2

I have a DNS lookup for an IP that is coming from somewhere however I cannot locate where.

I have checked my entire DNS infrastructure and the device itself but all have the correct name, when I run a 'ping -a "IP address"' it comes back with the incorrect name.

I have flushed my DNS but get same lookup.

ipconfig /displaydns shows the item incorrectly as below:

km3aece9
----------------------------------------
Name does not exist.

But nslookup shows me the correct name:

C:\Users\charles_hurst>nslookup 10.100.9.87
Server:  DC1
Address:  10.100.9.61

Name:    printer10009
Address:  10.100.9.87

Any ideas?

peterh
  • 4,953
  • 13
  • 30
  • 44
CharlesH
  • 344
  • 2
  • 13

1 Answers1

6

No, it is coming from the windows networking, and not from an (originally) ip-based DNS record.

Windows has a complex hostname resolution mechanism, which mixes the DNS record-based host identification with the WINS-based one (which wasn't even IP in the ancient times). This is coming/registered by generally (but not always) by the domain controller of your local network.

This name resolution is now very well integrated with the normal TCP networking, and it is not a real surprise, that you get record from the local dns cache even if you run reverse lookups.

This printer firmware simply registered himself in the local network master browser (which is mostly the local server/domain controller/etc), and used his ip and pre-configured name to do that.

ipconfig /displaydns (which is a microsoft-specific tool) showed you this integrated dns entry cache, but nslookup didn't, because it is a purely tcp/ip based tool.

Here you can read more about the windows name resolution.

peterh
  • 4,953
  • 13
  • 30
  • 44
  • That makes sense! So my solution was to disconnect printer, factory reset, reload zones on DNS and flush DNS (not sure if needed), setup printer from device locally, plug back in to network and let it register DNS and volla no more ugly default name! Thanks for the advise! – CharlesH Aug 15 '14 at 14:22