11

I have been given the task of changing our current file server's IP address. I haven't been in the company long, so don't know what exactly reads and writes to it yet.

Is there any way that I can tell if connections are being made to it by the IP address instead of the name?

MDMarra
  • 100,183
  • 32
  • 195
  • 326
Chris Robinson
  • 111
  • 2
  • 17
    Yeah. Change the IP address and see if people complain :-P – MDMarra Oct 25 '12 at 15:18
  • as @MDMarra pointed out thats the easiest way :) – Zapto Oct 25 '12 at 15:18
  • I joke, of course. I'd actually like to know the answer to this as well. – MDMarra Oct 25 '12 at 15:19
  • 1
    No seriously, change the server's IP address, make sure your company's DNS A record for that server is current with the new information, and then see who complains. MDMarra may be on the right track with this. – Jason Oct 25 '12 at 15:40

3 Answers3

25

You could add a second IP address to the system and point the DNS name at that new IP address. The server will still talk on both IPs, so none of your users will be disrupted, but you will know that anyone connecting on the old IP is not using DNS.

Dan
  • 737
  • 5
  • 11
2

I actually looked into this at $job-1. I never did find a way to address this in the windows event logs natively but I did come up with an interesting workaround which may be of some use. Using file system auditing you can get the source IP and username for each access that takes place. I'm assuming you are running AD with integrated DNS with WINS disabled. If so you can export the logs for your DNS queries.

It is possible to pump both of these logs into a Splunk instance and cross correlate any source IPs which haven't made a DNS request but that have hit your file server. From there all you need to do is verify that there isnt HOSTS file in use.

All that being said in mist environments it is way easier to just make the change and see who complains.

Tim Brigham
  • 15,465
  • 7
  • 72
  • 113
0

I'd take a creative approach and bind the server's IP to a separate folder with a text-document, like "README". People will be curious and open it... then I'd just tell them to stop using the server's IP and instead use the server's name. They'll be forced to change it to see the new files anyways, so you should be able to get everyone to switch.

And then just have the regular FTP server binded to the name. Should be possible, 'ey? As for a programmable way of figuring it out, that's a really good question.

EDIT: not too sure on how it works on Windows, but if you have an FTP running on the IP and the name of the server, you should be able to view the logs too and see which server is being accessed by what IP. Although this is coming from a Linux guy. :p

Taylor Jasko
  • 686
  • 4
  • 13