goldie100
asked on
strange dns behaviour
Hi All,
We have a Windows 2003 domain which has been experiencing some unusual symptoms recently
We also use network monitoring software (Netcrunch) which monitors our primary domain and some other domains
The main issue is that when i run a tracert to any host (in this example - hostb) in any of the other domains the results come back as follows:
Tracert 192.168.0.1
Tracing route to dnsserver1.domain.com 192.168.0.1
1 1ms 192.168.1.1
2 1ms 192.168.0.1
In the above example the server I am running the trace from is dnsserver1 and 192.168.0.1 is hostb
Why does the trace result come back with dnsserver1? dnsserver1 will show up no matter which host in any of the other domains i try and trace to
The same happens if i try and run a trace from any hosts in our primary domain to the other domains
The net result of this behaviour is that out network monitoring software is showing all hosts in the other domains as the hostname of the network monitoring server:
How it should look (v simplified)
hosta 192.168.0.2
hostb 192.168.0.1
hostc 192.168.0.3
How it does look
netmonhost 192.168.0.2
netmonhost 192.168.0.1
netmonhost 192.168.0.3
Hope my explanation is clearer than mud!
Thanks in advance
G
We have a Windows 2003 domain which has been experiencing some unusual symptoms recently
We also use network monitoring software (Netcrunch) which monitors our primary domain and some other domains
The main issue is that when i run a tracert to any host (in this example - hostb) in any of the other domains the results come back as follows:
Tracert 192.168.0.1
Tracing route to dnsserver1.domain.com 192.168.0.1
1 1ms 192.168.1.1
2 1ms 192.168.0.1
In the above example the server I am running the trace from is dnsserver1 and 192.168.0.1 is hostb
Why does the trace result come back with dnsserver1? dnsserver1 will show up no matter which host in any of the other domains i try and trace to
The same happens if i try and run a trace from any hosts in our primary domain to the other domains
The net result of this behaviour is that out network monitoring software is showing all hosts in the other domains as the hostname of the network monitoring server:
How it should look (v simplified)
hosta 192.168.0.2
hostb 192.168.0.1
hostc 192.168.0.3
How it does look
netmonhost 192.168.0.2
netmonhost 192.168.0.1
netmonhost 192.168.0.3
Hope my explanation is clearer than mud!
Thanks in advance
G
ASKER
Hi Zane thanks for your reply
The strange thing is that nothing has been changed in DNS and all was normal until a couple of days ago.
Some of the domains in question are seen as secondary zones. A couple have forwarders setup
All the A records for hosts in these domains are correct
I am able to ping the fqdn for any of the hosts in the other domains. Only seems to be when i trace to the ip it will return the hostname of the machine i'm tracing from !
Also, if i do an nslookup on dnsserver1 for 192.168.0.1 (in a secondary zone) it returns
local host
192.168.0.1
Should it not return
hostb
192.168.0.1
The strange thing is that nothing has been changed in DNS and all was normal until a couple of days ago.
Some of the domains in question are seen as secondary zones. A couple have forwarders setup
All the A records for hosts in these domains are correct
I am able to ping the fqdn for any of the hosts in the other domains. Only seems to be when i trace to the ip it will return the hostname of the machine i'm tracing from !
Also, if i do an nslookup on dnsserver1 for 192.168.0.1 (in a secondary zone) it returns
local host
192.168.0.1
Should it not return
hostb
192.168.0.1
Does it say
Server: localhost
Address: 192.168.0.1
If so, that would be expected behavior. Make sure if you are doing an nslookup for an IP address you enter:
> set type=ptr
> 192.168.0.1
Then you should get the name for that IP address.
When you ping the FQDN, does it return the correct IP Address or does it return the IP address of the machine you are on? I couldn't tell for certain from your response.
Server: localhost
Address: 192.168.0.1
If so, that would be expected behavior. Make sure if you are doing an nslookup for an IP address you enter:
> set type=ptr
> 192.168.0.1
Then you should get the name for that IP address.
When you ping the FQDN, does it return the correct IP Address or does it return the IP address of the machine you are on? I couldn't tell for certain from your response.
ASKER
Hi Zane
No the output is
Server:dnsserver2
address: x.x.x.x
name: localhost ------- this should return the hostname for the target server?
address: 192.168.0.1
If i set type = prt then lookup 192.168.0.1 it returns 'local host' again - where it should return hostb?
Any ideas?
Thanks
No the output is
Server:dnsserver2
address: x.x.x.x
name: localhost ------- this should return the hostname for the target server?
address: 192.168.0.1
If i set type = prt then lookup 192.168.0.1 it returns 'local host' again - where it should return hostb?
Any ideas?
Thanks
ASKER
Anybody else got any ideas on this ?
Cheers
G
Cheers
G
Does nslookup return the correct values on each system? Do they resolve each other correctly?
Anything strange to report from Dcdiag /test:DNS
When you say domains- are they AD or DNS or both?
Any strange router configs like ospf?
Anything strange to report from Dcdiag /test:DNS
When you say domains- are they AD or DNS or both?
Any strange router configs like ospf?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Problem was never solved only worked around
A Record for Domain B
* netmonhost
Hopefully that is clearer than mud too.