Can someone explain this ?

[Volker Borowski]

nslookup www.hp.com

Name: www.hp.com
Addresses:
192.6.234.8, 192.6.234.9, 192.6.234.10, 192.151.52.187
192.151.52.217, 192.151.53.86, 192.6.118.44, 192.6.118.97, 192.6.118.128


Obviously nslookup returns several targets for www.hp.com. I'd like to know, how the Internet-Browser chooses the one it connects to. Is the chosen target predictable in any way ? How does the browser behave with repeatable connections from the same / diffrent windows on the same client ?
I tried some tests with diffrent PCs and "netstat -n", and I got connections to several of the given IPs, but once a connection was established, it never changed to a diffrent target.

Is there an RFC which describes the rules for accessing one of several given IPs from "gethostbyname" ?

Thanks
Volker

[Ron Kinner · Accepted solution]

Basic DNS RFC is 1035.

http://www.ietf.org/rfc/rfc1035.txt

But I don't think it will answer your question.

Suspect the actual use of multiple IP addresses is left to the implementation (browser). However, programmers are lazy so it probably take the first one and then rotates through them or grabs one at random each time you do a refresh. That's what my MS IE appears to be doing right now.

If you do a netstat -rn you will see which ip address is being used.

There is currently something wrong with the first one it uses. I have to do a refresh every time I change to a different page in order to see anything.

Ron

[Knut Eckstein]

AFAIK, the client resolver gives the list of addresses to the application which will usually choose the first address. In case that times out, it'll choose the second, etc.

The trick is that usually the application and the client resolver library do not cache responses. Therefore load distribution can be achieved using a so call "Round Robin" scheme. See the "Cricket Book" (O'Reilly DNS and BIND, 4th edition) on pages 273 ff. With round robin, names servers return the addresses in a different order for different queries, so that the load is distributed, but not balanced, as the name servers know nothing about the load on each individual server....

So in your case your browser in multiple windows may have issue multiple queries at differnt points in time and may have gotten the list of IP addresses in differnt order. Each time he chose the one on top of the list, therefore you see connections to differnt IP numbers. I'd recommend to use a network sniffer software, e.g. ethereal, to monitor the exact behaviour of your client.

Regards,

Knut

[Steven Gillard_2]

As others have said, there's usually no way to predict which IP address will be used by the application. Most applications simply take the first address, which can vary as you've seen.

You can use the sort-order directive in resolv.conf to influence the way in which the array of addresses is sorted before being returned, but I'm not sure how this would be done on a PC.

There's also an RFC that discusses this form of load balancing which you might like to read:

http://www.faqs.org/rfcs/rfc1794.html

For a discussion od the sort-order resolv.conf directive see section 6.2 in /usr/share/doc/bog.txt

Regards,
Steve

[Christopher Caldwell]

The client picks the first A record, the DNS server rotates the A records.