Solved

Can anyone tell me what a value in the dwTimeStamp value of DNSCMD output is?

Posted on 2006-07-06
15
974 Views
Last Modified: 2008-01-09
If you execute Microsoft's DNSCMD.EXE and ask for detailed informaiton you will find a value in the information called dwTimeStamp (i.e. dwTimeStamp  = 3554631 ([15: 0: 0] [ 7/ 6/2006]).  I know that the 15:0:0 is 15:0:0 ZULU time but can anyone tell me what th 3554631 means?
0
Comment
Question by:wchull
  • 6
  • 4
  • 2
  • +2
15 Comments
 
LVL 26

Expert Comment

by:Pber
ID: 17053016
I believe that is the DNS aging information.
0
 
LVL 11

Expert Comment

by:star_trek
ID: 17053099
It is the scavenging time.
0
 
LVL 26

Expert Comment

by:Pber
ID: 17053115
Further to my previous post...

This value is set on all DDNS records.  It can also be set if you manually age records.  It does not come into play unless you have scavenging turned on in DNS.  This timestamp indicates how old the record is since it was last refreshed and scavenging will remove records tha are older.

this might help:
http://technet2.microsoft.com/WindowsServer/en/Library/20fbbd82-0cea-4a74-9634-fdd993f4c4f41033.mspx?mfr=true
0
Webinar: Aligning, Automating, Winning

Join Dan Russo, Senior Manager of Operations Intelligence, for an in-depth discussion on how Dealertrack, leading provider of integrated digital solutions for the automotive industry, transformed their DevOps processes to increase collaboration and move with greater velocity.

 

Author Comment

by:wchull
ID: 17053170
Thanks for the reply but that I know.  What I'm trying to determine is what the 3554631 means in regard to an actual date and/or time the record was registered or when the record is scheduled to be scavenged.
0
 
LVL 33

Expert Comment

by:NJComputerNetworks
ID: 17053373
dwTimeStamp
System time at which the input event was generated, in milliseconds. This value wraps around approximately every 50 days. See Remarks
0
 
LVL 33

Expert Comment

by:NJComputerNetworks
ID: 17053377
Remarks
The system time returned in dwTimeStamp comes from the same clock used by the Microsoft Win32 GetTickCount or timeGetTime functions, but it produces potentially more precise values. For example, on Microsoft Windows 95, the GetTickCount timer is updated only every 55 milliseconds, but the dwTimeStamp value is accurate to within 1 millisecond. Therefore, if you call GetTickCount and it returns n, and you then receive an event with a timestamp of n + n1, you cannot assume that the event took place exactly n1 milliseconds after the call to GetTickCount.
0
 
LVL 26

Expert Comment

by:Pber
ID: 17053450
I found the same documentation in MSDN.  I don't think it pertains to this situation $!#@$ M$.

It would seem to be the timestamp the records was last updated

3554631 ([15: 0: 0] [ 7/ 6/2006]).  
3554635 ([19: 0: 0] [ 7/ 6/2006])

It wouls seem to be based on hours as per above. I think we have to look at RFC's for this one.
0
 

Author Comment

by:wchull
ID: 17053714
OK...

I'm still confused bu Let's see if we can put some of this together.  I know that if I look at he properties of the DNS host record the  Record Time Stamp for this record will show up as 7/6/2006 10:00:00 AM.  The 15:0:0 is the time of day in the Universal Time mode which ignores all daylight savings time but to calculate the correct time for the Central Daylight Time in the US I need to subtract 5 hours (15 - 5) to get the time.  But is the 355361 just a different representation of 7/6/2006 10:00:00 AM?

Here is the reason I want to know....  We have Windows XP machines set to self register themselves in DNS and when they connect to the company via VPN a record is added to DNS.  When the clients disconnect there is nothing to automaticaaly remove the DNS entry so it stays in DNS dispite the fact that VPN issues that same address to another VPN client (whose record was also registered in DNS).  We have scavenging turned on but we can't get rid of the records fast enought so we are trying to run a VBScript around the output of DNSCMD to determine which records are stale based on a newer time stamp on for the same IP address.  In order to get the full dwtimeStamp I have to get the DNS records detail however if I can determine how the 355361 value equates to the date and time in the record I could speed up the proesss by only asking for the type A records which only provides the 355361 value as opposed to the full date and time.
0
 
LVL 26

Expert Comment

by:Pber
ID: 17053756
We had a similar problem with laptops vpning in and getting dual A records.  We fixed the problem letting DHCP do DNS updates and not the clients themselves.  As soon as the VPN client would drop the VPN concentrator would do a release on the IP and DHCP would clear out the record.  You can configure teh VPN interface on the client to not register DNS and make the DHCP zone update DNS.  
0
 

Author Comment

by:wchull
ID: 17054350
We may need to try something in that direction but we are attempting to look at a work-around to get us by for a while.  Our problem is that the clents typically have a small DHCP addresss range in their remote offices and this address pool is not shared with VPN.  If the client is not in their office but can connect via VPN then they still register in DNS but in the VPN address range.
0
 

Author Comment

by:wchull
ID: 17054690
Solution:

From another post on another forum it appers that the 3554631 number in the dwtimestamp is the number of hours from 1/1/1601 at 00:00:00 AM.  I took this information and used it in a VBScript function shown below and it calculated the date to be 7/6/2006 3:00:00 PM and since 3:00:00 PM is really 15:00:00 on the 24 hour clock this matched up with the rest of values ([15: 0: 0] [ 7/ 6/2006]) in the dwtimeStamp.  

DateInterval = 3554631
testdate = DateAdd("h",DateInterval,"1/1/1601 00:00:00 AM")
WScript.Echo testdate

This will help out as to get the dwtimestamp thru the DNSCMD function I was having to use the /detail argument which enumerates a lot more info than needed and I then had to use a bunch of VBScript to parse out the date.  Instead of going to all this trouble I can get the dateinterval by removing the /detail argument so my command string looks like this:

C:>dnscmd.exe c1dcl021 /enumrecords my.domain.com @ /child /type a /continue

With this info I can now create my own scavenging script for DNS that will keep our VPN address ranges down to 1 address.

Thanks for the help.
0
 
LVL 26

Expert Comment

by:Pber
ID: 17501995
I think wchull did find the solution to the question, thus should be awared the points.
0
 
LVL 26

Expert Comment

by:Pber
ID: 17502007
Sorry didn't see he was the author.  I'll be quiet now. (:
0
 
LVL 1

Accepted Solution

by:
DarthMod earned 0 total points
ID: 17519872
PAQed with points refunded (50)

DarthMod
Community Support Moderator
0

Featured Post

Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

So you have two Windows Servers and you have a directory/folder/files on one that you'd like to mirror to the other?  You don't really want to deal with DFS or a 3rd party solution like Doubletake. You can use Robocopy from the Windows Server 200…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question