2

I need to investigate what clients connected to my application and I am using the netstat command for this. I noticed that sometimes it does not report me the correct machine name.

Why this is happening? Is there a better way to get the list of clients connected to my server?

gyurisc
  • 139
  • 2
  • 11

1 Answers1

2

I believe netstat is getting the IP address of the connected host and doing a reverse-DNS lookup on that address (I know that's how Unix netstat works, I suspect that's how Windows netstat works).

So first, the network name does not necessarily bear any relationship to the machine name. Second, inside DNS, network names and addresses have many-to-many relationships. That is, a given name lookup may return a list of addresses and an address lookup may return a list of names -- but the order of the entries on the lists may be different, and the lists may not match. Further, it's not uncommon that software doesn't handle DNS list answers correctly and only uses the first item on the list.

Thus, your concept of what the "correct" name for the network connected host is may not match what the DNS administration of that host feels is the "correct" name. You may both be right, from your different perspectives, but since you're getting the name from a DNS lookup, the DNS answer is what you get.

mpez0
  • 1,512
  • 9
  • 9
  • Thanks. What can be a reliable way to get the hostname that currently has that ip address? – gyurisc Mar 11 '10 at 08:45
  • You may be missing my main point: there is not necessarily a singular hostname associated with that IP address. However, `nslookup` is the utility to do DNS lookups -- including reverse lookups -- for Windows and Unix systems. Just do `nslookup ` in a command prompt window. – mpez0 Mar 11 '10 at 13:11