3

On my local network, I have multiple computers that I connect to. I don't typically remember the IP address nor do I care. This morning, I went to RDP put "Sam" in the field and pressed enter. It wouldn't connect so I opened up a command prompt to see if I could ping her computer and got something I have never seen before. 

C:\Documents and Settings\wbeard52>ping sam  
Pinging sam.WORKGROUP [67.215.65.132] with 32 bytes of data:  
Reply from 67.215.65.132: bytes=32 time=51ms TTL=56

Obviously, I have a computer named "sam" on the local network and I cam RDP into her computer with her IP address (not the one listed here). I don't have anything in the routing table that I can see.

wbeard52>route print
===========================================================================  
Interface List  
0x1 ........................... MS TCP Loopback interface  
0x2 ...00 0e 35 a5 6f b2 ...... Intel(R) PRO/Wireless 2200BG Network Connection  
- Packet Scheduler Miniport  
===========================================================================  
===========================================================================  
Active Routes:  
Network Destination        Netmask          Gateway       Interface  Metric  
          0.0.0.0          0.0.0.0   192.168.52.208  192.168.52.152       10  
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1  
     192.168.52.0    255.255.255.0   192.168.52.152  192.168.52.152       10  
   192.168.52.152  255.255.255.255        127.0.0.1       127.0.0.1       10  
   192.168.52.255  255.255.255.255   192.168.52.152  192.168.52.152       10  
        224.0.0.0        240.0.0.0   192.168.52.152  192.168.52.152       10  
  255.255.255.255  255.255.255.255   192.168.52.152  192.168.52.152       1  
Default Gateway:    192.168.52.1  
===========================================================================  
Persistent Routes:  
  None

What would be causing the ping to be sent to an IP address in San Francisco?

ChrisF
  • 41,262
wbeard52
  • 3,447
  • 5
    You using OpenDNS? Looks like it resolves to one of their servers and they are in San Francisco. What do you get for ping blah and ping whatever? – hyperslug Sep 12 '10 at 16:51
  • (I'm assuming you don't have machines named blah and whatever) – hyperslug Sep 12 '10 at 16:52
  • I am using openDNS. This is interesting. Why is it that it started doing this now and not before. I've used openDNS for quite awhile now? – wbeard52 Sep 12 '10 at 22:55
  • Dunno. Sounds like some kind of DNS caching. If so, ipconfig/flushdns would help. – hyperslug Sep 13 '10 at 10:57

3 Answers3

6

I'm pretty sure that @hyperslug has hit it on the head. When using OpenDNS as your DNS provider, if you try to resolve an unknown name, they'll return an IP address that "redirects" your browser to their branded "results" page. You'll never see a "404" page when using OpenDNS.

If you were to use your ISPs DNS servers and you tried to PING sam, you'd get:

C:\>ping sam
Ping request could not find host sam. Please check the name and try again.

To fix this (assuming that you want to resolve sam by name and not have to type in an IP address), you'll need to place an entry in your HOSTS file for 'sam'.

From your routing table, I can see that you are on network 192.168.52.x, and that your computer is 192.168.52.152. I can also see that your default gateway is 192.168.52.1. You haven't mentioned what the IP address of sam is. For the purposes of this exercise, we'll assume that sam is 192.168.52.201.

I'm assuming that your environment is Windows for what follows. You'll want to edit the file %windir%\system32\drivers\etc\hosts. If you've never used the hosts file, you'll probably first have to rename %windir%\system32\drivers\etc\hosts.sam to %windir%\system32\drivers\etc\hosts.

Open the file in your favorite text editor (such as Notepad) and you'll see something very similar to:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

At the end of the hosts file, add a line:

192.168.52.201  sam

Save the file and you're done.

BillP3rd
  • 6,465
  • 2
  • 30
  • 39
  • I took my laptop to my parents house yesterday and connected to their wireless network. I have an IBM T42 and use the IBM Access Connections. When I turned on my laptop this morning, it automatically connected but obviously something didn't transfer with the name resolution. I disconnected via access connections and reestablished the connection and the issue is gone. It's quite interesting to me. I am using openDNS, it's interesting that was part of the issue. – wbeard52 Sep 12 '10 at 22:58
  • 1
    I suspect that what you're seeing is that different DNS servers are being delivered (via DHCP). When you're at home and type ipconfig /all and compare the results (for DNS servers) to the same when you're at your parent's house. I suspect that your home router is set up to serve the OpenDNS servers while that at your parent's probably serves their ISPs. All of this assumes that your computer is set up to receive its IP address automatically (i.e. DHCP is enabled). – BillP3rd Sep 12 '10 at 23:10
  • That is exactly the case. I have openDNS and my parents do not. I don't quite understand it. Perhaps when Access Connections reconnected to my home network it didn't update the DNS server information? DHCP is enabled on my laptop. – wbeard52 Sep 13 '10 at 02:42
  • Since you confirm that DHCP is enabled on your laptop, the values it receives for its DNS servers come from the router (DHCP server) that serves your IP address. The DNS servers would always be updated when a new DHCP lease is obtained. A workaround for the "problem" would be to configure your laptop to use static DNS servers. (i.e. You tell it to use the ones you designate, not what the DHCP server suggests.) – BillP3rd Sep 13 '10 at 04:52
  • A nitpick: You will see 404s with OpenDNS. A 404 is a web server telling you it doesn't have a page with the name you asked for. OpenDNS redirects you when the domain name is unknown (so the's no web server to send a 404), not when the server at that name can't find the page you asked for. – Peeja May 08 '14 at 18:58
0

What's the setting for your WINS server? An "IPCONFIG /ALL" command should show your Windows WINS settings. I understand "ping sam" would trigger your WINS server rather than your DNS server.

sabre23t
  • 226
  • WINS doesn't come into play on a home network and has been more-or-less obsolete since Windows 2000. Prior to Win2K, WINS was used for NetBIOS name resolution. Beginning with Win2K, DNS became the preferred mechanism for NetBios name resolution. Generally, WINS is only required for pre-Win2K clients (Win95, Win98, WinME, WinNT). – BillP3rd Sep 12 '10 at 23:15
0

pathping 67.215.65.132 and pathping sam can help you identify which network route the packets take.

nslookup sam will determine which DNS server is pointing you to that IP adress.

nslookup 67.215.65.132 checks the reverse way of DNS lookup (check if it matches!).

nslookup <DNS-server-ip-addres> and nslookup <DNS-server-name> checks the supposed DNS server. Does it belong to OpenDN?

nbtstat -n shows local NetBIOS names.

nbtstat -r shows names resolved by broadcast and/or WINS.

nbtstat -S and nbtstat -s show session tables (with target IP adresses or names).

nbtstat -RR refreshes your WINS by first releasing names.

Kurt Pfeifle
  • 12,621
  • Never heard of pathping, although it seems to be a lesser version of traceroute. Whats the difference? – TheLQ Sep 12 '10 at 20:20
  • Pathping is sort of ping plus tracert. You can read about its capabilities at http://en.wikipedia.org/wiki/PathPing – BillP3rd Sep 12 '10 at 23:20