Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What steps would you take to discover all (or close to all) IP addresses that are currently used by a website? How would you be as exhaustive as possible without calling a website admin and asking for the list of IP addresses? ;)

nslookup works but will vary based on dns server queried.

whois is another good tool.

Dig, not bad.

Let's use Facebook for example. I'm blocking that site for the majority our our company's users, but some are approved for "research". I can not easily use OpenDNS because we all appear to come from the same request IP address. I could change that but don't want to add more vlans than I already have.

I also could use block something like regex facebook1 "facebook\.com" (I'm running a cisco firewall) but that's pretty easy to sidestep.

All that being said, I'm asking about specifically about finding ip addresses for a domain and not for other methods that I can block a domain name.

share|improve this question

closed as off-topic by Jenny D, Rex, Katherine Villyard, MadHatter, mdpc Apr 11 at 16:05

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Jenny D, Rex, Katherine Villyard, MadHatter, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

6 Answers

You cannot do it reliably. Larger sites like Facebook (or Google, etc) are using Anycast for their DNS servers so even if you lookup the domain in Whois to get the authoritative DNS server the responses may change from hour to hour or even query to query depending on which data center they want to serve you from.

For smaller sites, I would do a WHOIS on the domain, then do a NS query on each DNS server listed to get a complete list of all possible DNS servers for that domain. Finally, query each DNS server for the FQDN that you want the IP list for.

share|improve this answer
add comment
up vote 3 down vote accepted

After trying out quite a few options I discovered that centralops.net gives an incredible extensive result set for dns using their "Domain Dossier". Anyway, it gave me exactly what I needed to get all the facebook A records (and more).

http://centralops.net/co/.

Feeling like a tool for finally answering my own stale question.

share|improve this answer
add comment

One way of doing it ( I admit not bulletproof) would be to host -t a domain-name and then do a whois in the RIPE/ARIN database for all of those IPs to get the full net-range belonging to the certain website/company and block all of them.
(whois or http://cqcounter.com/whois/ )

share|improve this answer
add comment

This may not be exactly what you're looking for, however I find robtex (http://www.robtex.com/) to be useful for finding ips and ranges used.

share|improve this answer
add comment

or you can try http://atsameip.com/

share|improve this answer
add comment

You can do it reliably, but the list of IP addresses can and will change over time, so you have to do it again from time to time.

For blocking companies with lots of IP addresses, you first need to find their autonomous system number. This is relatively easy; it'll be in the whois record for any of their IP addresses.

These examples use GNU jwhois, which normally appears on Linux systems. You may have to massage the commands slightly for other whois clients.

$ host www.facebook.com
www.facebook.com is an alias for star.c10r.facebook.com.
star.c10r.facebook.com has address 173.252.120.6
star.c10r.facebook.com has IPv6 address 2a03:2880:2130:cf05:face:b00c:0:1
star.c10r.facebook.com mail is handled by 10 msgin.t.facebook.com.

$ whois -h whois.radb.net 173.252.120.6 | grep origin
origin:     AS32934
origin:     AS38621

Make sure it actually belongs to Facebook. If you're blocking a small website that doesn't have their own AS, you don't want to do this, as you'll block other people as well. For instance, not all of the ASNs returned above are actually Facebook's.

$ whois -h whois.radb.net AS32934
$ whois -h whois.radb.net AS38621

Now we know which is Facebook's ASN; let's get their IPv4 address ranges.

$ whois -h whois.radb.net -- -i origin -T route AS32934 | grep route: 

And finally their IPv6 address ranges.

$ whois -h whois.radb.net -- -i origin -T route6 AS32934 | grep route6:

Repeat for all their ASNs, if they actually have more than one.

This is just a demo to show how easily the information can be obtained. You can work these into a script at your convenience. Also note that some of the returned ranges may overlap; how you deal with this is between you and your firewall.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.