Link to home
Start Free TrialLog in
Avatar of Anti-Mhz
Anti-Mhz

asked on

Search DNS Manager for an entry (Windows 2003 SBS)

I have an entry of ip 10.0.1.28 which is an outdated entry that previously lead to the main WIndows 2003 server. The ip still shows up and gives an error on reverse lookup check. My understanding is this entry is within DNS Manager somwhere (WIndows 2003 SBS) yet after browsing all the folders and sub folders I just cant find. Is there a tool or a script that will let me search DNS entries for a specific entry. I wasnt able that find that option.
Avatar of Rick Fee
Rick Fee
Flag of United States of America image

Have you cleared the DNS cache on both Server and workstation?

Other idea is that there is a host file that has this DNS setup...check:

C:\Windows\System32\drivers\etc\hosts
Avatar of Anti-Mhz
Anti-Mhz

ASKER

Both Server and workstation had their cache cleared via ipconfig /flushdns as well as "Clear Cache" in DNS manager for the server. The hosts file on the server does not contain an entry for 10.0.1.28
thanks. il start going through these
On the server if you ping itself does it come back with 10.0.1.28 or is this on the workstations or both?   If on the workstations only check the host file there.   If not the scripts should be able to help you hunt it down.
i checked the hosts file on 2 workstations and it doesnt have an try for 10.0.1.28.
 What do you mean by ping itself? cmd> ping localhost or something similar?
From the workstation I'm wondering if you ping the server if it comes back with the bad IP
nah pinging server by it's name comes back with proper ip. It just we installed this system for IT's called Spiceworks and it runs like a DNS checkup on a system . The Checkup comes back with errors for 10.0.1.28
like this:

  10.0.1.28 ’ does not resolve ’ no reverse lookup

    IP Address does not resolve to a hostname


When you ping the name, do you get this:

> Pinging server.domain.com [192.168.1.1] with 32 bytes of data:

Or this:

> Pinging server [192.168.1.1] with 32 bytes of data:

The format here is revealing. The first tells us the answer is from the Hosts file or for DNS (no where else), the latter tells us it is from Hosts, WINS or Broadcast.

If you run "nslookup server" and get a response then Hosts and Broadcast are out, as is WINS except in special circumstances. That is, where DNS is forwarding unresolved requests to WINS.

If you get a response with that there's no need to dig through all the folders. DNS has a logical structure, "server" will be in the main "domain.com" forward lookup zone. It won't be in any sub-folder, it would need a longer name for that (like server.sub-folder.domain.com).

Chris
C:\Documents and Settings\drudnev>ping server

Pinging server.ARC.local [10.0.1.100] with 32 bytes of data:

Reply from 10.0.1.100: bytes=32 time=16ms TTL=128
Reply from 10.0.1.100: bytes=32 time=12ms TTL=128
Reply from 10.0.1.100: bytes=32 time=1ms TTL=128
Reply from 10.0.1.100: bytes=32 time=13ms TTL=128

Ping statistics for 10.0.1.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 16ms, Average = 10ms

C:\Documents and Settings\drudnev> nslookup server
Server:  server.arc.local
Address:  10.0.1.100

Name:    server.ARC.local
Address:  10.0.1.100


Our server is conviently (maybe not too secure) named SERVER btw

Judgin from this response the answer is from HOsts or DNS

The problem is with the name 10.0.1.28 which is our old ip for the server and still has a record somewhere. Here it goes

C:\Documents and Settings\drudnev>ping 10.0.1.28

Pinging 10.0.1.28 with 32 bytes of data:

Reply from 10.0.1.28: bytes=32 time=56ms TTL=128
Reply from 10.0.1.28: bytes=32 time=31ms TTL=128
Reply from 10.0.1.28: bytes=32 time=29ms TTL=128
Reply from 10.0.1.28: bytes=32 time=30ms TTL=128

Ping statistics for 10.0.1.28:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 29ms, Maximum = 56ms, Average = 36ms

C:\Documents and Settings\drudnev>nslookup 10.0.1.28
Server:  server.arc.local
Address:  10.0.1.100

*** server.arc.local can't find 10.0.1.28: Non-existent domain

That's the same thing Spiceworks told you, in essence. To get from the IP to a name you need to have a record in the Reverse Lookup Zone.

Head back to the DNS console and order records by the Data column?

If all your sub-folders are for AD, so _msdcs, _tcp, etc they won't have any record in that references that IP address.

Chris
ASKER CERTIFIED SOLUTION
Avatar of Citacomp
Citacomp
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial