Ping [computer] get strange IP address

Question

On my local network, I have multiple computers that I connect to. I don't typically remember the IP address nor do I care. This morning, I went to RDP put "Sam" in the field and pressed enter. It wouldn't connect so I opened up a command prompt to see if I could ping her computer and got something I have never seen before.

C:\Documents and Settings\wbeard52>ping sam  
Pinging sam.WORKGROUP [67.215.65.132] with 32 bytes of data:  
Reply from 67.215.65.132: bytes=32 time=51ms TTL=56

Obviously, I have a computer named "sam" on the local network and I cam RDP into her computer with her IP address (not the one listed here). I don't have anything in the routing table that I can see.

wbeard52>route print
===========================================================================  
Interface List  
0x1 ........................... MS TCP Loopback interface  
0x2 ...00 0e 35 a5 6f b2 ...... Intel(R) PRO/Wireless 2200BG Network Connection  
- Packet Scheduler Miniport  
===========================================================================  
===========================================================================  
Active Routes:  
Network Destination        Netmask          Gateway       Interface  Metric  
          0.0.0.0          0.0.0.0   192.168.52.208  192.168.52.152       10  
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1  
     192.168.52.0    255.255.255.0   192.168.52.152  192.168.52.152       10  
   192.168.52.152  255.255.255.255        127.0.0.1       127.0.0.1       10  
   192.168.52.255  255.255.255.255   192.168.52.152  192.168.52.152       10  
        224.0.0.0        240.0.0.0   192.168.52.152  192.168.52.152       10  
  255.255.255.255  255.255.255.255   192.168.52.152  192.168.52.152       1  
Default Gateway:    192.168.52.1  
===========================================================================  
Persistent Routes:  
  None  

What would be causing the ping to be sent to an IP address in San Francisco?

Answer 1

I'm pretty sure that @hyperslug has hit it on the head. When using OpenDNS as your DNS provider, if you try to resolve an unknown name, they'll return an IP address that "redirects" your browser to their branded "results" page. You'll never see a "404" page when using OpenDNS.

If you were to use your ISPs DNS servers and you tried to PING sam, you'd get:

C:\>ping sam
Ping request could not find host sam. Please check the name and try again.

To fix this (assuming that you want to resolve sam by name and not have to type in an IP address), you'll need to place an entry in your HOSTS file for 'sam'.

From your routing table, I can see that you are on network 192.168.52.x, and that your computer is 192.168.52.152. I can also see that your default gateway is 192.168.52.1. You haven't mentioned what the IP address of sam is. For the purposes of this exercise, we'll assume that sam is 192.168.52.201.

I'm assuming that your environment is Windows for what follows. You'll want to edit the file %windir%\system32\drivers\etc\hosts. If you've never used the hosts file, you'll probably first have to rename %windir%\system32\drivers\etc\hosts.sam to %windir%\system32\drivers\etc\hosts.

Open the file in your favorite text editor (such as Notepad) and you'll see something very similar to:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

At the end of the hosts file, add a line:

192.168.52.201  sam

Save the file and you're done.

Answer 2

What's the setting for your WINS server? An "IPCONFIG /ALL" command should show your Windows WINS settings. I understand "ping sam" would trigger your WINS server rather than your DNS server.

Answer 3

pathping 67.215.65.132 and pathping sam can help you identify which network route the packets take.

nslookup sam will determine which DNS server is pointing you to that IP adress.

nslookup 67.215.65.132 checks the reverse way of DNS lookup (check if it matches!).

nslookup <DNS-server-ip-addres> and nslookup <DNS-server-name> checks the supposed DNS server. Does it belong to OpenDN?

nbtstat -n shows local NetBIOS names.

nbtstat -r shows names resolved by broadcast and/or WINS.

nbtstat -S and nbtstat -s show session tables (with target IP adresses or names).

nbtstat -RR refreshes your WINS by first releasing names.