Rogue Host (A) Record

[Geates]

This is bazzar! It seems as though there is a rogue A record somewhere on my domain.

My XP client, B-105699, pings and resolves to 10.15.60.72.

A reverse ping of this IP (ping -a 10.15.60.72) resolves to my virtual XP machine, B-136620v. This machine has been off for about 10 days.

My DNS servers do not have an A record for either B-105699 or B-136620v BUT they do have an A record for B-088956, which points to 10.15.60.72.

I use Cisco routers without any DNS capabilities enabled. DHCP leases are 8 hours. Where is this name resolution coming from!?

Here's a command block:

*************************
>ping B-105699

Pinging B-105699.nmh.nmrhs.net [10.15.60.72] with 32 bytes of data:
Reply from 10.15.60.72: bytes=32 time=1ms TTL=128

>ping -a 10.15.60.72

Pinging b-136620v.nmh.nmrhs.net [10.15.60.72] with 32 bytes of data:
Reply from 10.15.60.72: bytes=32 time<1ms TTL=128

>ipconfig /flushdns

Windows IP Configuration
Successfully flushed the DNS Resolver Cache.

*** Waited 30 minutes ***

>ping b-105699

Pinging b-105699.nmh.nmrhs.net [10.15.60.72] with 32 bytes of data:
Reply from 10.15.60.72: bytes=32 time<1ms TTL=128

>ping -a 10.15.60.72

Pinging b-136620v.nmh.nmrhs.net [10.15.60.72] with 32 bytes of data:
Reply from 10.15.60.72: bytes=32 time<1ms TTL=128

**************************************

-dmjones

 

[NetIntruder]

Go take a look on your DNS server's Reverse zone and find your records for 10.15.60.72 and you will likely find one record for each machine you listed. Remove the bad one and try again.

~Intruder~
CREA,CISSP,CEH,CEPT,MCSE,MCSA,GWAS,GCWN