Brainfreeze: Can ping but nslookup does not work?
Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: Brainfreeze: Can ping but nslookup does not work?

  1. #1
    Senior Member
    Join Date
    Jan 2005
    Posts
    100

    Brainfreeze: Can ping but nslookup does not work?

    Hello all-

    My brain freezed on this one. I am trying to verify some servers site admin give me a list of and some are coming up that nslookup cannot find in DNS, but I can ping them. The site admin provided me the names and ips as part of the information I requested to start their upcoming audit, and I tried nslookup with the ip and the hostname. Again - most of the servers worked - but two did not - and all are on the same subnet. I know I should know this, but please have mercy and let me know why this is happening? ARPcache? DNS not updated? Something else?

    Also - if someone can google a problem like this - could you share the search string please? I was not even sure how to word this issue in a couple words or less.

    I hate this feeling - the feeling like you know something about networks and then something like this just pushes you off your little ego mountain. Damm!t! Well back to my picture books.

    TIA.
    \"An ant may well destroy a whole dam.\" - Chinese Proverb
    \"Not only can water float a craft, it can sink it also.\" - Chinese Proverb

    http://www.AntiOnline.com/sig.php?imageid=764

  2. #2
    Senior Member RoadClosed's Avatar
    Join Date
    Jun 2003
    Posts
    3,834
    I am assuming your IP config is set to the correct name server and that same name server pops up in nslookup when you enter the console? If that is the case, I would look at the entrys in the DNS server, maybe they are not part of the directory, again assuming you are in a directory network. Or there are replication issues if they are part of the domain.

    You can view your local arp just to eliminate that factor if you like. c:>arp -a But you should only see your machine and the proper DNS server in their.
    West of House
    You are standing in an open field west of a white house, with a boarded front door.
    There is a small mailbox here.

  3. #3
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    Probably a really silly question but I like to start with the obvious.

    Is the DNS service on those two servers actually running or have they been disabled, crashed at start or stopped providing DNS resolution?
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  4. #4
    Senior Member
    Join Date
    Jul 2004
    Posts
    469
    When you say you're able to ping them but not nslookup them up, are you pinging their IP or their DNS name?

  5. #5
    AO Senior Cow-beller
    Moderator
    zencoder's Avatar
    Join Date
    Dec 2004
    Location
    Mountain standard tribe.
    Posts
    1,177
    KuiXing, I've seen this before...

    IIRC, the nslookup command will ALWAYS go to the DNS server and ask for a response...but if you have a host file with entries, the ping (or any other network command) may get its address from there, depending on resolve configurations. Have you flushed the local dns cache and tried again?
    "Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
    Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
    "...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore

  6. #6
    Senior Member
    Join Date
    Jan 2005
    Posts
    100
    Hello all-

    My apologies for not replying earlier.

    Ok:

    I am assuming your IP config is set to the correct name server and that same name server pops up in nslookup when you enter the console? If that is the case, I would look at the entrys in the DNS server, maybe they are not part of the directory, again assuming you are in a directory network. Or there are replication issues if they are part of the domain.
    Yes - I am pointing to the correct name server. I am able to nslookup the other machines in the list.

    However - I will need to contact the admin to see if the servers are in the domain - thanks!

    Probably a really silly question but I like to start with the obvious.
    Is the DNS service on those two servers actually running or have they been disabled, crashed at start or stopped providing DNS resolution?
    Ahhh - good question - you're right - basic and yet quite true - something to check with the SA.

    When you say you're able to ping them but not nslookup them up, are you pinging their IP or their DNS name?
    Did both - on two of the servers (they are W2K) I can ping by ip by not hostname.

    IIRC, the nslookup command will ALWAYS go to the DNS server and ask for a response...but if you have a host file with entries, the ping (or any other network command) may get its address from there, depending on resolve configurations. Have you flushed the local dns cache and tried again?
    Hmm - nope will ask the SA about that if the above does not work - I may have to approach Networking as well.

    FYI - I have to check with the SA group on all of these because as an auditor, as many of you know, I do not and should not have everyday access to any servers or workstations; outside of my group. My follow-up will also be interesting to see how the site responds to questioning.

    Thank you all for your suggestions - I am will be firing off a few notes to see where it takes me. I will let you know what happens.
    \"An ant may well destroy a whole dam.\" - Chinese Proverb
    \"Not only can water float a craft, it can sink it also.\" - Chinese Proverb

    http://www.AntiOnline.com/sig.php?imageid=764

  7. #7
    AO Senior Cow-beller
    Moderator
    zencoder's Avatar
    Join Date
    Dec 2004
    Location
    Mountain standard tribe.
    Posts
    1,177
    FYI - I have to check with the SA group on all of these because as an auditor, as many of you know, I do not and should not have everyday access to any servers or workstations; outside of my group. My follow-up will also be interesting to see how the site responds to questioning.
    This is an excellent opportunity to do a little auditing on social-engineering-resistance.
    "Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
    Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
    "...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore

  8. #8
    Senior Member
    Join Date
    Jan 2005
    Posts
    100
    This is an excellent opportunity to do a little auditing on social-engineering-resistance.
    In my best Montgomery Burns voice: "Yesssss - Excelllllent"

    From the Marathon Man: "So tell me, is it safe (dental drill winds up)?"
    \"An ant may well destroy a whole dam.\" - Chinese Proverb
    \"Not only can water float a craft, it can sink it also.\" - Chinese Proverb

    http://www.AntiOnline.com/sig.php?imageid=764

  9. #9
    AO's MMA Fanatic! Computernerd22's Avatar
    Join Date
    Mar 2003
    Location
    Miami, FL
    Posts
    795
    Have you tried using these in the command prompt


    ipconfig /flushdns
    ipconfig /displaydns

    Perhaps reseting the TCP/IP Stack by clicking start, run, type: "netsh int ip reset resetlog.txt", also, flush the DNS by using "ipconfig /flushdns",

    Did both - on two of the servers (they are W2K) I can ping by ip by not hostname.
    If you can ping by IP address but not by the hostname, then your winsock file is corrupted. To fix this: Click on start go to run, enter: netsh winsock reset, If entered correctly then you will see the command prompt come up then disappear after that reboot PC. Hope this helps, Computernerd22

  10. #10
    Senior Member RoadClosed's Avatar
    Join Date
    Jun 2003
    Posts
    3,834
    As an auditor I would wager the possibility that you are NOT part of the domain. And therefore Windows is ignoring your DNS requests. Therefore you MUST ping the fully qualified domain name. That would equate to something like Host1.domain.com versus just pinging Host1.

    Just a guess though.
    West of House
    You are standing in an open field west of a white house, with a boarded front door.
    There is a small mailbox here.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •