Resolving numerical adresses

[David Risner]

As stated, many times the IP addresses have no associated FQDN; however, there is a way to find out the name of the domain which the address comes from.  Under Unix, the command is "whois".  There are Windows whois clients.  One I know of comes with WS_FTP Pro.  As an example, the computer I am on now has the address "205.184.104.22" and is not registered in a DNS to have a FQDN.  To find out what domain the address is coming from I can type (at a Unix prompt, I'm using Linux specifically in this case):

"whois 205.184.104"

I then get the response:

[rs.internic.net]
Cad Solutions, Inc. (NETBLK-NETBLK-CADSOL) NETBLK-CADSOL
                                                 205.184.102.0 - 205.184.106.0
NETCOM On-Line Communication Services, Inc (NETBLK-NETCOM-BLK) NETCOM-BLK
                                                   205.184.0.0 - 205.187.255.0

To single out one record, look it up with "!xxx", where xxx is the
handle, shown in parenthesis following the name, which comes first.

The InterNIC Registration Services Host contains ONLY Internet Information
(Networks, ASN's, Domains, and POC's).
Please use the whois server at nic.ddn.mil for MILNET Information.


Not so helpful actually since all it tells you is that my school is a customer of Netcom; however, for most schools at least this will give you good information.

An example.  Let's say I have "130.182.181.87", I would type:

"whois 130.182"

and get:

[rs.internic.net]
California State University, Los Angeles (NET-CSULANET)
   5151 State University Drive
   Los Angeles, CA 90032

   Netname: CSULANET
   Netnumber: 130.182.0.0

   Coordinator:
      Gregorich, David T.  (DTG11)  DTG at CSULA-PS.CALSTATELA.EDU
      (213) 343-2140

   Domain System inverse mapping provided by:

   EAGLE.CALSTATELA.EDU         130.182.121.1
   CSULA-PS.CALSTATELA.EDU      130.182.171.1
   IPAC.CALTECH.EDU             134.4.10.10

   Record last updated on 26-Aug-91.

The InterNIC Registration Services Host contains ONLY Internet Information
(Networks, ASN's, Domains, and POC's).
Please use the whois server at nic.ddn.mil for MILNET Information.


Note that this time I only used the first two numbers of the address.  This is because the first number 130 indicates that this is a class B address.  205 in the previous one is a class C.  I can never remember what the cutoff point is, but basically the lowest numbers are Class A for which you would use just the first number with whois, then comes Class B and then Class C.  There are Class D, E, and, I think, F, but these classes should not be accessing your server.

Another strategy to try is this:  if you have 205.184.104.22, start with 205.184.104.1 as a lookup in DNS (nslookup).  If this doesn't return anything, try 204.184.104.2, and so on until you either get a good name or you get up to 254.  Most people have their servers in the lowest part of the number range and these will usually have FQDN registered in DNS.

Good luck, I hope this helps you out.

--
David G. Risner - Network Services Administrator
Southwestern University School of Law, Los Angeles, CA
Business: drisner at swlaw.edu  Personal: dgrisner at aol.com


----------
From:  Jon Knight[SMTP:jon at net.lut.ac.uk]
Sent:  Thursday, November 28, 1996 3:31 AM
To:  Multiple recipients of list
Subject:  Re: Resolving numerical adresses

On Thu, 28 Nov 1996 web4lib at library.berkeley.edu wrote:
> But can anyone tell me where the log pics up the machinename/IP-number?

The IP address can be retrieved from the OS once a socket connection is
made (the IP packets have to carry both a source and destination IP
address otherwise the server wouldn't know where to send any responses).

> Is it from the browser?

Yes, its the browser, or the last proxy that the request went through
before it reached your server.
 
> The statistics program (Analog) lists IP-numbers
> under the heading ]Unresolved numerical adresses], does this mean that
> they have failed a resolving process?

To get from the IP address to the Fully Qualified Domain Name (FQDN) one
calls a name resolution function (the name of which varies depending on
the OS that you're using). This function can try a number of techniques
to look up the host name including looking in a local file, doing a
NIS (Yellow Pages) lookup and querying the DNS.  The last of those will be
the most common.  Your "Unresolved numerical adresses" are simply IP
addresses that either don't have an associated FQDN in the DNS or whose
DNS servers are unreachable for some reason.  Not having an FQDN for an IP
address is not uncommon and is perfectly valid; FQDNs are just to improve
user friendliness and you can run perfectly OK without one as long as
you've got a valid IP address.

Tatty bye,

Jim'll

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Jon "Jim'll" Knight, Researcher, Sysop and General Dogsbody, Dept. Computer
Studies, Loughborough University of Technology, Leics., ENGLAND.  LE11 3TU.
* I've found I now dream in Perl.  More worryingly, I enjoy those dreams. *