Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I am pinging non-existing host like 'zzz' or 'qwerty'

I am getting the following result

Pinging zzz.kanisa.com [209.62.20.200] with 32 bytes of data:

Reply from 209.62.20.200: bytes=32 time=60ms TTL=46
Reply from 209.62.20.200: bytes=32 time=66ms TTL=46

It looks like a virus to me. But I was unable to find a solution on web. Any ideas how to fix it?

Even more ridiculous results with nslookup

C:\> nslookup google.com
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Non-authoritative answer:
Name:    google.com.kanisa.com
Address:  209.62.20.200

How to get rid of it?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

For name lookup, the DNS client uses DNS Suffixes which can be changed here for Windows XP:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\SearchList
share|improve this answer
    
Aha, I somehow thought your were on a Mac. I'm sure there is some "Advanced" setting in some dialog for that on Windows as well. –  Arjan May 8 '10 at 17:12

You will be interested to notice that I get similar results too :-)

$ ping zzz.kanisa.com
PING zzz.kanisa.com (209.62.20.200): 56 data bytes
64 bytes from 209.62.20.200: icmp_seq=0 ttl=57 time=390 ms

So,

  1. zzz.kanisa.com resolves the same way for all
    Nothing special in zzz.kanisa.com resolving to 209.60.20.200 for you
  2. But, why does zzz get converted to zzz.kanisa.com for you?
    That means, you have kanisa.com as your local domain name.
    Is that expected? If so, ping abc would also look for abc.kanisa.com
    And, resolve to the same IP (wildcard DNS as MarkM explains).

So, the real question becomes: Is kanisa.com your default domain name?

share|improve this answer
    
No, it is not my domain name. Although I am not sure what default in this context means. –  bublegumm May 8 '10 at 14:36
    
@bublegumm, see the default search domain, in your network preferences, Advanced, DNS, like here. –  Arjan May 8 '10 at 16:32

There is a wildcard DNS entry for *.kanisa.com which points at that IP. That means that even if there is no website hosted for that subdomain, all non-explicitly defined entries for that domain point to 209.62.20.200, which, apparently, responds to ICMP ECHO requests.

share|improve this answer
    
Sounds like exact answer to me. I wonder how I can fix it. I cannot reproduce it on my second laptop so I guess it is local issue. –  bublegumm May 8 '10 at 14:35
1  
IF you have "kanisa.com" set as a search domain in your network connection preferences, anything you ping from that one location that isn't fully qualified will append kanisa.com to the end. –  MDMarra May 8 '10 at 16:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.