Pagine

Scripting - Il comando NSLOOKUP parte 2 (piu' DIG)

Già nel seguente articolo avevamo affrontato il funzionamento di nslookup:


Ecco invece alcuni esempi ripresi dal seguente articolo:


Se invece vogliamo usare il comando DIG possiamo guardare il seguente articolo che con 10 esempi spiega il tutto:

http://www.thegeekstuff.com/2012/02/dig-command-examples/

1. Query record A del DNS

$ nslookup redhat.com

Server:  192.168.19.2
Address: 192.168.19.2#53

Non-authoritative answer:
Name: redhat.com
Address: 209.132.183.181

2. Query Record MX

$ nslookup -query=mx redhat.com
Server:  192.168.19.2
Address: 192.168.19.2#53

Non-authoritative answer:
redhat.com mail exchanger = 10 mx2.redhat.com.
redhat.com mail exchanger = 5 mx1.redhat.com.

Authoritative answers can be found from:
mx2.redhat.com internet address = 66.187.233.33
mx1.redhat.com internet address = 209.132.183.28



La differenza fra autorativo e non autorativo è spiegata bene qua:

"Any answer that originates from the DNS Server which has the complete zone file information available for the domain is said to be authoritative answer.
In many cases, DNS servers will not have the complete zone file information available for a given domain. Instead, it maintains a cache file which has the results of all queries performed in the past for which it has gotten authoritative response. When a DNS query is given, it searches the cache file, and return the information available as “Non-Authoritative Answer”."

3. Query dell'NS Record

il record NS è quello che indica qual'è il DNS che è autorativo per quel dominio

nslookup -type=ns redhat.com
Server:  192.168.19.2
Address: 192.168.19.2#53

Non-authoritative answer:
redhat.com nameserver = ns4.redhat.com.
redhat.com nameserver = ns2.redhat.com.
redhat.com nameserver = ns1.redhat.com.
redhat.com nameserver = ns3.redhat.com.

Authoritative answers can be found from:
ns4.redhat.com internet address = 209.132.188.218
ns2.redhat.com internet address = 209.132.183.2
ns1.redhat.com internet address = 209.132.186.218
ns3.redhat.com internet address = 209.132.176.100

4. Query dell'SOA Record

Il SOA Record da informazione autorative del dominio, email adress, domain admins, serial number del dominio....

$ nslookup -type=soa redhat.com
Server:  192.168.19.2
Address: 192.168.19.2#53

Non-authoritative answer:
redhat.com
 origin = ns1.redhat.com
 mail addr = noc.redhat.com
 serial = 2012071601
 refresh = 300
 retry = 180
 expire = 604800
 minimum = 14400

Authoritative answers can be found from:
ns1.redhat.com internet address = 209.132.186.218


Ecco la descrizione:

"mail addr – specifies the mail address of the domain admin ( noc@redhat.com )
  • serial – sort of revision numbering system. The standard convention is to use “YYYYMMYYNN” format. ( 2012-07-16. 01 will be incremented, if more than one edit has taken place on a same day )
  • refresh – specifies ( in seconds ), when the secondary DNS will poll the primary to see if the serial number has been increased. If increased, secondary will make a new request to copy the new zone file.
  • retry – specifies the interval to re-connect with the Primary DNS
  • expire – specifies the time that the secondary DNS will keep the cached zone file as valid
  • minimum – specifies the time that the secondary DNS should cache the zone file"

5. Fare la - query=any

$ nslookup -type=any google.com
Server:  192.168.19.2
Address: 192.168.19.2#53

Non-authoritative answer:
Name: google.com
Address: 173.194.35.7
Name: google.com
Address: 173.194.35.8

google.com nameserver = ns1.google.com.
google.com nameserver = ns2.google.com.
google.com
 origin = ns1.google.com
 mail addr = dns-admin.google.com
 serial = 2012071701
 refresh = 7200
 retry = 1800
 expire = 1209600
 minimum = 300
google.com mail exchanger = 20 alt1.aspmx.l.google.com.
google.com mail exchanger = 30 alt2.aspmx.l.google.com.
google.com mail exchanger = 40 alt3.aspmx.l.google.com.
google.com mail exchanger = 50 alt4.aspmx.l.google.com.
google.com mail exchanger = 10 aspmx-v4v6.l.google.com.
google.com has AAAA address 2a00:1450:4002:801::1004

Authoritative answers can be found from:
ns4.google.com internet address = 216.239.38.10
ns3.google.com internet address = 216.239.36.10


6. Si può fare anche il REVERSE Lookup

$ nslookup 209.132.183.181
Server:  192.168.19.2
Address: 192.168.19.2#53

Non-authoritative answer:
181.183.132.209.in-addr.arpa name = origin-www2.redhat.com.

7. Se vogliamo fare le query DNS su un server DNS alternativo

$ nslookup redhat.com ns1.redhat.com

Server:  209.132.186.218
Address: 209.132.186.218#53

Name: redhat.com
Address: 209.132.183.181

8. Cambiare la porta dove sta in listening il DNS

Se il DNS non lavora sulla porta standard ma su una diversa:

$ nslookup -port 112 redhat.com

9. Cambiare il timeout di risposta del DNS alle nostre query

$ nslookup -timeout=10 redhat.com

10. Effettuare il debug dns

$ nslookup -debug redhat.com
Server:  192.168.19.2
Address: 192.168.19.2#53

------------
    QUESTIONS:
 redhat.com, type = A, class = IN
    ANSWERS:
    ->  redhat.com
 internet address = 209.132.183.181
 ttl = 5
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
------------
Non-authoritative answer:
Name: redhat.com
Address: 209.132.183.181