Charles M. Kozierok The TCP-IP Guide

Подождите немного. Документ загружается.

Note: It is also possible to specify one or more options to modify the behavior of

the lookup in non-interactive mode. These options are the same as the parameters

controlled by the nslookup set command described in Table 292; they are specified

by preceding them with a dash. For example, “nslookup -timeout=10 www.pcguide.com”

would perform the same lookup as in Table 291 but with the timeout interval set to 10

seconds.

Interactive Use of nslookup

The interactive mode of nslookup is selected by simply issuing the name of the command

with no parameters. This will cause the program to display the current default name

server’s DNS name and address, and then provide a prompt at which the administrator may

enter commands. Interactive mode allows someone to perform multiple lookups easily

without having to type “nslookup” each time. More importantly, it provides more convenient

control over the types of information that can be requested and how the lookups are

performed.

The exact command set available in an nslookup implementation can usually be deter-

mined by issuing the command “help” or “?” at the nslookup prompt. Table 292 shows some

of the commands that are usually found in most nslookup implementations.

Table 292: Typical nslookup Utility Commands (Page 1 of 2)

Command and

Parameters

Description

<host> [<server>]

Look up the specified host, optionally using the specified DNS name

server. Note that there is no actual command here, you just enter the name

directly at the command prompt.

server <server>

Change the default server to <server>, using information obtained from the

current default server.

lserver <server>

Change the default server to <server>, using information obtained from the

initial name server—that is, the system’s default server that was in place

when the nslookup command was started (prior to any preceding changes

of the current name server in this session).

root Changes the default name server to one of the DNS root name servers.

ls [-t <type>] <name>

Requests a list of information available for the specified domain name, by

conducting a zone transfer. By default, the host names and addresses

associated with the domain are listed; the “-t” option may be used to restrict

the output to a particular record type. Other options may also be defined.

Most servers restrict the use of zone transfers to designated slave servers,

so this command may not work for ordinary clients.

help Displays help information (usually a list of valid commands and options).

? Same as “help” (only on some systems).

set all Displays the current value of all nslookup options

Problems With nslookup

The nslookup utility is widely deployed on both UNIX and Windows systems, but the

program is not without its critics. The complaints about it mainly center around its use of

non-standard methods of obtaining information, rather than standard resolution routines. I

have also read reports that it can produce spurious results in some cases. One example of

a significant problem with the command is that it will abort if it is unable to perform reverse

lookup of its own IP address. This can cause confusion, because users mistake that error

for an error trying to find the name they were looking up.

For this and other reasons, a number of people in UNIX circles consider nslookup to be a

“hack” of sorts, and for this reason, in some newer UNIXes nslookup has been deprecated.

This simply means that it is still included in the operating system for compatibility, but it is

not recommended and may be removed in the future. Instead, a pair of newer utilities are

provided: host and dig.

The host Utility

The first alternative to nslookup, host, is most often used for simple queries such as would

normally be performed using nslookup’s non-interactive mode. It is invoked in the same

way as non-interactive nslookup:

host <host> [<server>]

The output is also similar to that of non-interactive nslookup, but less verbose. An example

is shown in Table 293.

set <option>[=<value>]

Sets an option to control the behavior of the utility. Most implementations

include quite a number of options, some of which are controlled by just

specifying a keyword, while others require a value for the option. For

example, “set recurse” tells the program to use recursive resolution, while

“set norecurse” turns it off; “set retry=3” sets the number of retries to 3.

exit Quits the program.

Table 293: DNS Name Resolution Using the host Utility

%host www.pcguide.com

www.pcguide.com is an alias for pcguide.com.

pcguide.com has address 209.68.14.80

Table 292: Typical nslookup Utility Commands (Page 2 of 2)

Command and

Parameters

Description

Even though host does not operate interactively, it includes a number of options that can

allow an administrator to get the same information that would have been obtained using

nslookup’s interactive mode. Some of the more common options are shown in Table 294.

The dig Utility

The second alternate to nslookup is dig, which stands for “Domain Information Groper”

(likely a play on the supposed origin of the name “ping”). It differs from the host command in

that it provides considerably more information about a domain, even when invoked in the

simplest of ways. It is also quite a bit more complicated, with a large number of options, and

features such as a batch mode for obtaining information about many domains.

The basic syntax for the dig command is different from nslookup or host, because if a non-

default name server is specified, it is prepended with an at sign (“@”) and comes before the

host to be looked up. A specific type of resource record can also be specified, like this:

dig [@<server>] <host> [<type>]

Table 294: Typical host Utility Options and Parameters

Option / Parameters Description

-d Turn on debug mode.

