Search DNS Manager for an entry (Windows 2003 SBS)

I have an entry of ip 10.0.1.28 which is an outdated entry that previously lead to the main WIndows 2003 server. The ip still shows up and gives an error on reverse lookup check. My understanding is this entry is within DNS Manager somwhere (WIndows 2003 SBS) yet after browsing all the folders and sub folders I just cant find. Is there a tool or a script that will let me search DNS entries for a specific entry. I wasnt able that find that option.
LVL 1
Anti-MhzAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Rick FeeMessaging Engineer - Disaster Recovery EngineerCommented:
Have you cleared the DNS cache on both Server and workstation?

Other idea is that there is a host file that has this DNS setup...check:

C:\Windows\System32\drivers\etc\hosts
0
Rick FeeMessaging Engineer - Disaster Recovery EngineerCommented:
0
Anti-MhzAuthor Commented:
Both Server and workstation had their cache cleared via ipconfig /flushdns as well as "Clear Cache" in DNS manager for the server. The hosts file on the server does not contain an entry for 10.0.1.28
0
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

Anti-MhzAuthor Commented:
thanks. il start going through these
0
Rick FeeMessaging Engineer - Disaster Recovery EngineerCommented:
On the server if you ping itself does it come back with 10.0.1.28 or is this on the workstations or both?   If on the workstations only check the host file there.   If not the scripts should be able to help you hunt it down.
0
Anti-MhzAuthor Commented:
i checked the hosts file on 2 workstations and it doesnt have an try for 10.0.1.28.
 What do you mean by ping itself? cmd> ping localhost or something similar?
0
Rick FeeMessaging Engineer - Disaster Recovery EngineerCommented:
From the workstation I'm wondering if you ping the server if it comes back with the bad IP
0
Anti-MhzAuthor Commented:
nah pinging server by it's name comes back with proper ip. It just we installed this system for IT's called Spiceworks and it runs like a DNS checkup on a system . The Checkup comes back with errors for 10.0.1.28
like this:

  10.0.1.28 ’ does not resolve ’ no reverse lookup

    IP Address does not resolve to a hostname

0
Chris DentPowerShell DeveloperCommented:

When you ping the name, do you get this:

> Pinging server.domain.com [192.168.1.1] with 32 bytes of data:

Or this:

> Pinging server [192.168.1.1] with 32 bytes of data:

The format here is revealing. The first tells us the answer is from the Hosts file or for DNS (no where else), the latter tells us it is from Hosts, WINS or Broadcast.

If you run "nslookup server" and get a response then Hosts and Broadcast are out, as is WINS except in special circumstances. That is, where DNS is forwarding unresolved requests to WINS.

If you get a response with that there's no need to dig through all the folders. DNS has a logical structure, "server" will be in the main "domain.com" forward lookup zone. It won't be in any sub-folder, it would need a longer name for that (like server.sub-folder.domain.com).

Chris
0
Anti-MhzAuthor Commented:
C:\Documents and Settings\drudnev>ping server

Pinging server.ARC.local [10.0.1.100] with 32 bytes of data:

Reply from 10.0.1.100: bytes=32 time=16ms TTL=128
Reply from 10.0.1.100: bytes=32 time=12ms TTL=128
Reply from 10.0.1.100: bytes=32 time=1ms TTL=128
Reply from 10.0.1.100: bytes=32 time=13ms TTL=128

Ping statistics for 10.0.1.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 16ms, Average = 10ms

C:\Documents and Settings\drudnev> nslookup server
Server:  server.arc.local
Address:  10.0.1.100

Name:    server.ARC.local
Address:  10.0.1.100


Our server is conviently (maybe not too secure) named SERVER btw

Judgin from this response the answer is from HOsts or DNS

The problem is with the name 10.0.1.28 which is our old ip for the server and still has a record somewhere. Here it goes

C:\Documents and Settings\drudnev>ping 10.0.1.28

Pinging 10.0.1.28 with 32 bytes of data:

Reply from 10.0.1.28: bytes=32 time=56ms TTL=128
Reply from 10.0.1.28: bytes=32 time=31ms TTL=128
Reply from 10.0.1.28: bytes=32 time=29ms TTL=128
Reply from 10.0.1.28: bytes=32 time=30ms TTL=128

Ping statistics for 10.0.1.28:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 29ms, Maximum = 56ms, Average = 36ms

C:\Documents and Settings\drudnev>nslookup 10.0.1.28
Server:  server.arc.local
Address:  10.0.1.100

*** server.arc.local can't find 10.0.1.28: Non-existent domain
0
Chris DentPowerShell DeveloperCommented:

That's the same thing Spiceworks told you, in essence. To get from the IP to a name you need to have a record in the Reverse Lookup Zone.

Head back to the DNS console and order records by the Data column?

If all your sub-folders are for AD, so _msdcs, _tcp, etc they won't have any record in that references that IP address.

Chris
0
CitacompCommented:
Another way you might want to try connecting the IP to the device is using the DHCP console.  Open up the address leases and see if you can find one for 10.0.1.28.

I can get the same ping and nslookup results for some switches for which I don't have DNS entries.  So your resolution might be to create the DNS entries rather than finding one to delete.

I don't know what Spiceworks is checking but it might be scanning for active IP addresses and then checking those it finds against your DNS records, and then reporting any inconsistencies.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.