Avatar of Brandon_V
Brandon_V
Flag for Canada asked on

DNS Tracing

I have an unusual issue where I have a DNS entry from a vmware server that seems to be getting a bad DNS entry. So at some point I imagine it had a bad entry. When I change the entry it seems to be good for a bit but then it reverts back to the old one. It's a pretty small IT team so it would appear it's like a server with the old entry is somehow publishing the old/bad entry as newer.

Is there any way to trace on a DNS server where an entry came from and see where things are going to?
DNSWindows Server 2008

Avatar of undefined
Last Comment
OriNetworks

8/22/2022 - Mon
OriNetworks

Where are you seeing the old dns entry? I'm not sure if you mean an old dns record is listed in a zone or if a client is getting a DNS server assigned via DHCP to use when looking up DNS records.

For loggings at the DNS Server level:
Open DNS, rightclick the root and select properties
Under Debug Logging tab select Log packets and select your required options from there.
Brandon_V

ASKER
so for example I have
a record that looks like below

ServerA IP: 10.1.1.1

The DNS record SHOULD be ServerA IP: 10.1.1.2

So if I change the record so there is a static entry that says ServerA IP: 10.1.1.2 what is happening is say 2-3 hours later it is back to being ServerA IP: 10.1.1.1

just side bar info the DNS is an Active Directory integrated DNS zone
OriNetworks

if you do ipconfig on serverA is 10.1.1.2 the only IP address assigned?

If any other network interfaces exists it may request a new address from DHCP. Also, if you have multiple DNS servers you should probably make sure it is deleted on all or make sure DNS is correctly synchronizing between DNS servers
Your help has saved me hundreds of hours of internet surfing.
fblack61
Brandon_V

ASKER
Nop single NIC, no other interfaces picking up  the bad IP.
OriNetworks

Does the ipconfig command list any additional ip addresses assigned to the interface?
Brandon_V

ASKER
No it doesn't. I did find the issue, which is someone had configured the servers ILO to have the same name as the host. So when it updated DNS it messed it up.

Still though is there a way to setup the logging so that I could have seen that an update from Server X had the update or that the update came from hardware Address XXXXXXXX in the environment for example ?
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER CERTIFIED SOLUTION
OriNetworks

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question