At 07:26 AM 8/3/01 -0600, [EMAIL PROTECTED] wrote the following:
>A question out of pure curiosity! I use a DOS-based mail client on my
>old machine (this one!), and can see, during dial-up, all the different
>steps as shown on screen - modem initialization, baud rate,
>IP address, PPP negotiations, calling pop3 or smtp etc. (most people think
>I'm mad still to use DOS, but I find it interesting and like to know what's
>happening!)
>
>The IP address varies (at random) between 213.xxx.xxx.xxx and 62.xxx.xxx.xxx
>I wonder what the significance of either of these starting figures is, and
>why it varies between the two. The second set of digits is often, but not
>always, the following: 213.123.xxx.xxx or 62.6.xxx.xxx
>
>Hope someone can elucidate - Gerry Boyd will surely be able to give a clear
>and highly informative answer ...
Your ISP happens to own two sets of IP addresses. Every time you dial up and
connect you access one set or the other. For example, looking at your
headers for this message, I see:
>Received: from host62-6-87-76.dialup.lineone.co.uk ([62.6.87.76]
> helo=62.6.87.76) by mk-smarthost-2.mail.uk.worldonline.com with smtp
> (Exim 3.22 #3) id 15SYle-000ONC-00 for [EMAIL PROTECTED]; Fri, 03
> Aug 2001 07:49:10 +0100
So this time you managed to connect and use a dial-up line at lineone.co.uk
(notice not lineone.net that you use as an address) with an IP address of
62.6.87.76
Generally speaking, we need to use a series of tools to help find
information about ISPs, IP addresses, names, routing, travel times, etc.
. nslookup is an interactive program to query Internet domain name
servers.
The user can contact servers to request information about a specific host or
print a list of hosts in the domain. It provides a translation between names
and IP addresses and vice versa. That is, you can lookup a domain name and
get the IP address or you can lookup an IP address and get the domain name.
. whois is used to lookup the full name, mailing address, telephone
number,
and network mailbox for users who are registered in one of the Domain name
Registrar databases.
. ping (Packet InterNet Groper) is a protocol and program for sending a
signal to see whether another network host or other device is online and
responding. The term is normally used as a verb in "Ping [host] to see if it
is up!"
. traceroute sends small packets of information which are designed to
return
information to the sender every time the packet encounters a new server.
These small messages expire after a short period of time. The information
they send you allow tracking of their progress towards the Internet Protocol
IP address they are sent to, returning the name and IP address of each
server and the time it took to get there.
. finger displays information about each logged-in user, including
his or
her login name, full name, terminal name, idle time, login time, and
location if known.
. dig (Domain Information Groper) is a flexible command line tool
which can
be used to gather information from the Domain Name System servers.
Most of these tools can be found on your UNIX shell account or as part of
Windows 9X. If you are a Windows 9X user you can download SamSpade, CyberKit
or NetLab free of charge.
http://www.samspade.org/ssw/
http://www.cyberkit.net/
http://www.zdnet.com/downloads/ (search on netlab)
To start the search I like to use nslookup which is great for converting
names to IP addresses. Once I have an IP address I can find other
information such as who controls the block of IP addresses (called Netblock)
that this IP address falls into.
So, let's do an nslookup...
no2:/opt2/home3/expita>nslookup lineone.net
Server: localhost
Address: 127.0.0.1
*** localhost can't find lineone.net: Non-existent host/domain
Whoa! appears as though lineone has trouble with their DNS (domain name
servers) somewhere along the line.
Hmm. let's check for their nameservers...
no2:/opt2/home3/expita>nslookup -q=ns lineone.net
Server: localhost
Address: 127.0.0.1
Non-authoritative answer:
lineone.net nameserver = ANNA.DELPHI.CO.UK
lineone.net nameserver = BRICKLAYERS-ARMS-S1.SPRINGBOARD.net
lineone.net nameserver = NS0.BT.net
Authoritative answers can be found from:
ANNA.DELPHI.CO.UK internet address = 194.72.86.5
BRICKLAYERS-ARMS-S1.SPRINGBOARD.net internet address = 194.75.152.200
NS0.BT.net internet address = 194.72.6.51
Bummer, nameservers exist but name doesn't resolve. Usually indicated by bad
or missing A record on the authoritative servers.
Well OK, I'll just use the IP address...
no2:/opt2/home3/expita>nslookup 62.6.87.76
Server: localhost
Address: 127.0.0.1
Name: host62-6-87-76.dialup.lineone.co.uk
Address: 62.6.87.76
Hmm, domain name is lineone.co.uk rather than lineone.net. Probably the
problem in the aliasing of the domain name.
