Finding all DNS aliases for a host using nslookup/dig/host or similar command

[R Cardwell]

Hi,

Hopefully someone on here will know how to do this, as I have searched on here and on google to no avail.

I'am trying to write a script that can retrieve a hosts ip address and all its alias when supplied with its fully qualified hostname.

Now getting the IP is easy enough, however I can't seem to find a way to extract the aliases from DNS.

Anyone know how to do this?

Rich Cardwell

[Simon Hargrave]

How about something like: -

$ nslookup

> server1.yourdomain.com

Name Server: dns.yourdomain.com
Address: 134.202.170.200

Trying DNS
Name: server1.yourdomain.com
Address: 134.202.4.2


Then to get the aliases (CNAMES) for that domain: -

> ls -a yourdomain.com

This will give a list of hostname->hostname aliases. You can grep your hostname from this to find your alises.

[R Cardwell]

Hmmm, that looks like it should do it. However I get the following output when I try that command

*** Can't list domain XXX.XXX.XXX.XXX: Unspecified error

or I get this

*** Can't list domain XXX.XXX.XXX.XXX: Query refused

Looks like a DNS, might be configured to reject these commands then.

RichC

[Rick Garland]

If there are aliases existing for a host, the nslookup will output that info as well - usually towards the bottom of the nslookup output

[Muthukumar_5]

Hostname lookup are decided based on hosts: entry on /etc/nsswitch.conf file.

If it is,

hosts: files dns ldap ..

It will try to resolve on /etc/hosts (files) first then

/etc/resolv.conf (dns) file

It is good to use as,

hosts: dns files

in /etc/resolv.conf

domain test.com
nameserver xx.xx.xx.xx

If you try

# nslookup

It will give the resolved one now!!

Else add the full entry on

/etc/hosts file as,

IP-Address aliasname
172.16.1.68 test.test.com test

It will do that also
nameserver

[R Cardwell]

Doesn't seem to Rick, I'am doing queries on a server I know to have 5 aliases and it just returns the hostname I supply and its IP address.

Rich Cardwell

[Dave Olker]

Hi Rich,

When you say:

____________________________________

I am doing queries on a server I know to have 5 aliases and it just returns the hostname I supply and its IP address.
____________________________________


How do you know there are 5 aliases for this IP address? Is it that the /etc/hosts file has 5 aliases for this IP address, or do you know for a fact that the DNS table you're using has all 5 aliases? I just want to be sure that the DNS tables you're using were built appropriately to contain all 5 aliases.

A couple of things to try, if nslookup is not returning what you want:

1) Try nsquery

# nsquery hosts ros-resolver dns

Using "dns" for the hosts policy.

Searching dns for ros-resolver
Hostname: rose-resolver
Aliases: ros-resolver
Address: XXX.XXX.XXX.XXX
Switch configuration: Terminates Search

This program allows you to override whatever search routine is specified in your /etc/nsswitch.conf file and use whichever name repositories you wish. As you can see from my above example, it returned the hostname, IP address and alias information.


2) If you are not absolutely certain that DNS contains all of the alias information, you can verify this by collecting a network trace of the DNS query and look at the answer packet in the trace.

For example:


================================ IP Header (outbound -- pid: 355033) =========
Source: hpatcux9.rose.hp.com(A) Dest: rose-resolver.americas.hp.net(A)
len: 74 ttl: 64 proto: 17 cksum: 0x19bc id: 0x6fe5
flags: DF tos: 0x0 hdrlen: 20 offset: 0x0 optlen: 0
-------------------------------- UDP Header ----------------------------------
sport: 63319 --> dport: domain data len: 46 chksum: 0xb149
-------------------------------- BIND Header ---------------------------------
flags: rd
opcode: QUERY rcode: NOERROR id: 0x36df
qdcount: 0x1 ancount: 0x0 nscount: 0x0 arcount: 0x0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUESTIONS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
domain name: ros-resolver.americas.hp.net
type: A class: IN



