We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

Search DNS Manager for an entry (Windows 2003 SBS)

Anti-Mhz
Anti-Mhz asked
on
Medium Priority
483 Views
Last Modified: 2012-05-07
I have an entry of ip 10.0.1.28 which is an outdated entry that previously lead to the main WIndows 2003 server. The ip still shows up and gives an error on reverse lookup check. My understanding is this entry is within DNS Manager somwhere (WIndows 2003 SBS) yet after browsing all the folders and sub folders I just cant find. Is there a tool or a script that will let me search DNS entries for a specific entry. I wasnt able that find that option.
Comment
Watch Question

Rick FeeMessaging Engineer - Disaster Recovery Engineer
CERTIFIED EXPERT

Commented:
Have you cleared the DNS cache on both Server and workstation?

Other idea is that there is a host file that has this DNS setup...check:

C:\Windows\System32\drivers\etc\hosts
Rick FeeMessaging Engineer - Disaster Recovery Engineer
CERTIFIED EXPERT

Commented:

Author

Commented:
Both Server and workstation had their cache cleared via ipconfig /flushdns as well as "Clear Cache" in DNS manager for the server. The hosts file on the server does not contain an entry for 10.0.1.28

Author

Commented:
thanks. il start going through these
Rick FeeMessaging Engineer - Disaster Recovery Engineer
CERTIFIED EXPERT

Commented:
On the server if you ping itself does it come back with 10.0.1.28 or is this on the workstations or both?   If on the workstations only check the host file there.   If not the scripts should be able to help you hunt it down.

Author

Commented:
i checked the hosts file on 2 workstations and it doesnt have an try for 10.0.1.28.
 What do you mean by ping itself? cmd> ping localhost or something similar?
Rick FeeMessaging Engineer - Disaster Recovery Engineer
CERTIFIED EXPERT

Commented:
From the workstation I'm wondering if you ping the server if it comes back with the bad IP

Author

Commented:
nah pinging server by it's name comes back with proper ip. It just we installed this system for IT's called Spiceworks and it runs like a DNS checkup on a system . The Checkup comes back with errors for 10.0.1.28
like this:

  10.0.1.28 ’ does not resolve ’ no reverse lookup

    IP Address does not resolve to a hostname

Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010

Commented:

When you ping the name, do you get this:

> Pinging server.domain.com [192.168.1.1] with 32 bytes of data:

Or this:

> Pinging server [192.168.1.1] with 32 bytes of data:

The format here is revealing. The first tells us the answer is from the Hosts file or for DNS (no where else), the latter tells us it is from Hosts, WINS or Broadcast.

If you run "nslookup server" and get a response then Hosts and Broadcast are out, as is WINS except in special circumstances. That is, where DNS is forwarding unresolved requests to WINS.

If you get a response with that there's no need to dig through all the folders. DNS has a logical structure, "server" will be in the main "domain.com" forward lookup zone. It won't be in any sub-folder, it would need a longer name for that (like server.sub-folder.domain.com).

Chris

Author

Commented:
C:\Documents and Settings\drudnev>ping server

Pinging server.ARC.local [10.0.1.100] with 32 bytes of data:

Reply from 10.0.1.100: bytes=32 time=16ms TTL=128
Reply from 10.0.1.100: bytes=32 time=12ms TTL=128
Reply from 10.0.1.100: bytes=32 time=1ms TTL=128
Reply from 10.0.1.100: bytes=32 time=13ms TTL=128

Ping statistics for 10.0.1.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 16ms, Average = 10ms

C:\Documents and Settings\drudnev> nslookup server
Server:  server.arc.local
Address:  10.0.1.100

Name:    server.ARC.local
Address:  10.0.1.100


Our server is conviently (maybe not too secure) named SERVER btw

Judgin from this response the answer is from HOsts or DNS

The problem is with the name 10.0.1.28 which is our old ip for the server and still has a record somewhere. Here it goes

C:\Documents and Settings\drudnev>ping 10.0.1.28

Pinging 10.0.1.28 with 32 bytes of data:

Reply from 10.0.1.28: bytes=32 time=56ms TTL=128
Reply from 10.0.1.28: bytes=32 time=31ms TTL=128
Reply from 10.0.1.28: bytes=32 time=29ms TTL=128
Reply from 10.0.1.28: bytes=32 time=30ms TTL=128

Ping statistics for 10.0.1.28:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 29ms, Maximum = 56ms, Average = 36ms

C:\Documents and Settings\drudnev>nslookup 10.0.1.28
Server:  server.arc.local
Address:  10.0.1.100

*** server.arc.local can't find 10.0.1.28: Non-existent domain
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010

Commented:

That's the same thing Spiceworks told you, in essence. To get from the IP to a name you need to have a record in the Reverse Lookup Zone.

Head back to the DNS console and order records by the Data column?

If all your sub-folders are for AD, so _msdcs, _tcp, etc they won't have any record in that references that IP address.

Chris
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.