Well let's get specific, that is, whois is lineone.net or lineone.co.uk?
no2:/opt2/home3/expita>whois -h whois.networksolutions.com lineone.net | more
The Data in Network Solutions' WHOIS database is provided by Network
Solutions for information purposes, and to assist persons in obtaining
[snip]
Registrant:
Springboard Internet Services Ltd (LINEONE3-DOM)
Ludgate House 245 Blackfriars Road
London, SE1 9UY
GB
Domain Name: LINEONE.NET
Administrative Contact:
Domain Administrator (DA20689-OR) [EMAIL PROTECTED]
Springboard Internet Services Limited
Ludgate House
245 Blackfriars Road
LONDON
UNITED KINGDOM
+44 20 7579 4300
Fax- +44 20 7579 4301
Technical Contact:
postmaster (PO38-ORG) [EMAIL PROTECTED]
Springboard Internet Services Limited
Ludgate House 245 Blackfriars Road
LONDON
UNITED KINGDOM
+44 20 7579 4300
Fax- +44 20 7579 4301
Billing Contact:
Department,Finance (DF882-ORG) [EMAIL PROTECTED]
Springboard Internet Services Limited
Ludgate House 245 Blackfriars Road
LONDON
UNITED KINGDOM
+44 20 7579 4300
Fax- +44 20 7579 4301
Record last updated on 13-Mar-2001.
Record expires on 03-Apr-2006.
Record created on 02-Apr-1997.
Database last updated on 3-Aug-2001 07:41:00 EDT.
Domain servers in listed order:
BRICKLAYERS-ARMS-S1.SPRINGBOARD.NET 194.75.152.200
NS0.BT.NET 194.72.6.51
ANNA.DELPHI.CO.UK 194.72.86.5
Hmm, so LINEONE.NET (alias to LINEONE.CO.UK which is the UK convention that
corresponds to .COM naming in the US) is controlled by LINEONE.COM. No
wonder nslookup fails.
We appear to have a problem with lineone.net resolving with nslookup.
no2:/opt2/home3/expita>dig lineone.net | more
; <<>> DiG 8.3 <<>> lineone.net
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUERY SECTION:
;; lineone.net, type = A, class = IN
;; AUTHORITY SECTION:
lineone.net. 1h1m53s IN
SOA bricklayers-arms-s1.springboard.net. hos
tmaster.springboard.net. (
3411145709 ; serial
5M ; refresh
1M ; retry
2W ; expiry
12H ) ; minimum
;; Total query time: 1 msec
;; FROM: no2 to SERVER: default -- 127.0.0.1
;; WHEN: Sat Aug 4 17:05:26 2001
;; MSG SIZE sent: 29 rcvd: 108
Dig tells me that the DNS for lineone.net is
BRICKLAYERS-ARMS-S1.SPRINGBOARD.NET (with IP address 194.75.152.200) which
is the same information that the whois returned. However, if you notice,
only ONE DNS is returned. Domains are required to have 2 at a minimum. If
you check you will see that whois search on LINEONE.NET showed 3 DNS's
however dig is only showing 1. Probably why nslookup is having a problem
resolving LINEONE.NET.
A simple check will show you what I mean. I'll use my own domain for the
example.
1st, name to IP...
no2:/opt2/home3/expita>nslookup expita.com
Server: localhost
Address: 127.0.0.1
Non-authoritative answer:
Name: expita.com
Address: 207.228.228.126
NOTE: The "nonauthoritative" answer means my local server will only ask
for the cached locations. It will cache that results in case someone else
who shares the same server with me wants to look at the same resource. Since
this information is a subset of the available information, and since it is
cached and can go out of date, it is marked as non-authoritative.
2nd, IP address to name...
no2:/opt2/home3/expita>nslookup 207.228.228.126
Server: localhost
Address: 127.0.0.1
Name: expita.com
Address: 207.228.228.126
3rd, Dig check for DNSs
no2:/opt2/home3/expita>dig expita.com | more
; <<>> DiG 8.3 <<>> expita.com
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
;; QUERY SECTION:
;; expita.com, type = A, class = IN
;; ANSWER SECTION:
expita.com. 27m53s IN A 207.228.228.126
;; AUTHORITY SECTION:
expita.com. 27m53s IN NS ns1.superb.net.
expita.com. 27m53s IN NS ns2.superb.net.
expita.com. 27m53s IN NS ns3.superb.net.
;; ADDITIONAL SECTION:
ns1.superb.net. 1d16h18m50s IN A 207.228.225.5
ns2.superb.net. 1d16h18m50s IN A 66.38.135.5
ns3.superb.net. 1d16h18m50s IN A 207.228.226.5
[snip]
Note, 3 DNS's for my domain. Granted they are all at superb.net (my hosting
ISP) but they are independent of one another.
--
Gerry Boyd
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/rules.htm
Contact list owner <[EMAIL PROTECTED]>
Unsubscribing and other changes: http://pcworkers.com
=====================================================
