DNS query result strange host name

[Simonchtan]

Hi,

I have a AD DNS server. on certain case where i ping internal host it return me a internet address.
Only when i run ipconfig /flushdns with then my dns query return the correct address
Wat is wrong with my DNS and how i pervent it.

Example:
My Host IP 192.168.100.100

I PING REMOTEHOST001
Result return Ping

http://WWW.ABC.COM

[IP 123.123.123.123]

IPCONFIG /FLUSHDNS
I PING REMOTEHOST001
Result return Ping REMOTEHOST001 [IP 192.168.100.100]



I know no voice, i know not systems,
i know nuts on networking, because I dont know anything!
------------------------------------
Error Message:System Fatal Failure, Please check the connection between the chair and the Keyboard/mouse.
©2003,2004 SCHT.

 

[jbud]

It would seem that your dns cache is either getting corrupted or poisoned.

From where are your running the ping and ipconfig comnmands? The DNS server?

What service pack level is your DNS server running?

 

[Simonchtan]

Hi Jbud,

I understand that the DNS is being corrupted however i also believe the source of the corruption is from internal.

I run the ping and ipconfig at any host within my domain but strangly the remote always seems to be the same system.

As for the SP, I install SP4 in win2k. is there any other patch that address this problem?

I know no voice, i know not systems,
i know nuts on networking, because I dont know anything!
------------------------------------
Error Message:System Fatal Failure, Please check the connection between the chair and the Keyboard/mouse.
©2003,2004 SCHT.

 

[jbud]

Last questions:

I run the ping and ipconfig at any host within my domain but strangly the remote always seems to be the same system.

So, the remote system whose name is getting corrupted - this is an internal host? If so, what OS is it running? Do you have a static IP and DNS entry for it or is it using DHCP?

Previous to SP2, the networks I was working on seemed to have dns pollution issues on a daily basis. It seems to be getting much better, recently. The last DNS issue I saw involved MS W2K secondaries incrementing the zone serial number, but that was fixed (alledgedly) in SP4.

 

[Simonchtan]

Hi,

The remote host is actually a Win98SE is has a DHCP client from my AD server. it is a internal host within my LAN.

I know no voice, i know not systems,
i know nuts on networking, because I dont know anything!
------------------------------------
Error Message:System Fatal Failure, Please check the connection between the chair and the Keyboard/mouse.
©2003,2004 SCHT.

 

[jbud]

So, the DHCP server should be performing updates to the DNS server for this particular host. I think this is the problem. There are lots of things like this in the kbase:

Microsoft Windows 98-based computers, however, place their NetBIOS information into the Host field, so the DHCP server updates the DNS server with the Windows 98 NetBIOS name information, and not the DNS host name information.

I would check the NetBIOS name of this W98 workstation for funny characters (I can't quote the DNS rfc right now). I would then consider logging DHCP events related to this host (do some ipconfig /release & /renew) to see what happens.

I'm sorry I don't have anything more specific right now.

 

[Simonchtan]

Hi Jbud,

thanks for the info. though i sure that the system do not have funny char in the netbois name. however the last time i discover that the corrupted reply address is actually a porn site ip.

I may believe my DNS may being DNS poisoned by some means. to make thing worst that system seem to be the only 1 that get the corrupted.

but nevertheless thanks, i have to burn the log file and drink it down.....

I know no voice, i know not systems,
i know nuts on networking, because I dont know anything!
------------------------------------
Error Message:System Fatal Failure, Please check the connection between the chair and the Keyboard/mouse.
©2003,2004 SCHT.