Detecting hard-wired IP addresses

A few times recently, I've spoken to people that are looking for a way to spot instances where their applications are using hard-wired IP addresses rather than DNS.

This can be a problem if the IP addresses are expected to change. For example, if you have an application that expects to be able to connect to a database on IP address 10.1.1.1 and the database server moves to 11.2.2.2 then the application will break unless you are able to identify the places where the application uses "10.1.1.1" and change them to "11.2.2.2".

Well written applications will use names "dbserver.foo.com" which get looked up in the DNS, so when the server's IP address is changed, the application will continue to work.

The extreme case is where there is a big change coming such as a data centre move. This could involve hundreds or even thousands of servers. If the move will result in changes to the IP addresses of servers, how can you be sure that nothing will break?

One solution is to inspect all of the source code of the applications. If there are hundreds of applications, this is not going to be a trivial task. Needless to say, this is not an appealing approach for many.

What else can you do? I'm open to suggestions.

One possibility is to use "tcpdump" or something similar to do packet traces of activity from each server looking for instances where a connection is opened to an address that has not previously been returned as a result of a DNS lookup. This should identify cases where an application is using an IP address rather than a DNS name. This might help, but it would still fall short of an ideal solution since it would not identify the process responsible for the connection. Better than nothing, though.

I guess you could go a step further and build an agent that would do much the same thing, running continuously on the box. Has anyone come across anything that does this?

Other approaches? Dtrace on Solaris, perhaps? Suggestions welcome.