Reverse-resolved address ending with .bng?

Question

I routinely check netstat --tcp when ssh'ed into my server, but today found an odd hyphenated address format that I haven't seen before:

Proto   Recv   Sent   Local Address       Foreign Address            State
tcp6    0      0      mydomain.com:www    xxx-xxx-xxx-xxx.bng:xxxx   TIME_WAIT

It's like an ip address, x's represent numbers, but being hyphenated I thought it could've been a domain, except ".BNG" isn't a tld.

All i could turn up with google was cisco's "Broadband Network Gateway", so maybe something to do with my host?

Answer 1

The name you see is whatever is in the reverse DNS domain, and it doesn't have to be valid. The netadmin of the network can put in reverse DNS whatever he/she wants. If you want to know who is connecting to your server you should look at the IP addresses with netstat --tcp --numeric.

If you then want to know which organisation is the holder of the IP address you can use whois, which will show you who is the holder. The data is distributed over different whois servers, but a recent whois client will probably determine the right server automatically (I removed some of the output to make it more readable/understandble):

$ whois 37.77.56.75

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

NetRange:       37.0.0.0 - 37.255.255.255
CIDR:           37.0.0.0/8
OriginAS:
NetName:        RIPE-37
NetHandle:      NET-37-0-0-0-1
Parent:
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
RegDate:        2010-11-30
Updated:        2011-01-17
Ref:            http://whois.arin.net/rest/net/NET-37-0-0-0-1

ReferralServer: whois://whois.ripe.net:43


% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Information related to '37.77.56.64 - 37.77.56.95'

% Abuse contact for '37.77.56.64 - 37.77.56.95' is '[email protected]'

inetnum:        37.77.56.64 - 37.77.56.95
netname:        STEFFANN-OFFICE1
descr:          S.J.M. Steffann Office
country:        NL
admin-c:        SJMS-RIPE
tech-c:         SJMS-RIPE
status:         ASSIGNED PA
mnt-by:         STEFFANN-MNT
mnt-by:         STEFFANN-AUTO-MNT
source:         RIPE # Filtered

role:           SJM Steffann NOC contact
address:        Tienwoningenweg 46
address:        7312 DN  Apeldoorn
address:        The Netherlands
admin-c:        SJMS1-RIPE
tech-c:         SJMS1-RIPE
abuse-mailbox:  [email protected]
nic-hdl:        SJMS-RIPE
mnt-by:         STEFFANN-MNT
source:         RIPE # Filtered

% Information related to '37.77.56.0/21AS57771'

route:          37.77.56.0/21
descr:          S.J.M. Steffann
origin:         AS57771
mnt-by:         STEFFANN-MNT
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.60.2 (WHOIS3)

So here you can see that 37.77.56.75 belongs to network STEFFANN-OFFICE1, which is my office. You can also see that you should contact [email protected] when you see abuse from this network.