Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 207
  • Last Modified:

DNS records

We have a printer on the print server with hostname abcd
if I ping the abcd I get the IP 172.16.x.x.
the ping times out

if I ping the 172.16.x.x I get the abcd
the ping times out

Well, if I nslookup the abcd, I get the record 10.20.x.x

So which DNS record is correct ?

I flushed DNS and tried this on 2 different PCs, but still do not know which DNS is correct for the host abcd.

Any idea ?

Thank you
0
jskfan
Asked:
jskfan
  • 8
  • 4
  • 3
  • +2
6 Solutions
 
Dr. KlahnPrincipal Software EngineerCommented:
If the printer is inside your LAN, and the LAN is on 10.20.0.0, they're probably both correct and incorrect.

172.16.x.x is probably the internet-facing address of your DSL/fiber/cable modem.

10.20.x.x is probably the printer's IP address on your LAN.

Do a dig on the name, and see what is returned.  Particularly note the nameserver involved (in the example below, 8.8.8.8, a google nameserver).  Let us know what you find.

dig www.decwrl.com

; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> www.decwrl.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29200
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1024
;; QUESTION SECTION:
;www.decwrl.com.                        IN      A

;; ANSWER SECTION:
www.decwrl.com.         3599    IN      CNAME   decwrl.com.
decwrl.com.             3599    IN      A       50.63.202.52

;; Query time: 70 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Oct 07 15:48:06 UTC 2016
;; MSG SIZE  rcvd: 73

Open in new window

0
 
omarfaridCommented:
What is your OS?
0
 
jskfanAuthor Commented:
This is windows 2008 OS
The Printer is inside the LAN.
0
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

 
footechCommented:
Do you have an entry in your hosts file for abcd?  Nslookup queries the DNS server directly, ignoring the hosts file, while ping will use the normal OS DNS resolver.

Failing to respond to a ping doesn't necessarily mean a DNS record is incorrect - the firewall rules may just not allow that traffic.
Both 172.16.x.x and 10.20.x.x are private IP addresses (not accessible via the internet).
0
 
jskfanAuthor Commented:
If I am not wrong the Ping also uses NSlookup...This is why when I ping abcd I get 172.16.x.x
and when I directly use Nslookup abcd I get 10.20.x.x  if I use Nslookup 10.20.x.x I get abcd

So where is that IP 172.16.x.x coming from ?
0
 
footechCommented:
I think you should read my comment again.

Ping and nslookup are two different tools.  One doesn't use the other.  Nslookup has its own DNS resolver, while ping uses the DNS resolver of the OS.  The normal OS name resolution process can use your hosts file, DNS, WINS, LMHosts file, and NetBIOS broadcasts to resolve names.
0
 
omarfaridCommented:
Please see the link below that explains difference of how ping and nslookup work:

https://blogs.msdn.microsoft.com/nitinsingh/2013/06/24/dilemma-of-name-resolution-process-with-ping-vs-nslookup/
0
 
jskfanAuthor Commented:
I know that they are different...but Ping calls the Nslookup.
For instance if you Ping an IP address 10.20.20.4
you will  get the "Pinging XYZ.domain.com" , how does the Ping knows the hostname ? it gets it from DNS..right?

Pinging XYZ.domain.com [10.20.20.4] with 32 bytes of data:
Reply from 10.20.20.4: bytes=32 time=17ms TTL=57
Reply from 10.20.20.4: bytes=32 time=22ms TTL=57
Reply from 10.20.20.4: bytes=32 time=31ms TTL=57
Reply from 10.20.20.4: bytes=32 time=14ms TTL=57
0
 
footechCommented:
When I said "Nslookup has its own DNS resolver, while ping uses the DNS resolver of the OS", it would have been more accurate to say:
Nslookup has its own name resolver, while ping uses the name resolver of the OS.  Nslookup only does DNS, while the OS can use any of the methods mentioned (it tries them in order).

I think we've spent enough time covering the differences.

Do you have an entry in your hosts file for abcd?
0
 
jskfanAuthor Commented:
We do not use Host file..and this has been tried from 2 different PCs.

 
while ping uses the name resolver of the OS
if you are referring to the DNS resolver cache on the client, That one gets flushed once we ran Ipconfig /flushdns, we also rebooted the clients...

Dr Klahn..on his comment above, probably thought the 172.16.x.x gets translated when you ping the hostname.
I am not sure Networking team will make that to the printer...

The only thing I have not checked was the Print server, if it has cached an old IP for the printer hostname..even though it does not make sense...but I have seen situations when you flush the DNS on the print server itself. it resolves many issues.
0
 
footechCommented:
I asked about the hosts file because that would explain the different results you see from ping and nslookup.

