Jambo_C Posted January 27, 2014 Posted January 27, 2014 Hi, I've three or four PCs that are picking up the wrong IP address for one of my servers. They can browse the server using mapped drives or by going to \\server1 in explorer but when I try to ping the server it attempts "pinging server1 [208.78.55.55]" and fails. The IP address shown is a completely incorrect address that is nothing like anything else on my network. I've looked at the DNS servers and the strange IP doesn't appear anywhere. I'm not sure where these machines have got that IP from? Thanks.
TraineeGeek Posted January 27, 2014 Posted January 27, 2014 Hi, Check there are no static DNS entries in the TCP/IP settings. D
JonDaviesBourne Posted January 27, 2014 Posted January 27, 2014 Hi, Type "ipconfig /flushdns" into an administrative command prompt and see if that resolves it. If not: Go to C:\Windows\System32\Drivers\etc\ and open up the "hosts" file to see if there are any static DNS entries in there on the affected machines. If not: Check on the servers that run DNS (usually 2 of your DCs) and see if they have any static entries in their hosts file. If there were static entries pointing at an external server that you did not put there, you will want to have a look at how and why they got there as it is indicative of cache poisoning.
FN-GM Posted January 27, 2014 Posted January 27, 2014 You can set DNS by group policy as well, might be worth a check. If not i would get Wireshark out and see if the DHCP server is sending out these incorrect addresses.
free780 Posted January 27, 2014 Posted January 27, 2014 I believe the gp method only works for xp clients.
FN-GM Posted January 27, 2014 Posted January 27, 2014 I believe the gp method only works for xp clients. I wouldn't know to be honest. Never needed it.
Jambo_C Posted January 28, 2014 Author Posted January 28, 2014 Hi, Check there are no static DNS entries in the TCP/IP settings. D Hi, Type "ipconfig /flushdns" into an administrative command prompt and see if that resolves it. If not: Go to C:\Windows\System32\Drivers\etc\ and open up the "hosts" file to see if there are any static DNS entries in there on the affected machines. If not: Check on the servers that run DNS (usually 2 of your DCs) and see if they have any static entries in their hosts file. If there were static entries pointing at an external server that you did not put there, you will want to have a look at how and why they got there as it is indicative of cache poisoning. Cheers, I already checked most of this and there's nothing unusual. Genuinely don't see where it's coming from!
3s-gtech Posted January 28, 2014 Posted January 28, 2014 Is that an iSCSI address on a separate card/switch that's somehow ended up connecting into your network?
localzuk Posted January 28, 2014 Posted January 28, 2014 If you do an nslookup on the client getting the odd IP, is the DNS server replying with the same IP or the correct one?
Gatt Posted January 28, 2014 Posted January 28, 2014 Make sure DNS Scavenging is enabled too. Used to get this all the until we enabled this.
Jambo_C Posted January 28, 2014 Author Posted January 28, 2014 If you do an nslookup on the client getting the odd IP, is the DNS server replying with the same IP or the correct one? If I run "nslookup server1" I get the correct IP of the DNS server and then the incorrect IP on server1. Strangely this happens on my PC which actually pings server1 correctly.
localzuk Posted January 28, 2014 Posted January 28, 2014 OK. That means that the record exists somewhere on your DNS server then, rather than it being a client issue.
Jambo_C Posted January 28, 2014 Author Posted January 28, 2014 OK. That means that the record exists somewhere on your DNS server then, rather than it being a client issue. I've looked all over on both DNS servers and cannot see this record anywhere. I've ran a Wireshark capture and there's no mention of this IP address on that either.
localzuk Posted January 28, 2014 Posted January 28, 2014 What DNS server do your internal DNS servers forward to? Have you tried an nslookup direct to the upstream DNS server?
sparkeh Posted January 28, 2014 Posted January 28, 2014 Well that's a public IP address right?. Check your forwarding config. Here's some lookups on that IP: IP Address Lookup - Whois by IP Address | Whois.net Network Tools: DNS,IP,Email
Jambo_C Posted January 28, 2014 Author Posted January 28, 2014 What DNS server do your internal DNS servers forward to? Have you tried an nslookup direct to the upstream DNS server? The forwarders are all as they should be. They're the ones provided by our ISP. They all nslookup fine too.
localzuk Posted January 28, 2014 Posted January 28, 2014 So, if the nslookup from the forwarder DNS servers is correct, then that isolates the local DNS servers as the source of the issue.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now