Hello,

does anybody know how to get a hostname by dns reverse lookup for unsupported devices (i.e. triggered by recognizing a new ip address)?

Please help

Actually, you find that ADDM uses nmap to do a reverse lookup for All IP addresses. If the IP and host name is in the DNS, it returns the host name, otherwise ADDM continues scanning using the original IP address.

If you look at your ‘skipped’ results from a discovery run, you might see a bunch of unsupported devices. THis default report does not contain a host name column. you can customize this report to see the hostnames if available.

Click on customize in the upper left corner, click on the ‘customize columns tab. then scroll down to relationships and click show all. You will expand the list and the first item should be DeviceInfo. click on that and then in the second window, you will see OS and Hostname . click on each one of these to add them to your report.

I also get rid of the start times and state info. in the lower right of the customize window, click ‘apply’, and voila…..host names. This comes from the DNS and not from the device.

Mark Verplaetse 3 - 09 February 2012 10:56 PM

Actually, you find that ADDM uses nmap to do a reverse lookup for All IP addresses. If the IP and host name is in the DNS, it returns the host name, otherwise ADDM continues scanning using the original IP address.

Almost, but not quite. ADDM will always use the IP for the scan, it will never change IPs based on a DNS result. The DiscoveryAccess.hostname can come from a variety of the heuristics including DNS but may also contain defaulted values like 192_168_132_248 under low access conditions.

You might also want to look at the getNames result under that DisccoveryAccess. This is a little more complex as it has to cope with the fact it’s entirely possible to have multiple names per IP so it’s a parent/child node structure and as it’s not really a common node you are going to have to use “show all” in the Query Builder.

From DiscoveryAccess the path you want is:
FQDNList (relationship) > Discovered FQDN (relationship) > FQDN (attribute)

If you’re happy working with search directly then the key expression you need in the SHOW clause would be:
#DiscoveryAccess:DiscoveryAccessResult:DiscoveryResult:FQDNList.#List:List:Member:DiscoveredFQDN.fqdn AS ‘FQDN’

Right you are Charles. thanks for adding detail.