An incorrect IP address is returned (nslookup)

[BillyCarpenter]

My customer's PC stopped scanning to folder. All the other PC's scanned just fine. It was only this one.

I was using the hostname when I initally set up scan to folder. It was working fine until today. I did a quick NSLOOKUP and it returned the wrong IP address for this PC. It was coming back as 192.168.0.43 but the correct IP address is 192.168.0.38.

I pinged the .43 address and the ping was successful. So, there's a device with that address.

Obviously, this isn't a copier problem. I changed the hostname in the copier to the IP address and scan to folder worked fine. But I don't like using IP address for scan to folder.

DNS was being done by the ISP router. I made sure no outside DNS was being used. I flushed DNS with no success. Still came back with wrong IP.

This problem is outside of the scope of the service contract. I noticed that there was a lot of network adaptors. I went as far as I wanted to go but it's bugging me.

Thoughts?

[slimslob]

Re: An incorrect IP address is returned (nslookup)

My customer's PC stopped scanning to folder. All the other PC's scanned just fine. It was only this one.

I was using the hostname when I initally set up scan to folder. It was working fine until today. I did a quick NSLOOKUP and it returned the wrong IP address for this PC. It was coming back as 192.168.0.43 but the correct IP address is 192.168.0.38.

I pinged the .43 address and the ping was successful. So, there's a device with that address.

Obviously, this isn't a copier problem. I changed the hostname in the copier to the IP address and scan to folder worked fine. But I don't like using IP address for scan to folder.

DNS was being done by the ISP router. I made sure no outside DNS was being used. I flushed DNS with no success. Still came back with wrong IP.

This problem is outside of the scope of the service contract. I noticed that there was a lot of network adaptors. I went as far as I wanted to go but it's bugging me.

Thoughts?

May actually be a hostname conflict problem. Years ago we had a customer who bought about 10 computers at the same time. The NETBios names were the model of the CPU board followed by a serial number. The total number of characters was 2 digits longer than their Server 2008 stored in DNS. Result was 10 computers that anything using hostname though were the same and would error out.

[BillyCarpenter]

Re: An incorrect IP address is returned (nslookup)

May actually be a hostname conflict problem. Years ago we had a customer who bought about 10 computers at the same time. The NETBios names were the model of the CPU board followed by a serial number. The total number of characters was 2 digits longer than their Server 2008 stored in DNS. Result was 10 computers that anything using hostname though were the same and would error out.

Hey, bro, that's interesting. Didn't think of that.

[PrintWhisperer]

Re: An incorrect IP address is returned (nslookup)

Check the local hosts file for the IP translation problem, this is attempted via NetBios Name Service before proceeding to DNS and part of the WINS/NetBIOS name resolution where DNS is not present.

"There are two main sequences used in almost all cases: NetBIOS resolution and Host name resolution. Clients connecting to resources on Microsoft servers, typically through Windows File Manager or Network Neighborhood, most often use NetBIOS name resolution."
Microsoft TCP/IP Host Name Resolution Order

Here is a NBNS look-up broadcast from the MFP to the entire subnet (Frame 143) prior to a SMB scan to file (Note Frame 144 is the resolved name):
NBNS.jpg

In Frame 144 the query response (answer) comes from the same workstation being scanned to (I am the droid you're looking for):
NBNS_Answer.jpg

Disabling NetBIOS and WINS should force DNS look-up first on the MFP side

[Venom]

Re: An incorrect IP address is returned (nslookup)

I would have tried setting a static ip on the pc 192.168.0.240 (if available) and try smb scan to ip. Maybe an ip conflict or it is mapped to another ip?

[BillyCarpenter]

Re: An incorrect IP address is returned (nslookup)

Check the local hosts file for the IP translation problem, this is attempted via NetBios Name Service before proceeding to DNS and part of the WINS/NetBIOS name resolution where DNS is not present.

"There are two main sequences used in almost all cases: NetBIOS resolution and Host name resolution. Clients connecting to resources on Microsoft servers, typically through Windows File Manager or Network Neighborhood, most often use NetBIOS name resolution."
Microsoft TCP/IP Host Name Resolution Order

Here is a NBNS look-up broadcast from the MFP to the entire subnet (Frame 143) prior to a SMB scan to file (Note Frame 144 is the resolved name):
[ATTACH=CONFIG]54536[/ATTACH]

In Frame 144 the query response (answer) comes from the same workstation being scanned to (I am the droid you're looking for):
[ATTACH=CONFIG]54537[/ATTACH]

Disabling NetBIOS and WINS should force DNS look-up first on the MFP side

I'll be the first to admit that I'm mostly ignorant when it comes to NetBios Name Resolution. I'm gonna make it a point to learn it this weekend. What you say makes perfect sense.

BTW: Your wireshark frame is interesting. I don't understand all of it, but from what I gather, a device (server?) sent out a broadcast (arp) looking to find out what device resides at an IP address and that device responded. Not really sure about the rest.

Thanks for the info. Always enjoy your posts.

