DNS Issues on multiple Custom Devices

[Kiosk_Man]

I have a few different devices, all custom-made by a manufacturer, that are having a strange intermittent connection issue. These devices act as Kiosks, so they are not very powerful devices. The devices are connecting to the local network, and other networks with no issues and I’m able to see it online across a WAN via remote management software. Some HTTPS traffic seems to fail to work on the device at different intervals. They will sometimes start working again after a few minutes or perpetually reach out to the webpage but never connect unless I restart the device. It doesn’t matter what webpage I try to reach, eventually, it will fail to resolve the query.

 

I’ve captured network packets from the device via Wireshark and you can see the outbound DNS query but sometimes there is no response. It will attempt a few retransmissions, then it will just stop until I refresh the page. Sometimes it will start working again, and sometimes it won't. In the Windows event viewer, I see DNS failures (Event ID: 1014) for various URLs, including the one I actually want to access.

 

These devices are on constantly, with a restart every day early in the morning. They are all updating regularly with Windows Updates (No feature updates because it's Enterprise IoT). This issue has been going on for months now and it's driving me crazy. Any help would be greatly appreciated.

 

Some of the things I’ve already tried:

• Flushing the DNS cache on the device and browser cache

• Changing the DNS servers that the device reaches out to (On the device, and our router)

• Providing a static IP for the device

• Checked for Windows file corruption via SFC scan

• Reinstall drivers, and updated drivers

• Disabled all services, except core Windows services

• Manually list the URL in the Windows Host file to bypass DNS

• Cleared browser cache

• Ethernet Only Connection

• Wi-Fi Only Connection

• Re-imaging the device

• Reset TCP/IP stack

 

Specs Unit-1:

 

• Microsoft Windows 10 Enterprise LTSC Version 10.0.17763 Build 17763

• Processor: Intel(R) Celeron(R) CPU N3450 @ 1.10GHz, 1101 Mhz, 4 Core(s), 4 Logical Processor(s)

• Installed Physical Memory (RAM) 4.00 GB

• Ethernet: Realtek PCIe GbE Family Controller

• Wifi NIC: Intel(R) Wireless-AC 9260 160MHz

 

Specs Unit-2:

 

• Microsoft Windows 10 Enterprise LTSC Version 10.0.17763 Build 17763

• Intel(R) Atom(TM) CPU  E3845  @ 1.91GHz, 1909 Mhz, 4 Core(s), 4 Logical Processor(s)

• Installed Physical Memory (RAM) 4.00 GB

• Ethernet: Intel(R) 82574L Gigabit Network Connection

• Wifi NIC: Intel(R) Wireless-AC 9260 160MHz

 

Specs Unit-3:

 

• Microsoft Windows 10 Enterprise 2016 LTSB Version 10.0.14393 Build 14393

• Processor: Intel(R) Celeron(R) CPU  J1900  @ 1.99GHz, 1993 Mhz, 4 Core(s), 4 Logical Processor(s)

• Installed Physical Memory (RAM) 4.00 GB

• Ethernet: Realtek PCIe GbE Family Controller

• Wifi NIC: Realtek 8821AE Wireless LAN 802.11ac PCI-E NIC

[Robchil]

4 hours ago, Kiosk_Man said:

I have a few different devices, all custom-made by a manufacturer, that are having a strange intermittent connection issue. These devices act as Kiosks, so they are not very powerful devices. The devices are connecting to the local network, and other networks with no issues and I’m able to see it online across a WAN via remote management software. Some HTTPS traffic seems to fail to work on the device at different intervals. They will sometimes start working again after a few minutes or perpetually reach out to the webpage but never connect unless I restart the device. It doesn’t matter what webpage I try to reach, eventually, it will fail to resolve the query.

 

I’ve captured network packets from the device via Wireshark and you can see the outbound DNS query but sometimes there is no response. It will attempt a few retransmissions, then it will just stop until I refresh the page. Sometimes it will start working again, and sometimes it won't. In the Windows event viewer, I see DNS failures (Event ID: 1014) for various URLs, including the one I actually want to access.

 

These devices are on constantly, with a restart every day early in the morning. They are all updating regularly with Windows Updates (No feature updates because it's Enterprise IoT). This issue has been going on for months now and it's driving me crazy. Any help would be greatly appreciated.

 

Some of the things I’ve already tried:

• Flushing the DNS cache on the device and browser cache

• Changing the DNS servers that the device reaches out to (On the device, and our router)

• Providing a static IP for the device

• Checked for Windows file corruption via SFC scan

• Reinstall drivers, and updated drivers

• Disabled all services, except core Windows services

• Manually list the URL in the Windows Host file to bypass DNS

• Cleared browser cache

• Ethernet Only Connection

• Wi-Fi Only Connection

• Re-imaging the device

• Reset TCP/IP stack

 

Specs Unit-1:

 

• Microsoft Windows 10 Enterprise LTSC Version 10.0.17763 Build 17763

• Processor: Intel(R) Celeron(R) CPU N3450 @ 1.10GHz, 1101 Mhz, 4 Core(s), 4 Logical Processor(s)

• Installed Physical Memory (RAM) 4.00 GB

• Ethernet: Realtek PCIe GbE Family Controller

• Wifi NIC: Intel(R) Wireless-AC 9260 160MHz

 

Specs Unit-2:

 

• Microsoft Windows 10 Enterprise LTSC Version 10.0.17763 Build 17763

• Intel(R) Atom(TM) CPU  E3845  @ 1.91GHz, 1909 Mhz, 4 Core(s), 4 Logical Processor(s)

• Installed Physical Memory (RAM) 4.00 GB

• Ethernet: Intel(R) 82574L Gigabit Network Connection

• Wifi NIC: Intel(R) Wireless-AC 9260 160MHz

 

Specs Unit-3:

 

• Microsoft Windows 10 Enterprise 2016 LTSB Version 10.0.14393 Build 14393

• Processor: Intel(R) Celeron(R) CPU  J1900  @ 1.99GHz, 1993 Mhz, 4 Core(s), 4 Logical Processor(s)

• Installed Physical Memory (RAM) 4.00 GB

• Ethernet: Realtek PCIe GbE Family Controller

• Wifi NIC: Realtek 8821AE Wireless LAN 802.11ac PCI-E NIC

what is the single common item these failing devices passes through to the internet?

 

have you looked at the routers? dns dhcp servers? fw logs if anything are stopping them?