Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a DNS lookup for an IP that is coming from somewhere however I cannot locate where.

I have checked my entire DNS infrastructure and the device itself but all have the correct name, when I run a 'ping -a "IP address"' it comes back with the incorrect name.

I have flushed my DNS but get same lookup.

ipconfig /displaydns shows the item incorrectly as below:

km3aece9
----------------------------------------
Name does not exist.

But nslookup shows me the correct name:

C:\Users\charles_hurst>nslookup 10.100.9.87
Server:  DC1
Address:  10.100.9.61

Name:    printer10009
Address:  10.100.9.87

Any ideas?

share|improve this question
    
Are you sure it's dns and not the local hosts file? –  Dennis Kaarsemaker Aug 15 at 10:43
    
Does it from multiple machines I'm afraid :( –  CharlesH Aug 15 at 11:07
1  
You may have multiple PTR records for 10.100.9.87? If it is a windows DNS server, look under ReverseLookupZones, 9.100.10.in-addr.arpa –  dusan.bajic Aug 15 at 12:31

1 Answer 1

up vote 5 down vote accepted

No, it is coming from the windows networking, and not from an (originally) ip-based DNS record.

Windows has a complex hostname resolution mechanism, which mixes the DNS record-based host identification with the WINS-based one (which wasn't even IP in the ancient times). This is coming/registered by generally (but not always) by the domain controller of your local network.

This name resolution is now very well integrated with the normal TCP networking, and it is not a real surprise, that you get record from the local dns cache even if you run reverse lookups.

This printer firmware simply registered himself in the local network master browser (which is mostly the local server/domain controller/etc), and used his ip and pre-configured name to do that.

ipconfig /displaydns (which is a microsoft-specific tool) showed you this integrated dns entry cache, but nslookup didn't, because it is a purely tcp/ip based tool.

Here you can read more about the windows name resolution.

share|improve this answer
    
That makes sense! So my solution was to disconnect printer, factory reset, reload zones on DNS and flush DNS (not sure if needed), setup printer from device locally, plug back in to network and let it register DNS and volla no more ugly default name! Thanks for the advise! –  CharlesH Aug 15 at 14:22
    
@CharlesH Thanks :-) –  Peter Horvath Aug 15 at 14:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.