================================ IP Header (inbound -- [ICS]) ================
Source: rose-resolver.americas.hp.net(A) Dest: hpatcux9.rose.hp.com(A)
len: 302 ttl: 62 proto: 17 cksum: 0x8abd id: 0x0
flags: DF tos: 0x0 hdrlen: 20 offset: 0x0 optlen: 0
-------------------------------- UDP Header ----------------------------------
sport: domain --> dport: 63319 data len: 274 chksum: 0x641
-------------------------------- BIND Header ---------------------------------
flags: qr aa rd ra
opcode: QUERY rcode: NOERROR id: 0x36df
qdcount: 0x1 ancount: 0x2 nscount: 0x5 arcount: 0x5
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUESTIONS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
domain name: ros-resolver.americas.hp.net
type: A class: IN
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ANSWERS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
domain name: ros-resolver.americas.hp.net
type: CNAME class: IN ttl: 28800 dlen: 16
domain name: rose-resolver.americas.hp.net

domain name: rose-resolver.americas.hp.net
type: A class: IN ttl: 7200 dlen: 4
internet address: 15.251.192.51
...


I've removed some of the information from the ANSWER packet for simplicity, but you can see at the top of the ANSWER packet is the primary hostname and the alias information.

If a network trace doesn't show this information then my guess is you don't have your DNS tables built correctly.

3) Use nslookup debug mode

# nslookup -d2 rose-resolver.americas.hp.net
------------
SendRequest(), len 44
HEADER:
opcode = QUERY, id = 13505, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
51.192.251.15.in-addr.arpa, type = PTR, class = IN

------------
------------
Got answer (296 bytes):
HEADER:
opcode = QUERY, id = 13505, rcode = NOERROR
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 2, authority records = 5, additional = 5

QUESTIONS:
51.192.251.15.in-addr.arpa, type = PTR, class = IN
ANSWERS:
-> 51.192.251.15.in-addr.arpa
type = PTR, class = IN, dlen = 31
name = rose-resolver.americas.hp.net
ttl = 7200 (2H)
-> 51.192.251.15.in-addr.arpa
type = PTR, class = IN, dlen = 13
name = forwarders.americas.hp.net
ttl = 7200 (2H)


Again, I've striped out much of the reply packet for simplicity, but this should show you the same information as the network trace, and you can verify whether the DNS tables were populated with the aliases.

Good luck,

Dave

[Sundar_7]

ls -a domainname will not work if the port 53/TCP is blocked or if the DNS has been configured to accept zone transfer requests only from specific hosts (typically secondary DNS servers).

[Jeff_Traigle]

In looking into this question off and on today, the only way I've been able to get the alias (CNAME record) from nslookup or nsquery is to use the alias as the argument instead of the hostname or IP address. Though I seem to recall years ago on SunOS 4 and IRIX 4 being able to use ANY as the querytype to get all records for a hostname or IP address from DNS (and the nslookup man page states this is the case), it doesn't appear to work on HP-UX. I know the systems I have at work are behind on patches though and they are 11.00... I can try it out at home tonight on my 11i workstation to see if it behaves the same or not.

[Patrick Wallek]

Here are 3 nslookups from one of my HP-UX 11.11 machines. nslookup for me lists all aliases, or all IPs, if more than 1 exists.

# nslookup whpackage1
Using /etc/hosts on: hqunm01

looking up FILES
Name: whpackage1.d.com
Address: 170.7.2.11
Aliases: whpackage1, wh06.d.com, wh07.d.com,wh09.d.com, wh14.d.com, wh15.d.com, wh17.d.com, wh40.d.com, wh63.d.com, wh16.d.com

# nslookup 170.7.2.11
Using /etc/hosts on: hqunm01

looking up FILES
Name: whpackage1.d.com
Address: 170.7.2.11
Aliases: whpackage1, wh06.d.com, wh07d.com, wh09.d.com, wh14.d.com, wh15.d.com, wh17.d.com, wh40.d.com, wh63.d.com, wh16.d.com

# nslookup www.yahoo.com
Using /etc/hosts on: hqunm01

looking up FILES
Trying DNS
Non-authoritative answer:
Name: www.yahoo.akadns.net  [Admin: The link is no longer valid> Broken Link removed]
Addresses: 216.109.117.110, 216.109.118.68, 216.109.118.75, 216.109.118.78,216.109.118.72, 216.109.117.108, 216.109.117.107, 216 109.117.205
Aliases: www.yahoo.com