changing my the DNS servers to Google's.  Still, why it was constantly doing this was odd.  Neither of my other computers had this problem, including when I had my laptop directly connected sans router.  At least my Glasswire graph will look a little cleaner.  That's always good. 

[Amanda]

Hey Gabe

Glad to hear but I want you to try something for me? 🙂

Do you know how to disable your IPv6 settings? If you can just a little experiment... clear out the DNS settings you made and try it with IPv6 disabled and see if you still get those alerts.. Thanks in advance if you do !

Amanda