-l

Provides a complete list of information for a domain; this is similar to the

“ls” command in interactive nslookup. This may be used with the “-t” option

to select only a particular type of resource record for the domain.

-r

Disable recursion in the request. When this is specified, only the server

directly queried will return any information; it will not query other servers.

-t <querytype>

Specifies a query for a particular resource record type, allowing any type of

DNS information to be retrieved.

-v Use verbose mode for output (additional details are provided).

-w Wait as long as necessary for a response (no timeout).

Table 295 shows the output from running dig on the same domain (www.pcguide.com) that

I used as an example for nslookup and host. You can see that it provides much more infor-

mation about the domain.

The dig command also allows specific types of resource records to be looked up, and

includes dozens of options and settings. Since this topic is already getting very long and dig

is by far the most advanced of the three utilities, I will stop here; consult your system’s

documentation for the full instructions on how dig works and a list of its parameters.

Key Concept: Most TCP/IP implementations provide one or more utilities that can

be employed by an administrator to manually resolve DNS domain names to IP

addresses or perform related searches for DNS information. One of the most

common is nslookup, which allows a host name to be translated to an address or vice-

versa; it has both interactive and non-interactive modes. On some operating systems,

nslookup has been replaced by the host utility for simple DNS lookups, and the dig program

for more detailed inspections of DNS resource information.

Table 295: DNS Name Resolution Using the dig Utility

%dig www.pcguide.com

; <<>> DiG 9.2.1 <<>> www.pcguide.com

;; global options: printcmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15912

;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2,

ADDITIONAL: 0

;; QUESTION SECTION:

;www.pcguide.com. IN A

;; ANSWER SECTION:

www.pcguide.com. 3600 IN CNAME pcguide.com.

pcguide.com. 3600 IN A 209.68.14.80

;; AUTHORITY SECTION:

pcguide.com. 3600 IN NS ns0.ns0.com.

pcguide.com. 3600 IN NS ns23.pair.com.

;; Query time: 1840 msec

;; SERVER: 209.68.1.87#53(209.68.1.87)

;; WHEN: Tue Nov 18 16:05:08 2003

;; MSG SIZE rcvd: 109Server: ns1-mar.starband.com

On The Web: The dig utility is very useful, but has still not been implemented on

some systems. Fortunately, there is an online dig utility you can access using your

browser on the Internet. Find it at http://www.gont.com.ar/tools/dig.

TCP/IP DNS Registry Database Lookup Utility (whois/nicname)

Utilities such as nslookup and host allow an administrator to resolve a DNS domain name to

an address and also view detailed information about a domain’s resource records. There

are cases, however, where we need to know not the technical information about a domain

but rather its DNS registration information. This includes details such as what organization

owns the domain, when its registration expires, and who are the designated contacts who

manage it.

In the early days of DNS, all domain names were centrally registered by a single authority,

called the Internet Network Information Center (InterNIC or just the NIC). To allow Internet

users to look up information about domains and contacts, a special server at this center

was set up. A protocol was created to allow users to retrieve information from this server,

called both nicname and whois. It was initially described in RFC 812 (1982) and then later,

RFC 943 (1985). Over time, the name “whois” has become the preferred of the two, and is

the one used today for the utility program that allows an administrator to look up DNS regis-

tration data. (It can also be used to look up information about IP addresses, but is used for

this purpose much less commonly.)

As the Internet grew and expanded, it of course moved away from having a single

centralized authority. The modern Internet has a hierarchical structure of authorities that are

responsible for registering domain names in different portions of the DNS name space. In

recent years, this has been further complicated by the deregulation process that allows

multiple registries for the generic top-level domains such as .COM, .NET and .ORG. All of

this means that more work is needed to look up domain registration information, since it is

distributed across many databases on different servers.

Syntax and Use of the whois Utility

To make it easier for administrators to find information about domains in this large

distributed database, modern TCP/IP implementations generally come with an intelligent

version of the whois utility. It is able to accept as input the name of a domain and automati-

cally locate the appropriate registry in which that domain’s information is located. The utility

is usually used as follows:

whois [-h <whois-host>] <domain>

In this syntax, “<domain>” represents the name about which registration information is

requested. The administrator can use the “-h” parameter to force the program to query a

particular whois server, but again, this is usually not required. Some implementations also

include other options that can be used to direct queries to particular registries.

Sample whois Output

Table 296 shows the sample output of the whois command on a FreeBSD UNIX machine (I

have stripped out some of the preliminary general information and legal disclaimers to keep

the table down to size).

