Is it possible to obtain all of the ip addresses correspoding to aFQDN?

Hi all,

For a domain name / FQDN, say www.google.com , is there a method to
obtain all of the ip addresses corresponding it?

Regards

 

I would guess it depends on who you ask or who responds to your lookup request.

For starters have you tried something like

$ nslookup www.google.com
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.google.com
Address: 74.125.21.106
Name: www.google.com
Address: 74.125.21.147
Name: www.google.com
Address: 74.125.21.103
Name: www.google.com
Address: 74.125.21.105
Name: www.google.com
Address: 74.125.21.99
Name: www.google.com
Address: 74.125.21.104

 

Is this homework again?

|[2/501][email protected]:~$ dig google.com
|
|; <<>> DiG 9.9.5-12-Debian <<>> google.com
|;; global options: +cmd
|;; Got answer:
|;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63902
|;; flags: qr rd ra; QUERY: 1, ANSWER: 16, AUTHORITY: 4, ADDITIONAL: 5
|
|;; OPT PSEUDOSECTION:
|; EDNS: version: 0, flags:; udp: 4096
|;; QUESTION SECTION:
|;google.com. IN A
|
|;; ANSWER SECTION:
|google.com. 300 IN A 109.193.193.94
|google.com. 300 IN A 109.193.193.123
|google.com. 300 IN A 109.193.193.84
|google.com. 300 IN A 109.193.193.89
|google.com. 300 IN A 109.193.193.93
|google.com. 300 IN A 109.193.193.103
|google.com. 300 IN A 109.193.193.108
|google.com. 300 IN A 109.193.193.113
|google.com. 300 IN A 109.193.193.98
|google.com. 300 IN A 109.193.193.104
|google.com. 300 IN A 109.193.193.109
|google.com. 300 IN A 109.193.193.114
|google.com. 300 IN A 109.193.193.88
|google.com. 300 IN A 109.193.193.99
|google.com. 300 IN A 109.193.193.118
|google.com. 300 IN A 109.193.193.119
|
|;; AUTHORITY SECTION:
|google.com. 33361 IN NS ns1.google.com.
|google.com. 33361 IN NS ns4.google.com.
|google.com. 33361 IN NS ns2.google.com.
|google.com. 33361 IN NS ns3.google.com.
|
|;; ADDITIONAL SECTION:
|ns1.google.com. 33361 IN A 216.239.32.10
|ns2.google.com. 33361 IN A 216.239.34.10
|ns3.google.com. 33361 IN A 216.239.36.10
|ns4.google.com. 33361 IN A 216.239.38.10
|
|;; Query time: 42 msec
|;; SERVER: 192.168.181.53#53(192.168.181.53)
|;; WHEN: Sun Oct 18 09:45:15 CEST 2015
|;; MSG SIZE rcvd: 431
|
|[3/502][email protected]:~$

Greetings
Marc

 

That’s not all the IP addresses for google.com. Specifically, it’s
missing IPv6 addresses. nslookup has the same issue.

Another problem is that the answer depends where you start from. The
addresses you quote belong to Kabel BW GmbH. Similarly the addresses I
get from home belong to my ISP. From other locations I see addresses
more directly associated with Google Inc.

 

Google obviously uses some kind of GeoIP setup to make its responses
faster. Which makes the homework assignment even stupider. Why don't
even teachers grok today's Internet any more?

Grüße
Marc

 

whois
why?

 

Probably not, Bill.
"whois" gives the dns registration data, not the resolver data. In other
words, "whois" will tell you who registered google.com, and what addresses
the DNS servers have, but not necessarily anything about the addresses that a
specific name resoves to.

The OP may find "nslookup" a better choice. It can (and will) report the IP
addresses any specific fqdn resolves to.

 

The 'host' command which comes with bind will list IPv4 and IPv6
addresses by default though -- A and AAAA records.

Perhaps the teacher was not stupid but clever -- he outwitted most of
us on c.o.l.n ...

There's an interesting questions here: is this behavior allowed by the
standards around DNS? And if not, is it de-facto standard to do it
anyway, for the giant sites?

