DNS/resolution issue...

[Dwyane Everts_1]

All,

I'm seeing something strange, and would like some input as to why this is happening, and more importantly, how to correct it.

Currently, we use telnet through a terminal emulator to access an HPUX server application. We recently migrated to Active Directory for our windows environment. As such, I began getting this error for my remote laptop users:

Jan 9 07:43:50 telnetd[14214]: gethostbyaddr: ..com != xxx.xxx.xxx.xxx

When I conduct an nslookup/dig from the server against the laptop name, I get an IP entry for the laptop that belongs to the last location the laptop was located.

Example:
- gethostbyaddr = IP of location 1
- laptop user (travelling sales) leaves and goes to next location
- laptop acquires new IP for location 2
- laptop reports location 2 IP, DNS still reports location 1 IP

Can anyone explain why? And how to correct?

Hope this made sense...
Dwyane

[Todd Whitcher]

Hi Dwayne,

That error means that telnetd did a reverse lookup (DNS PTR RECORD) on the laptops hostname (DNS A RECORD) and it does not equal (!=)the IP that is returned from the DNS server. A lot of UNIX applications do reverse lookups on remote systems when they connect.

It sounds like your DNS dynamic updates are not working to your Active directory DNS servers in-addr.arpa database records aka PTR/ aka Reverse lookup databases.

I'm not a AD DNS guru but I know that by default the AD DNS servers to not create in-addr.arpa (PTR) record db files. Its easy to create them if thats the case.

It sounds like your Active directory DNS servers do have the in-addr.arpa db files created but possibly are not set up for dynamic updates from your DHCP server? I'd confirm both w/ the administrator.

I would ask the AD DNS admin to review the PTR databases to make sure they been set up to allow dynamic updates (allow-udpate statements) for the in-addr.arpa database files aka PTR records aka Reverse lookup database.

They are probably set up for the Address record database so compairing the two should shed some light on the issue.

Hope this helps.

Todd

[john kingsley]

I wonder if it is a DHCP lease issue. Your laptop is probably getting it's IP through DHCP. You may be reconnecting to the domain before the lease for the original location expires. This could create a conflict.

From your windows command prompt, run:
ipconfig /all

If your are using dhcp, this will show your lease times. At my site, the lease times are for one day.

[Dwyane Everts_1]

John, and Todd...

You are both correct (after t-shooting with the AD admin).

The problem is...the lease is not being released when a DHCP device leaves the network.

Is there a way to configure DHCP devices to release their IPs when they logout of the network?

Dwyane

[Geoff Wild]

You could configure a batch job to do an:

ipconfig /release

Rgds...Geoff

[john kingsley]

I think the easiest solution is to shorten your lease time.

[Dwyane Everts_1]

The lease time is already at 120 minutes.

This issue doesn't appear to be causing any adverse problems. Does anyone know of a reason why I shouldn't turn the notification off? Is there a way to turn it off?

"Out of sight, out of mind," right?

Dwyane

[Todd Whitcher]

I am not aware of any way to tell telnetd to not do reverse lookups or to not log those messages.

Maybe have the AD admin fix the issue w/ the DNS servers configuratino to allow the DHCP servers to update the the in-addr.arpa databases...that would solve the root problem.

[Dwyane Everts_1]

The DHCP updates isn't as easy as you think. These laptops are obtaining an IP from the VPN Concentrator (config'd with a lease for 120 minutes), then its up to the laptop to register with DNS. The problem is, when a laptop is shutoff, the lease isn't releasing.

If I can't turn off the notifications, the only alternative is Geoff's idea. Problem with that is getting laptops to do it as part of both a logout script and/or shutdown procedure.

Dwyane

[Todd Whitcher]

Hi Dwyane,

Sorry to hear that. I know that HP has done some enhancements to some remsh to disable reverse lookups with a -s option but nothing for telnetd to date. There have been enhancement requests in the past that were denied.

I've worked w/ some VPN devices thats are DDNS aware, you may want to see if thats possible.

Sorry I dont have any alternate suggestions.

Good Luck

[john kingsley]

Check the settings on your laptop's network connection and make sure it's setup to register your network connection in DNS.

Start -> Settings -> Network Connetions

Select nework connection -> right mouse click properties. Select "Internet Protocol(TCP/IP)" -> properties -> Advanced... -> DNS. At the bottom you should see a "Register this connection's addresses in DNS" checkbox.

[Dwyane Everts_1]

John,

These settings are all set as part of our "Ghost" image. The laptops are registering, but not releasing. And that is causing multiple IP assigned to the same name.

Dwyane

[Todd Whitcher]

Hi Dwayne,

Not to beat a dead horse, but does the AD DNS admin see the update that the laptop makes when it aquires the second ip address?

Example:
- gethostbyaddr = IP of location 1
- laptop user (travelling sales) leaves and goes to next location
- laptop acquires new IP for location 2
- laptop reports location 2 IP, DNS still reports location 1 IP


If DNS is still reporting the location 1 then it was never updated w/ the new IP address?

I think its worth confirming.

[Dwyane Everts_1]

What we have discussed here:

1. Remote users (VPN, laptops) connect to a VPN Concentrator; which, issues the DHCP address with a 120 minute lease
2. The laptops then register their IP with DNS/AD

3. The user logs out or shuts down, but the IP doesn't get released. Nor, does the VPN Concentrator tell the DNS to release the IP when the lease is up. (hhhmmm, bug with the VPN Concentrator code maybe?)

Ideas thrown around as possible solutions:
1. Write a "release" script for the laptops to execute as part of the logout/shutdown process.
2. Configure the VPN Concetrator to use DDNS. With this, a laptop user logs in, and the VPN Concentrator passes the IP request to a windows DHCP server. This allows the DHCP server to handle the dynamic updates on the AD server. In fact, the DHCP process load would be so small, it would be setup on the AD server.

Any other thoughts?
Dwyane

[Dwyane Everts_1]

Todd,

DNS reports only the first entry in the DB table; but when we looked, we can see MULTIPLE (3+) DHCP IPs assigned to the same name. We've removed a lot of them, but we are seeing them accumulate again.

Dwyane

[kheno]

Same overhere...

There is an scope option in your dhcp config where you can set clients to do a dhcp release when shutting down.

add new scope option => advanced => set microsoft scope option => option 002 set to 0x1

If other sollutions are avaible please post since lots of users disconnect before shutting down. Or even use hybernation.

Probable sollution would be to use scavening of reccords? So that unused reccord get deleted after a while.

Greetz