WMI - 无法通过 IP 地址连接到某些计算机 [英] WMI - Cannot connect to certain computers via IP address

问题描述

我在网络上的几台机器上遇到了一个非常奇怪的 WMI 问题.

I have a really odd issue with WMI that I'm running into on a few machines on our network.

我编写了一个软件 (.NET/C#) 来扫描本地网络上的 IP 范围，然后使用 WMI 查询有关机器的某些数据(计算机名称、.NET 框架版本等).我最近遇到的一个问题是，这些机器的一小部分不会响应通过其 IP 地址建立的 WMI 连接——它们只是抛出RPC 服务器不可用"异常，就好像 WMI 没有运行一样.

I have a piece of software (.NET/C#) written that scans an IP range on a local network, and then uses WMI to query certain data about the machines (computer names, .NET framework versions, among other things). One issue I've run into recently is that a small subset of these machines will not respond to WMI connections made via their IP address- they simply throw an "RPC Server is Unavailable" exception as if WMI isn't running to begin with.

这在 C# 应用程序和尝试简单查询以返回计算机名称的 vbscript 应用程序中都会发生:

This occurs both with the C# application and with a vbscript application that attempts a simple query to return the computer's name:

if wscript.arguments.count >= 1 then
    host = wscript.arguments(0)
end if
if host = "" or isnull(host) then host = "."

connectionStr = "winmgmts:{impersonationLevel=impersonate}!\\" & host & "\root\cimv2"
wscript.echo connectionStr

set objWMIService = GetObject(connectionStr)    
set objCompName = objWMIService.ExecQuery("Select * from Win32_ComputerSystem")
for each x in objCompName
    wscript.echo x.Name
next

这将返回以下结果:

C:\>nslookup BROKENCOMPUTER
Address: 192.168.1.123

C:\>cscript testwmi.vbs 192.168.1.123
winmgmts:{impersonationLevel=impersonate}!\\192.168.1.123\root\cimv2
C:\testwmi.vbs(9, 1) Microsoft VBScript runtime error: The remote server machine does not exist or is unavailable: 'GetObject'

C:\>cscript testwmi.vbs BROKENCOMPUTER
winmgmts:{impersonationLevel=impersonate}!\\BROKENCOMPUTER\root\cimv2
BROKENCOMPUTER

如果我通过主机/计算机名称引用计算机，我仍然可以打开 WMI 连接.我还可以通过 IP 地址(例如 HTTP 或 RDP)连接到机器上运行的其他服务器 - 请求 tp http://192.168.1.123 成功返回.

I can still open a WMI connection if I refer to the computer by its host/computer name. I can also connect to other servers running on the machine via IP address (such as HTTP or RDP)- a request tp http://192.168.1.123 returns successfully.

让事情变得更奇怪的是，行为甚至不一致.有时与 IP 的连接会正常工作，并且它会成批发生.为了对此进行测试，我设置了一个脚本，该脚本每 5 秒向相关计算机重复发送 WMI 请求并记录结果(以及结果趋势).我发现所有请求都会在大约一定数量的请求(180-15 分钟间隔)或其倍数内失败或成功.示例:

To make things even weirder, the behavior isn't even consistent. Sometimes the connection to the IP will work correctly, and it happens in batches. To test this, I set up a script that repeatedly spammed a WMI request every 5 seconds to the computer in question and recorded the result (and trends of results). What I found was that all requests would fail or succeed for about a certain number of requests (180- a 15 minute interval) or a multiple of it. Example:

   - Start script
   - 35 successful requests in a row
   - 180 failed requests in a row
   - 180 successful requests
   - 360 failed requests
   - 180 successful requests
   - 180 failed requests
   - 900 successful requests
   - etc etc

然后我同时在两台机器上运行这个脚本.我发现两者之间的行为相似(有几分钟的时间间隔能够连接和无法连接)，但两者之间没有同步；有两个可以连接的时期，只有一个(或另一个)可以连接的时期，以及两个都不能连接的时期.

I then ran this script on two machines at the same time. What I found was the behavior between the two was similar (had several-minute-long-intervals of being able to connect and not being able to connect) but did not sync up between the two; there were periods where both could connect, periods where only one (or the other) could connect, and periods where neither could connect.

我知道这是一个非常奇怪和具体的问题，我真的不希望有人能够即时解决它，但我想知道是否有人有任何提示或方向?我已经和这里的网络人员谈过了，他们和我一样对这个问题感到困惑.

I know this is an incredibly weird and specific problem, and I don't really expect anyone to be able to insta-solve it, but I was wondering if anyone had any hints or direction? I've spoken to the network guys here and they're just as puzzled over the issue as I am.

推荐答案

除了 MisterZimbu 的精彩回答之外，我还可以对此添加一些看法.假设 Microsoft 没有删除我对本文的评论，请参阅 http://msdn.microsoft.com/en-us/library/windows/desktop/aa393720%28v=vs.85%29.aspx.基本上，当 IP 地址传递到 WMI 时，Microsoft 似乎正在执行反向 DNS 查找.如果您的 DNS 不干净，您将获得不可预测的结果"，也就是说您将连接到您不希望连接的机器.

I can add some perspective on this, in addition to the fine answer from MisterZimbu. Assuming Microsoft doesn't remove my comments on this article, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa393720%28v=vs.85%29.aspx. Basically, Microsoft seems to be doing a reverse DNS lookup when IP addresses are passed into WMI. If your DNS isn't squeaky clean, you will get "unpredictable results", which is to say that you will be connecting to machines you didn't expect to connect to.

将句点添加到 IP 地址会强制反向(或正向)查找失败，然后奇迹般地，它们实际上使用的是 IP 地址，而不是从 DNS 返回的(可能不正确的)主机名.似乎在许多情况下(UNC、浏览器等)都可以在 IP 地址后使用句点，但您可能会遇到一些警告和其他故障.请注意，如果您查看您的 DNS 缓存 (ipconfig/displaydns)，您会在附加句点时看到失败的查找，因此它不会阻止操作系统进行查找 - 它只是确保过时的 DNS 条目不会使用.

Adding the period to the IP address forces the reverse (or forward) lookup to fail, and then by some miracle, they actually use the IP address, and not the (potentially incorrect) hostname returned from DNS. It appears that appending a period to the IP address can be used in many contexts (UNC's, browser, etc.), but there are caveats and other failures you might encounter. Note that if you look at your DNS cache (ipconfig /displaydns) you will see the failed lookups when the period is appended, so it doesn't stop the OS from doing the lookup - it just ensures that the stale DNS entries won't be used.

这篇关于WMI - 无法通过 IP 地址连接到某些计算机的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！