In this case, the registrar of the domain “pcguide.com” is pairNIC, the DNS registry division

of pair Networks, the company I have used for Web hosting for many years (since 1997, as

you can see). This output is public information, and lets anyone who has an interest in

pcguide.com, for whatever reason, determine that I own the domain and learn how to

contact me. (That is obviously not my real phone number, of course.) It also tells them that

pair Networks runs the name servers that contain domain information for my domain.

Table 296: DNS Domain Registry Lookup Using the whois Program

%whois pcguide.com

Registrant:

The PC Guide

2080 Harwood Hill Road

Bennington, VT 05201

ixl@fearn.pair.com

+1.8025555555

Domain Name: PCGUIDE.COM

Administrative & Technical Contact:

Charles Kozierok

The PC Guide

2080 Harwood Hill Road

Bennington, VT 05201

ixl@fearn.pair.com

+1.8025555555

Domain Name Servers:

NS23.PAIR.COM

NS0.NS0.COM

Created: August 25, 1997

Modified: July 7, 2003

Expires: August 24, 2008

** Register Now at http://www.pairNIC.com/ **

Third-Party whois Tools

Many operating systems, including Windows, do not come with a whois command imple-

mentation, but there are third-party programs that will support the function. In recent years

many different organizations have also set up Web sites that implement the whois function,

which is much more convenient and user-friendly to those more accustomed to graphical

operating systems like Windows. Many of these sites are provided as free services by DNS

registrars, so customers can check if a name they are interested in is already taken, and if

so, by whom.

One drawback of some of these systems is that they usually do not have the intelligence to

check all the different registries where domain name records are stored. In most cases, a

whois service provided by a registrar will only search for names in the particular top-level

domains (TLDs) in which the registrar operates. So, if the registrar deals with .COM, .ORG

and .NET, it may only support whois queries for those TLDs. To check the registration infor-

mation for domains in more obscure TLDs, such as some of the less common geopolitical

(country code) domains, a considerable amount of searching may be required.

Key Concept: The TCP/IP whois utility allows registration information to be

displayed for a DNS domain, such as its owner, contact information and the date that

its registration expires. The program is most commonly found on UNIX operating

systems, where it is given intelligence that allows it to automatically query the correct

servers to find the information for most domains. Newer Web-based whois utilities also now

exist, but are usually limited to displaying information about domains in only a specific

subset of top-level domains.

TCP/IP Network Status Utility (netstat)

TCP/IP is a very complex protocol suite, as I am sure you would agree after perusing the

contents of this Guide. It is actually quite amazing that most of the time, all of the different

protocols, services and programs perform their jobs both efficiently and silently. Most of us

don’t even realize just how much is going on in the background, and that’s as it should be.

☺ On the other hand, when a problem does occur on a TCP/IP network, the administrator

charged with fixing it needs to obtain as much information as possible about what all those

bits and pieces of the suite are doing behind the scenes. The network status utility, netstat,

is provided for this purpose.

The netstat program is very simple in concept, being designed for only one purpose: to

show information about the operation of TCP/IP on a device. The aforementioned

complexity of TCP/IP, however, leads to netstat being rather elaborate itself: the program

can provide a large variety of information. As usual, the options and output of netstat

depend on the particular operating system type and version. It is somewhat different on

UNIX and Windows machines, so I will describe each platform separately.

UNIX netstat

On most UNIX systems the netstat utility is very full-featured, with a typical implementation

including dozens of options that can be used to control what information is displayed. These

options may not all be used simultaneously; rather, they are arranged into option groups,

each of which presents one class of information. Within each group, one option is

mandatory; it identifies the group, and hence, the general kind of information that will be

displayed. Other options are also possible in each group, which are optional and modify the

command to provide better control on exactly what is output. In essence, then, netstat is

really like many related utilities rolled into one.

UNIX netstat Option Groups, Options and Parameters

Table 297 provides a simplified summary of the option groups for a typical UNIX netstat

implementation, in this case FreeBSD.

Table 297: Typical UNIX netstat Option Groups, Options and Parameters (Page 1 of 2)

Option Group, Options and

Parameters

Description

netstat [-AaLSW] [-f <family>]

[-p <protocol>] [-n]

This is the default invocation of netstat, with no mandatory options. It

prompts the utility to display a list of active sockets on the host machine.