[PrintWhisperer]

Re: An incorrect IP address is returned (nslookup)

What you see in frame 143 and 144 is a NBNS query, functionally similar to a DNS query, except it is not destined for a specific host, but the network population for answer.

...

BTW: Your wireshark frame is interesting. I don't understand all of it, but from what I gather, a device (server?)

It was the MFP scan to folder acting as a workstation peer and requesting the IP of the scan destination, this is a peer-to-peer modality

sent out a broadcast (arp)

It was a NBNS broadcast packet, but not ARP. While many ARP are broadcast, not all broadcast are ARP, plus ARP is MAC to IP mapping.

looking to find out what device resides at an IP address and that device responded.

The query is on the hostname (which I blacked out) and the answer (which happened to come from the hostname in question, but could have been in the LMhosts files of and answered by other PC's on the network) contains it's IP address.



Yeah spend some time on the MS article. I was born into the WINS loop for NetBIOS name resolution and used to muck around in 'hosts' and 'lmhosts' (remote machine table) files but you don't see it much anymore.

YVW and Happy Learning!

[adecanmin]

Re: An incorrect IP address is returned (nslookup)

I've had this problem before, even posted about it. I'll have to disable NetBIOS over TCP/IP to see if I'm able to get those copiers scanning using the host name instead of the ip.

[blackcat4866]

Re: An incorrect IP address is returned (nslookup)

I always enjoy reading threads like this one.
Unfortunately most of it passes way over my head.

Thanks! =^..^=

[slimslob]

Re: An incorrect IP address is returned (nslookup)

I always enjoy reading threads like this one.
Unfortunately most of it passes way over my head.

Thanks! =^..^=

Now David you been around long enough to understand most of it.

[blackcat4866]

Re: An incorrect IP address is returned (nslookup)

Now David you been around long enough to understand most of it.

I'm aware of the existence of Bios & NetBios, but I'm not real clear on what it does. I know I can boot my laptop into Bios mode to make such settings ... that's about it. If I were to make a guess I'd say Bios is a more basic version of the computer operating system that boots before Windows.

I've used hostnames and IP's before ... even came across identical hostnames before.

My first inclination on Billy's question was that the hostname had a specific IP reserved on the router, and the IP of the computer had been changed. Is that a possibility?

[PrintWhisperer]

Re: An incorrect IP address is returned (nslookup)

I'm aware of the existence of Bios & NetBios, but I'm not real clear on what it does....

Yes, BIOS we know as the Basic Input Output System for your hardware.

NetBIOS is a network protocol to govern the basic input/output sessions on and over networks. (Primarily during the Pre-internet peer to peer serverless environments...remember dial-up?)

It's old, insecure, and best turned OFF, always.

I used the wireshark sample just to show how the initial connection is handled differently in the NetBIOS only world, this photo is marked up with some more notes on what is going on.
1) The MFP initiates a session (OSI Layer 5) and needs the IP address of the 'scan-to' computer.
2) The IP address is provided.
3) ARP sets up the Data Link (Layer 2)
4) The session proceeds to connect the MFP to Transport over TCP (Layer 3) destined for service on port 139

NBNS.jpg

The rest of this capture has the host attempting to change to port 445 for domain auth but cannot and fails.

But that's another discussion

[rthonpm]

Re: An incorrect IP address is returned (nslookup)

I'll be the first to admit that I'm mostly ignorant when it comes to NetBios Name Resolution. I'm gonna make it a point to learn it this weekend.

NetBIOS and WINS were the resolution protocol before DNS. In modern environments there's no reason to have them enabled as they're essentially dead. The only reason you'd need it enabled is if you somehow have something older than Windows NT on your network, and if you're connecting something that old, you definitely have other issues...

It was also part of the reason that SMB 2 changed from port 139 to 445. Port 139 is SMB over WINS, while 445 is SMB over DNS. SMB 2 was more of a re-write than an update.


Unfortunately there's no real way to force a DNS flush on the MFP. The closest thing you can do is to change the IP for the DNS Server on the MFP, reboot, then change it back to the real value.

I haven't been a big fan of ISP equipment handling anything for the LAN side in years. Often, they'll offer their external DNS servers as the internal ones, which kills any attempt at local name resolution. I've been down that road before, as well as customers using Google or some other public DNS and wondering why they can't talk to local devices.

Sent from my Pixel 6 Pro using Tapatalk

[BillyCarpenter]

Re: An incorrect IP address is returned (nslookup)

Man, there's a lot of good information in this thread. Even though scan to folder is working after I used the IP address instead of hostname, I think I'll go back and try some of the suggestions in this thead. I'm only doing this because I hate not doing a job the right way. I feel like I used a bandaid by using the IP address.


On another note: Do you guys do this type of stuff free or do you charge? This isn't covered under my service contract. (I'm not gonna charge them but I'm just curious)

[BillyCarpenter]

Re: An incorrect IP address is returned (nslookup)

Unfortunately there's no real way to force a DNS flush on the MFP. The closest thing you can do is to change the IP for the DNS Server on the MFP, reboot, then change it back to the real value.


Sent from my Pixel 6 Pro using Tapatalk

I just made a note of that. Thank you very much.