/Jorgen

 

IF he has specific names, then what you say is true. But he wanted to
know all of the computers under a certain domain I thought.
Now, it is confusing, since www.google.com is not a domain, and an FQDN
is not a domain, so for looking up addresses corresponding to specific
names, I agree whois is not appropriate. The easiest is probable
ping -c 1 -w 1 name
which will show the IP corresponding to that name. (or course with
www.google.com it does not correspoind to a specific address-- they are
both location and time dependent. There are loads of Ip corresponding
to that name .)
On the other hand if he wants to know what belongs to google.com then
whois at least give a hint.
But as far as I know, there is nothing that says "these are all the
machines IPs that use say google.com as their domain name. I do not
think it is even possible.

 

The standards were written before somebody thought about this. I don't
see why it would be forbidden, the reference implementations even
support this on a single instance, and it works like a charm.

Greetings
Marc

 

This is nonsense. www.google.com is a domain name. See RFC1034 for
terminology.

 

It’s called split-horizon DNS, AFAIK people have been doing it for
longer than I’ve been on the Internet.

 

google.com is the domain name.

www.google.com is a host name.

www.google.com is NOT a domain name, that non-sense started with web
masters/devs.

 

google.com is also a host name.

and, (if google were in the mood) www.google.com could be a domain name as
well.

Not that we know anyway. If we find such resolvable names as
canada.www.google.com or sales.www.google.com, then we know that
www.google.com is also a domain name.


To illustrate:
- digitalfreehold.ca is a domain name.
- digitalfreehold.ca is also a host name.
- pitcher.digitalfreehold.ca is a host name
within the digitalfreehold.ca domain

 

Obviously you didn’t follow the suggestion to see RFC1034.

 

Obviously you didn’t understand RFC1034

 

digitalfreehold.ca should not be both a host name and domain name.

That non sense goes back to "our web master fiends" sometime around 1995

Yes

 

Sorry, but your opinion differs from reality.

Nonsense? No.


[snip]

 

You (or, perhaps, I) seem to have a fundamental misunderstanding about DNS,
domain names, and host names.

So, let's go back to the RFCs

RFC 1034 ("DOMAIN NAMES - CONCEPTS AND FACILITIES") says
"The domain name space is a tree structure. Each node and leaf on the
tree corresponds to a resource set (which may be empty). The domain
system makes no distinctions between the uses of the interior nodes and
leaves, and this memo uses the term "node" to refer to both."
and
"The domain name of a node is the list of the labels on the path from the
node to the root of the tree. By convention, the labels that compose a
domain name are printed or read left to right, from the most specific
(lowest, farthest from the root) to the least specific (highest, closest
to the root)."

so, the "www.google.com" represents a specific node in the domain name space,
as does "google.com".

Further
"A domain is identified by a domain name, and consists of that part of
the domain name space that is at or below the domain name which
specifies the domain. A domain is a subdomain of another domain if it
is contained within that domain. This relationship can be tested by
seeing if the subdomain's name ends with the containing domain's name.
For example, A.B.C.D is a subdomain of B.C.D, C.D, D, and " "."

So, "www.google.com" is a domain, /and/ a subdomain of the
domain "google.com".


Each of these domain nodes may have a resource set; a set of properties (such
as mail exchanger or ip address). Thus "www.google.com" may have an IP
address, /and/ "google.com" may have an IP address.

There is no requirement that a node /have/ any particular resource set, or
that a node should have no resources. Both leaf nodes /and/ branch nodes may
have (or not) such resources as IP addresses or mail exchanges.

So,
digitalfreehold.ca is a valid domain, by RFC 1034's requirements.
digitalfreehold.ca can have an IP address, as per RFC 1034, making
it a host, as well as a domain.
pitcher.digitalfreehold.ca is also a valid domain, a subdomain of
digitalfreehold.ca, and also can have an IP address, as per RFC 1034,
making it a host, as well as a domain and a subdomain.

 

s3.1 is pretty clear about the definition of ‘domain name’. Which part
do you think contradicts it?