June 21st, 2016

How to recognize DNS zone scavenging availability timestamps from quite a long way away

A customer couldn’t figure out how to decipher the scavenge available value that is produced by the dnscmd /zoneinfo command:

C:\> dnscmd /zoneinfo contoso.com
Zone query result:
Zone info:
    ptr                     = 0000000000327C90
    zone name               = contoso.com
    zone type               = 1
    update                  = 2
    DS integrated           = 1
    data file               = (null)
    using WINS              = 0
    using Nbstat            = 0
    aging                   = 1
        refresh interval    = 168
        no refresh          = 168
        scavenge available  = 3606130
    ...

(If you want to see what it looks like in French, here ya go.)

The customer liaison found an old article of mine on decoding timestamps but none of the tricks on that page worked.

So what is the format for the scavenge available time?

This is one of those weird custom time formats. Specifically, it is “Hours since January 1, 1601 UTC”.

The FILETIME format has the same epoch, so the easiest conversion is to convert it through a FILETIME.

using System;

class Program
{
    public static void Main()
    {
        var x = 3606130;
        var y = DateTimeOffset.FromFileTime(x * 36000000000);
        System.Console.WriteLine("{0:u}", y);
    }
}

This program prints 2012-05-21 10:00:00Z, which is the scavenge time.

Bonus reading: Don’t be afraid of DNS scavenging. Just be patient.

Earlier versions of this article said that the starting point was January 1, 1600 UTC. This has been corrected.

Author

Raymond has been involved in the evolution of Windows for more than 30 years. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie-jeebies. The Web site spawned a book, coincidentally also titled The Old New Thing (Addison Wesley 2007). He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information.

0 comments

Discussion are closed.