I don't have any further suggestions.
0
 
DrDave242Commented:
We have a printer on the print server with hostname abcd
Does that mean abcd is the hostname of that printer or the print server?

So which DNS record is correct ?
The simple answer is "The one that matches the actual IP address of abcd." So you might want to check abcd itself before going any further.

Nslookup will only use whatever DNS server you tell it to use. This will be your preferred DNS server unless you specifically tell it to use a different one. As footech said, nslookup won't look at your hosts file. It also won't use an alternate server if the one it queries doesn't respond. If ping is consistently resolving that hostname to a different IP address, it's getting that information from somewhere other than the server nslookup is using. This could be an alternate DNS server, the hosts file, a WINS server, or any of the other methods footech mentioned.

If you want to know for sure where that address is coming from, a packet capture on the client should be very useful. If it shows no name resolution going on at all, then the client has that name cached somewhere locally.
1
 
jskfanAuthor Commented:
Ok...
Let's make it simple.

if from PC1,PC2 (more than one computer)
I ping the abcd I get the IP 172.16.x.x.
and the ping times out
Where could the 172.16.x.x come from?

seeing that if I nslookup the abcd, I get the 10.20.x.x
0
 
omarfaridCommented:
can you try using FQDN (e.g. abcd.domain.con) with ping?

What you get when you run:

nslookup 172.16.x.x

nslookup 10.20.x.x
0
 
jskfanAuthor Commented:
Just a comment to the relation between Ping and NSlookup
Ping always use Nslookup when you ping the Hostname or when you ping IP with -a

ping -a 10.x.x.x
0
 
DrDave242Commented:
I think there's a terminology problem here.

Ping doesn't use nslookup. Ever. Ping and nslookup can both perform name resolution using DNS, but they use different mechanisms to do this.

Nslookup is a command-line tool that does one specific thing: it sends DNS queries to a server and displays the results. It contains its own DNS resolver (DNS client) that behaves differently from the resolver built into Windows.

Ping is a command-line tool that can also perform DNS queries, but it uses the built-in Windows DNS resolver to do so. It also uses other, non-DNS methods to resolve names to IP addresses if DNS resolution is unsuccessful.

One of the key differences between ping and nslookup is that nslookup only queries one specific DNS server, and that's it. It doesn't look at the hosts file, the Windows DNS resolver cache, WINS servers*, or anything else. If you don't tell nslookup which server to use, it will use the first DNS server in the list of servers configured for the Windows resolver. If that DNS server doesn't respond, nslookup tells you that the query timed out. If you want to send the same query to a different server, you have to tell nslookup to use that server; it won't do that automatically.

[*If that DNS server has WINS Forward Lookup enabled and a valid WINS server specified, WINS may ultimately resolve the query. That's controlled by the DNS server, though, not nslookup. And I can't say that I've seen WINS Forward Lookup enabled anywhere in at least a decade.]

The Windows DNS resolver (the one that ping uses) maintains an in-memory cache of records that it has recently resolved. Everything in the machine's hosts file is also in this cache. That's the first place it looks when resolving a query.

Assuming the cache lookup is unsuccessful, the resolver also maintains an in-memory array of DNS servers that it can query. If the first server in that array doesn't respond before a built-in timer expires, it queries the next server, assuming there is one. If there are multiple active NICs in the system and each NIC has more than one DNS server configured, it'll begin querying multiple servers at this point. The array may then be re-prioritized, assuming one of the servers responds. This process is discussed in excruciating detail here by someone who knows more about it than I do.

That's just the DNS part. Nslookup doesn't do anything but DNS, but ping can use a variety of other methods to resolve names, as mentioned already: WINS, the lmhosts.sam file, NetBIOS broadcasts, Link-local multicast name resolution (LLMNR)...and that may be it. That's all I can think of, anyway.

All that can be said for sure, given the information provided, is that ping is obtaining that address from somewhere other than the server that nslookup is using. If it's not cached on the local machine, a packet capture is your best bet at determining where it's coming from.
1
 
jskfanAuthor Commented:
That's What I meant....Ping does the Lookup into DNS ...
The order it does it probably , it looks into resolver , then Hostfile, then DNS server
0
 
jskfanAuthor Commented:
Thank you
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Easily Design & Build Your Next Website

Squarespace’s all-in-one platform gives you everything you need to express yourself creatively online, whether it is with a domain, website, or online store. Get started with your free trial today, and when ready, take 10% off your first purchase with offer code 'EXPERTS'.

  • 8
  • 4
  • 3
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now