Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I got three different IP addresses when trying to resolve a domain name three times. All three of these pings happened within seconds of one another. Is this normal? I wouldn't think DNS servers could be updated so quickly, so my guess is that this is something to do with load-balancing.

So far, I've only noticed this with bestbuy.com, and I tried it because a friend was reporting that he was redirected to Best Buy Turkey, and Best Buy Korea when visiting bestbuy.com last night.

G:\>ping bestbuy.com

Pinging bestbuy.com [77.67.19.107] with 32 bytes of data:...

G:\>ping bestbuy.com

Pinging bestbuy.com [69.31.49.74] with 32 bytes of data:...

G:\>ping bestbuy.com

Pinging bestbuy.com [69.31.49.73] with 32 bytes of data:...
share|improve this question

migrated from stackoverflow.com Aug 14 '10 at 16:37

This question came from our site for professional and enthusiast programmers.

    
probably better for ServerFault. –  James Aug 13 '10 at 17:52
    
Noted. Sorry about posting in the wrong forum, but thanks for the replies, Guys. –  Mike M. Lin Aug 13 '10 at 18:15

4 Answers 4

up vote 5 down vote accepted

(Probably a better question for serverfault, but...)

If you do an nslookup on bestbuy.com:

localhost /home/me > nslookup
Default Server:  #############.com
Address:  192.168.252.11

> bestbuy.com
Server:  ####################.com
Address:  192.168.252.11

Non-authoritative answer:
Name:    bestbuy.com
Addresses:  77.67.19.120, 77.67.19.107

>

Note that there are multiple ip addresses that correspond to this ip name. The primary purpose of this is to provide a failover. If one of their web farms goes DOA, then the other will continue to accept inbound traffic. The positive side effect of this is that when everything is operating normally, they can share the traffic load between two farms.

share|improve this answer

Wrong site for this question, but my guess is load balancing

share|improve this answer

The reason for this is because the zonefile for the bestbuy.com zone contains multiple A records for the entry @ eg:

@                IN        A         77.67.19.120
@                IN        A         77.67.19.107 

This is done for load balancing purposes.

share|improve this answer

Look at dig:

# dig bestbuy.com

; <<>> DiG 9.5.0-P2.1 <<>> bestbuy.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 395
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;bestbuy.com.                   IN      A

;; ANSWER SECTION:
bestbuy.com.            20      IN      A       173.223.232.48
bestbuy.com.            20      IN      A       173.223.232.98

;; Query time: 52 msec
;; SERVER: 72.249.191.254#53(72.249.191.254)
;; WHEN: Sat Aug 14 14:26:35 2010
;; MSG SIZE  rcvd: 61

As pointed above, they do it for load balancing, fail over, etc... But it's a pretty unsafe way of doing it because DNS load balancing works close to round robin: every time you ask for a hostname, the DNS server answers with one of the pool (like you see happening in your ping). Unfortunately, it means that in case of one of the "servers" goes down, half of the requests will fail.

It's better to implement that using a true load balancer, or a VIP (virtual ip).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.