Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to see what nodes exist under a certain domain from within the domain. Short of querying every valid ip address within that domain, is there a way to get all records/map the network?

share|improve this question

Typically zone transfers are denied if the server is properly configured. You can do a zone transfer via dig:

dig @ AXFR

You can also use nslookup:

nslookup -query=AXFR

If you are not the administrator, you might be better off contacting your IT department for further details.

share|improve this answer

As warner mentioned (that's becoming familiar), zone transfers are othen denied for security reasons. If the name servers aren't something you have access to you can attempt to discover the most common subdomains of a given domain using one of the popular DNS bruteforce scripts. They work by performing DNS requests against a local nameserver using a user supplied dictionary list. Dictionary lists exist solely for this purpose.

  • Note if this reply is against the user agreement just delete it, sorry. *

WS-DNS-BFX is one such script (perl and threaded I believe).

share|improve this answer
ah. Ultimately I'm trying to figure out a way to 'bounce' packets around a network to search for services that are not advertised and don't have a fixed location. I don't want to flood my network, though, so brute-force isn't the best option. – mechko Mar 1 '10 at 20:08
Do you have access to the DHCP server logs? You can use the lease table to determine which IPs should be further scanned with nmap for whatever services your looking for. You can also scan a network for bonjour,avahi,zeroconf. As well as just nmap the whole subnet(this can be done slow or fast). If it's a flat network you can just iterate through all the IPs doing arp lookups to discover hosts to further scan. Your initial post made it seem like it was limited to a specific domain name, not network. The most obvious tool that comes to mind is nmap with the "-PN" switch for starters. – CarpeNoctem Mar 2 '10 at 2:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.