First off it's not AIX6.3 but AIX6.1,
If who -ub is showing you hostname, that means your DNS is resolving the IP to hostname.
Just do nslookup <hostname> , it should give you IP address.
I'd think that's only guaranteed to work if the host the user is coming from has only one IP address. Admittedly that will cover the vast majority of cases.
Also, the root cause of the problem is probably the data stored in the utmpx file contains a string that's already been converted to the hostname, almost certainly at login. I'm not sure offhand how to prevent the login process from recording a hostname instead of an IP address in the utmpx data.