Name resolution issue: ping -a gets different host - Resolution with screenshots

Q: We are running Windows 2008 domain. Some of our Windows 7 have a name resolution issue. For example, the computer 002653 IP is 10.0.6.250

C:\Windows\System32>ping 002655

Pinging 002655.chicagotech.net [10.0.6.250] with 32 bytes of data:

Reply from 10.0.6.250: bytes=32 time=1ms TTL=128

Reply from 10.0.6.250: bytes=32 time=1ms TTL=128

Reply from 10.0.6.250: bytes=32 time=1ms TTL=128

Reply from 10.0.6.250: bytes=32 time=1ms TTL=128

Ping statistics for 10.0.6.250:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

If I use ping –a 10.0.6.250, it lists computer hostname 001267.

C:\Windows\system32>ping -a 10.0.6.250

Pinging 001267.chicagotech.net [10.0.6.250] with 32 bytes of data:

Reply from 10.0.6.250: bytes=32 time=1ms TTL=128

Reply from 10.0.6.250: bytes=32 time<1ms TTL=128

Reply from 10.0.6.250: bytes=32 time<1ms TTL=128

Reply from 10.0.6.250: bytes=32 time<1ms TTL=128

Ping statistics for 10.0.6.250:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 1ms, Average = 0ms

After I flush and register DNS,

C:\Windows\system32>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Windows\system32>ipconfig /registerdns

Windows IP Configuration

Registration of the DNS resource records for all adapters of this computer has b

een initiated. Any errors will be reported in the Event Viewer in 15 minutes.

Still ping –a 10.0.6.250 shows 001267.

C:\Windows\system32>ping -a 10.0.6.250

Pinging 001267.chicagotech.net [10.0.6.250] with 32 bytes of data:

Reply from 10.0.6.250: bytes=32 time=1ms TTL=128

Reply from 10.0.6.250: bytes=32 time<1ms TTL=128

Reply from 10.0.6.250: bytes=32 time<1ms TTL=128

Reply from 10.0.6.250: bytes=32 time<1ms TTL=128

Ping statistics for 10.0.6.250:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 1ms, Average = 0ms

The nslookup shows the same problem. Why?

C:\Windows\system32>nslookup

Default Server: 2008dc2.chicagotech.net

Address: 10.0.0.27

> 10.0.6.250

Server: 2008dc2.chicagotech.net

Address: 10.0.0.27

Name: 001267.chicagotech.net

Address: 10.0.6.250

If I check the DNS Manager, the 001267 computer IP address is 10.0.7.117.

A: I have a feeling it's due to the ownership of the reverse record. If DHCP doesn't own it, or the previous machine that registers it owns the record, then the new machine taking that IP won't be able to update it.

So let's take a look in the reverse zone for IP 10.0.6.250, and delete its "001267chicagotech.net" PTR record, then re-run the ipconfig /registerdns.

To get it to make sure the zones stay clean in the future, you can configure DHCP with credentials to use for registration so DHCP owns the records under that account, then force DHCP to update all records, forward and reverse, and enable (but not force) scavenging. Just turn it on, and let it go. Keep the lease greater than or equal to the scavenge periods, and not less than 24 hours.

Reply: You are right. The Reverse record shows IP 10.0.6.250 points to 001267. After deleting it, flushdns and registerdns, ping -a get correct hostname.

Contact a consultant

Related Topics