-1

I need assistance in a reverse lookup issue. I have a server say XYZ.ABC.COM having an IP 10.20.30.40. If I ping the server, it is resolving to the correct IP.

On reverse ping (i.e ping -a 10.20.30.40), it resolves to the domain name and not the server name

C:\bin>ping  -a 10.20.30.40

Pinging ABC [10.20.30.40] with 32 bytes of data:
Reply from 10.20.30.40: bytes=32 time=4ms TTL=57
Reply from 10.20.30.40: bytes=32 time=4ms TTL=57
Reply from 10.20.30.40: bytes=32 time=6ms TTL=57
Reply from 10.20.30.40: bytes=32 time=4ms TTL=57

On NBTSTAT -a 10.20.30.40, below are the results

       NetBIOS Remote Machine Name Table

   Name               Type         Status
---------------------------------------------
ABC     <00>  GROUP       Registered
XYZ     <00>  UNIQUE      Registered
XYZ     <20>  UNIQUE      Registered

MAC Address = 00-15-5D-A6-88-05

As far as I know the Nbtstat -a 10.20.30.40 should be as below

       NetBIOS Remote Machine Name Table

   Name               Type         Status
---------------------------------------------
XYZ     <00>  UNIQUE      Registered
ABC     <00>  GROUP       Registered
XYZ     <20>  UNIQUE      Registered

MAC Address = 00-15-5D-A6-88-05

Kindly help me in fixing this issue and want to resolve the correct server name XYZ on reverse ping

HopelessN00b
  • 53,385
  • 32
  • 133
  • 208
Dragan Kidovic
  • 147
  • 1
  • 2
  • 10
  • You need to use the nslookup command instead of nbtstat. Offhand, I'd say there's something wonky with your reverse DNS tables - look in the 30.20.10.in-addr.arpa table, the 40 address should be a PTR to "xyz.abc.com.". – John Feb 05 '13 at 13:48
  • Why are you using NETBIOS? Don't do that; it's not the 90's anymore. – HopelessN00b Feb 05 '13 at 15:27
  • I could not find any PTR record for this entry in DNS. – Dragan Kidovic Feb 05 '13 at 16:15

2 Answers2

1

nbstat is not a reverse [DNS] lookup. nbstat uses NETBIOS name resolution, which you really shouldn't be using for anything anyway. If at all possible, disable NETBIOS entirely, and use DNS instead.

The command you're looking for to do a reverse DNS lookup is nslookup 10.20.30.40, not nbstat.

In any event, in a Windows environment, when an IP resolves to the domain rather than a server, you're looking at a Domain Controller, and that's expected behavior. If the server isn't actually a Domain Controller, then you should take a look at your reverse DNS entries (PTR records), which you can find under Reverse Lookup Zones --> 30.20.10.in-addr.arpa in the DNS Manager. You can just change the PTR to the correct value, or delete both the forward and reverse entries and recreate them, if you prefer.

HopelessN00b
  • 53,385
  • 32
  • 133
  • 208
  • I could not find any PTR record in DNS nslookup – Dragan Kidovic Feb 05 '13 at 16:16
  • @RoshanRaikar Then add one. Not sure why it's a big deal for you (doubt it'd be worth my time), but it's not hard to add a reverse DNS entry either. Just select the desired zone, right click, and it's pretty self explanatory from there. – HopelessN00b Feb 05 '13 at 18:11
  • If it was a question of a few entries, I would have done that.. I have around 400+ servers having this issues.. – Dragan Kidovic Feb 06 '13 at 14:50
0

Make sure your reverse DNS tables have the entries, PTR addresses are not all automatically created.

Juan
  • 1