The other options shown can be used to control what precisely is output;

for example, “-a” causes server processes also to be shown.

netstat -i

[-abdt] [-f <family>] [-n]

netstat -I <interface>

[-abdt] [-f <family>] [-n]

Tells netstat to provide information about all network interfaces (“-i”) or a

particular network interface (“-I <interface>”). The “-a” option causes

multicast addresses to be shown as well, “-b” displays bytes of data in

and out on the interface, “-d” shows the number of dropped packets, and

“-t” displays the value of watchdog timers.

netstat -w <interval> -d

[-I <interface>]

Displays packet traffic information on all interfaces every “<interval>”

seconds, or just on the specified interface if “-I <interface>” is included. If

“-d” is included, also indicates the number of dropped packets.

netstat -s [-s] [-z] [-f <family>]

[-p <protocol>]

Shows system-wide statistics for each of the protocols on the system

(which may be modified to show information for only a particular address

family or protocol). If the “-s” option is repeated, counters that have a

value of zero are suppressed; the “-z” option resets the statistics after

they are displayed.

netstat -i -s

[-f <family>] [-p <protocol>]

netstat -I <interface> -s

[-f <family>] [-p <protocol>]

Displays statistics as for “netstat -s” just above, but on a per-interface

basis rather than aggregated for the whole system.

netstat -m Outputs memory management routine statistics.

netstat -r [-Aa] [-f <family>]

[-n] [-W]

Displays the contents of the host’s routing tables. The options “-A” and “-

a” provide additional information about the routes.

netstat -rs [-s] Displays routing statistics; “-s” suppresses counters with a zero value.

UNIX netstat Universal Options and Parameters

Most of the options shown in these option groups are particular to those groups; for

example, you cannot use “-s” when issuing the command “netstat -i”. However, there are

also a number of universal options that can be used with more than one of these groups to

modify the behavior of netstat variations in a consistent way. These options are described in

Table 298.

Sample UNIX netstat Output

The netstat command can produce a startling amount of output, especially if you do not

restrict it with some of the options in Table 298. This is particularly true for netstat by itself

and with the “-s” option. In Table 299 I have shown sample output from running “plain”

netstat, but I have truncated the list of connections so it would not be too long (I also refor-

matted the table so it would display better). Notice the last column, which shows the current

state of the TCP connection (see, that TCP finite state machine stuff was useful after all! ☺)

netstat -g [-W] [-f <family>] Shows multicast routing information.

netstat -gs [-s] [-f <family>]

Shows multicast routing statistics; “-s” suppresses counters with a zero

value.

Table 298: Typical UNIX netstat Universal Options and Parameters

Option / Parameters Description

-f <family>

Limits the output of the command to information on a particular protocol

address family, for hosts running multiple protocol suites. For example,

the address family for regular TCP/IP is “inet”, while for IPv6 it is “inet6”.

Others may also be supported.

-p <protocol>

Restricts output to data related only to a particular protocol, such as IP,

TCP, UDP, or ICMP.

-n

Shows network addresses in numeric form, instead of showing them as

symbolic names. Also shows ports as numbers instead of converting

well-known UDP and TCP port numbers to the protocol names that use

them (for example, “23” rather than “telnet”).

-W

Suppresses the automatic truncation of addresses (which is sometimes

done for display formatting).

Table 297: Typical UNIX netstat Option Groups, Options and Parameters (Page 2 of 2)

Option Group, Options and

Parameters

Description

Table 300 shows an example of the output of “netstat -s”; here I have shortened the size of

the output by using “-p ip” to tell the program to only show me the statistics for the Internet

Protocol.

Table 299: Sample Connections List From UNIX netstat Utility

%netstat

Active Internet connections

Prot Rcv Snd Local Address Foreign Address (state)

tcp4 0 0 pcguide.com.http c-24-118-141-124.3384 ESTABLISHED

tcp4 0 827 pcguide.com.http webcacheB03a.cac.46075 ESTABLISHED

tcp4 0 0 qs36.smtp MV1-24.171.17.64.1339 ESTABLISHED

tcp4 0 0 pcguide.com.http 1Cust234.tnt1.le.1338 ESTABLISHED

tcp4 0 0 pcguide.com.http 1Cust234.tnt1.le.1337 FIN_WAIT_1

tcp4 0 84 pcguide.com.http dial81-131-97-70.2902 FIN_WAIT_1

tcp4 0 0 pcguide.com.http 216.76.14.221.9954 FIN_WAIT_2

tcp4 0 0 pcguide.com.http 216.76.14.221.9945 FIN_WAIT_2

tcp4 0 0 pcguide.com.http 1Cust234.tnt1.le.1326 TIME_WAIT