who -u not showing IP anymore

[Stefan Farrelly]

Hi all,

tricky one. Weve just had a rollout of some new W2K PC's and when they login to our HP servers now (via telnet) who -u no longer shows their IP, instead it shows;

rebecp pts/tt Nov 20 09:03 0:02 27201 10.132.33.120
orchar pts/tu Nov 20 09:06 0:47 27764 pcp040924pcs.ipc.co.uk
kathry pts/tv Nov 20 09:11 0:33 27871 10.132.33.9

some sort of PC/Computer name. Our network and PC teams cant for the life of them figure out how this is happening. All we know is they used a new standard W2K build on these PC's which is now broadcasting some sort of PC name instead of an IP when they login. This makes diagnosing problems on the HP much harder for us (relys on PC documentation of PC -> IP being uptodate, which it isnt and there are thousands of PCs out there).

Anybody know how this happens in W2K and how to switch it off ?

Cheers,

Stefan

[Ralph Grothe]

Can you resolve these queer names to an IP by nslookup or dig?

[Stefan Farrelly]

Hi Ralph,

thats the funny thing, some are in DNS, some arent, so its not necessarily coming from DNS.

What is dig ?

Cheers,

Stefan

[Elmar P. Kolkman]

I think this is caused by your DNS... The problem is not with the strange name but with the other IP addresses that aren't resolvable and thus not shown as names but as IP addresses... So if you need the IP address do a nslookup or dig for the strange name.

[Elmar P. Kolkman]

dig is the follow-up on nslookup.

[T G Manikandan]

Stefan,

Also make sure none exists on your local /etc/hosts.

If you have a dhcp for the windows machines and dns resolving their ip's then things should be ok.

What is dig?

[john korterman]

Hi,
perhaps a silly question as I do not know if all other "who" function works, but are you sure that your wtmp and btmp files are not corrupted?

regards,
John K.

[Ralph Grothe]

As elmar said,
dig is the follow up tool for DNS analysis that should replace nslookup sooner or later.
Btw, the acronym stands for "domain information groper".
dig is widespread in the OpenSource (e.g. GNU/Linux the *BSDs).

[Stefan Farrelly]

Hi all,

thanks for all the replies. Apparently its something to do with the new W2K build has a tick box set to auto advertise each PC on the network, and with the new dhcp+dns servers they are using they automatically register each dhcp connection in the dns, which should NOT happen. Our network guys are going to get this auto advertisment/dns registration via dhcp switched off.

Thanks for the help.

[rbarot]

Stefan ,
Hasitating to reply olympian. Anyway have you tried with some emulator ?Are you using IP v6 ?

[T G Manikandan]

Stefan,

If auto advertisment/dns registration is to be switched off then how about the dhcp ip's being released and renewed with a new ipaddress.

Please clarify!

[Henrik Palmqvist]

Hi,

This may have something to do with Microsoft Active Directory. I may be wrong but it would not surprise me if this "autoregister" procedure is needed for the AD to work properly.

Could be worth checking... if you're using Active Directory.

Anyway... Would it not be a better solution to resolve (using nslookup) the last field of the output of the who -u command if the last field is a real hostname and not an ip address?

[Brian Hackley]

Stefan,
Another HP-UX program to use to look up IP address and/or hostnames is "nsquery hosts"

For example:

nbox# who -mR
root pts/ta Nov 24 08:42 (atl177179.ssr.hp.com)
nbox# nsquery hosts atl177179.ssr.hp.com

Using "files [NOTFOUND=continue] dns" for the hosts policy.

Searching /etc/hosts for atl177179.ssr.hp.com
atl1177179.ssr.hp.com was NOTFOUND

Switch configuration: Allows fallback

Searching dns for atl177179.ssr.hp.com
Hostname: atl177179.ssr.hp.com
Aliases:
Address: 10.2.177.179
Switch configuration: Terminates Search
#

You can also feed in the IP address to nsquery. This is the most reliable method to determine how HP-UX 11.0 and up is obtaining a hostname<>IP Address relationship.

-> Brian Hackley

[Steven E. Protter]

I noticed this issue myself several months ago. It was caused by changes to our domain controllers and images as we upgraded all of our desktop boxes.

We now show hostnames instead of IP addresses on local workstations. Since we allow nobody in from the outside it does make unresolvable hostnames show IP addresses. This shows up like a sore thumb.

I've not asked whether the hostname is being maintained on the DNS server or in the pc image, but I suspect both after running a scan on my pc.

Annoying that nobody bothered to tell me when they made the change. Interestingly enough inetd.sec worked just fine by numeric IP address. When we added a new buidling, nobody there could see my machines because the networking people didn't see fit to tell me about the new network.

Good Luck,

Have a great week.

SEP

[Kristopher March]

When I experienced this, we just put on a new version of SSH. The config file needed to be changed at this line:

ResolveClientHostName:

By default is was YES and I set it to NO to return my IP addresses with the who -u commmand.

[Alzhy]

I can't explain it but I think it has something to do with Dynamic DNS that comes with DHCP services on Win2K machines and newer... I also noticed this when our entire PDC/BDC infrastructure were upgraded from NT 4.0 to Windows 2000.

The response I got from our PC and network folks was that -- "It is the new DHCP services and Dynamic DNS" that came with Windows2000..

It has no effect though on TCP wrappers and SSH..