NSLookUp using CLI in windows [closed]

Question

My question is an amateur one. I'm looking at traffic going to and from my computer. When I find an IP address that looks suspicious I use NSLookup on it.

If I was to say put random IP addresses in and get strange domain names back from dodgey websites, could my pc get infected, or can the web masters trace it back to me? What exactly do they see on the other end of a NSLookup?

Answer 1

NSlookup is a DNS lookup tool. It can be used in interactive mode to query many different record types but, when used from the command line, it will either try to perform a standard forward-lookup of an IP based on the provided host name or a reverse lookup if the input is an IP address.

So, if you enter a random IP address, here is what happens:

• The byte groups will be reverted (1.2.3.4 becomes 4.3.2.1)
• The fixed DNS name ".in-addr.arpa." will be appened at the end of the reversed IP string.
• The result is processed like a regular DNS query except that it's looking for a PTR record type.

So, assuming you type in "nslookup 1.2.3.4", you will generate a DNS query for "4.3.2.1.in-addr.arpa.". This request will then be processed by one of the DNS servers of all the following domains:

arpa.
in-addr.arpa.
1.in-addr.arpa.
2.1.in-addr.arpa.
3.2.1.in-addr.arpa.

The first two DNS servers are part of the global Internet infrastructure and is handeled by IANA. Since the same organisation also supervise IP address assignment (as well as the global DNS root), it is the authority that can (and will) delegate the management of the others servers in the query path to the respective owners of the IP block.

An interesting thing to note is that your computer is not going to perform all these queries itself. Typically, it will place the request to your local DNS server which will perform the query for you completely and just supply you with the answer (it will perform a recursive DNS query). After that, it gets fuzzy because it all depends on how each server in the query path is configured.

So, what it means is:

• You're not infected by anything, at least not based on the fact that feeding random IP addresses to nslookup will return (random) answers.
• Since pretty much all DNS server will generate some log, you will leave a trace of your queries in multiple hosts. In the "worse" case, your query will contain your own public IP address and be forwarded to each server in the chain. At each step, anyone reading the log can see traces of your request and see who requested it (you or the last server you used that was configured for answering recursive queries). And in case you're asking, this is usually pretty easy to trace back if the law enforcement are involved (at least back to your ISP).

For more information, I suggest you start with the wikipedia article about the DNS system and, if you're really interested, go on with reading the first few of the numerous RFCs related to DNS (listed in the the wikipedia article but the most interesting ones are probably 1034, 1035 and 1591.