Pinging a machine thats not there but still geting a reply ?

[gerryR]

Well my query is in the subject, why is it that when I ping a machine that I
know is not on the network I still get a reply ? dns or dhcp spring to mind
but why would it happen and is there any way of pinging and only getting a
reply if the machine is connected to the network ?

Thanks for any help given
gerryR

 

[ChrisM]

Are you pinging the machine by name or by ip address?

If you are pinging by ip address, then there must be another machine (or
some other device) on your network with that address.
If you are pinging by name, I guess your dns must be linking the name to an
address other than the one you are expecting.

Ping usually give the address of the responding machine, even if you do ping
a name, so is that the address you are expecting?

ChrisM

 

[gerryR]

Hi Chris, thanks for fast reply

I'm pinging by computer name as all our workstations use dhcp. When I ping
the ip that the machine name resolves to I get a reply too but I know for a
fact the machines not there. Is there any way I can flush the dns ?

I'm doing this to check if remote machines are on or off the network as some
of them are not contacting our anti virus server

any more help greatly appreciated
gerryR

 

[ChrisM]

Gerry,

If you fire up a command window,

you can enter
ipconfig /flushdns

which should clear the DNS cache on the machine you run it on.

It sounds to me like somthing strange is going on though.

Try a little test:
Take a machine that is on the network. At the command prompt, type
ipconfig

This should tell you the IP address that has been allocated to the machine.

From your server (or whener you are doing your Ping-ing from) ping that
machine by name and see if it is using the same ip address as the one you
just found on the target machine.

Then remove the target from the network and ping it again, see if it pings,
and what address is being used.

Another thing you could look at is on the target machine, type:
ipconfig /all

Two of the pieces of information it should give you is:
Lease Obtained
and
Lease Expires

This is the length of time the DHCP server 'leases' an IP address to the
machine for. If this lease is very short, (less than a few hours?) then I
guess it is possible that ip addresses are being handed out by the DHCP
server quicker than the DNS server can keep up...?

I have to confess, I'm not an expert on any of this, but I have found out a
few things over time in sorting my own network problems out. :-/

Cheers,

ChrisM.

 

[gerryR]

Chris

Tried all that but to no avail I'm afraid. The machine(s) I'm pinging from
do seem to be pinging properily. There's an 8 day lease for dhcp numbers
too. Guess I'll keep looking.

Thanks for all your suggestions
best regards
gerryR

 

[ChrisM]

One last question, 'cause I'm curious now...

When you are pinging one of these disconnected machines, is the address
that is being pinged the same as the disconnected PC reported having?

How do you KNOW the disconnected machine is not on the network, are you
physically unplugging the network cable/un-plugging the PC from the mains? I
believe some computers network cards are still active even if the PC is
switched off (but still plugged in) as some BIOSes support remote
startup/power on...

Sounds stupid, but I've actually heard of this: You don't have a wireless
network that they might be still connected to do you?

ChrisM

 

[gerryR]

Chris

Yes the address being pinged is the same as the reported one and I'm sure
because one of the machines is a laptop which is beside my desk in a box
waiting to be shipped off for repair. Not making it easy am I !!

Cheers again for the help
gerryR

 

[ChrisM]

Gerry,

OK.

Let me get this straight!

You have a laptop, in a box. For the sake of argument, we'll call it LAPTOP.

if you type:

PING LAPTOP you get

pinging LAPTOP[123.456.78.90]
Reply from 123.456.78.90
Reply from 123.456.78.90
Reply from 123.456.78.90

even after typing ipconfig /flushdns

Obviously you are not pinging that laptop (unless it has a wireless lan card
in it...)

Last suggestions:

Are you sure there are no other machines on the network called LAPTOP

How many computers on your network? Is it practical to check the IP address
of each one?

After pinging LAPTOP, type arp -a
you should get a table showing IP addresses against MAC-Addresses
Check the entry for the IP address of LAPTOP and see what MAC address it
gives.
If possible check this against the actual MAC address of the Laptops NIC.

Do you have any really cheapo network cards? I have heard of some that have
configurable MAC addresses, hence it could be possible to have 2 devices
with the same MAC address.

From the MAC address you got for LAPTOP, compare the first 6 digits on:
http://standards.ieee.org/regauth/oui/oui.txt

See what manufacturer it represents and see if that helps work out
where/what the hell it is.

Otherwise,

Sorry I think I'm all out of ideas :-(

Cheers,

Chris.

 

[Torgeir Bakken \(MVP\)]

Well my query is in the subject, why is it that when I ping a machine that I
know is not on the network I still get a reply ? dns or dhcp spring to mind
but why would it happen and is there any way of pinging and only getting a
reply if the machine is connected to the network ?

Hi

Is this from a script, and if it is, could you post the relevant
code here?

 

[Enkidu]

Well my query is in the subject, why is it that when I ping a machine that I
know is not on the network I still get a reply ? dns or dhcp spring to mind
but why would it happen and is there any way of pinging and only getting a
reply if the machine is connected to the network ?

You can **ONLY** get a reply to a ping from a machine that is
connected to the network. If you get a ping from an IP address which
belonged to a machine that WAS on the network, but is NOT now on the
network, then another machine has obtained that IP address (via DHCP?)
and is responding.

Cheers,

Cliff

 

[Guest]

If your're using netbios names, try this:

1) Ping the pc for example: PING LAPTOP

2) If you get a reply then use the ip address it respinds with to do
this: NBTSTAT -a <ipaddress>, for example:

NBTSTAT -a 192.168.0.10

3) If this responds with a set of netbios names, you now can see which
PC is currently using that IP address.

HTH

Harry

Well my query is in the subject, why is it that when I ping a machine that I
know is not on the network I still get a reply ? dns or dhcp spring to mind
but why would it happen and is there any way of pinging and only getting a
reply if the machine is connected to the network ?

Thanks for any help given
gerryR

Ha®®y

(e-mail address removed)