2

I got three different IP addresses when trying to resolve a domain name three times. All three of these pings happened within seconds of one another. Is this normal? I wouldn't think DNS servers could be updated so quickly, so my guess is that this is something to do with load-balancing.

So far, I've only noticed this with bestbuy.com, and I tried it because a friend was reporting that he was redirected to Best Buy Turkey, and Best Buy Korea when visiting bestbuy.com last night.

G:\>ping bestbuy.com

Pinging bestbuy.com [77.67.19.107] with 32 bytes of data:...

G:\>ping bestbuy.com

Pinging bestbuy.com [69.31.49.74] with 32 bytes of data:...

G:\>ping bestbuy.com

Pinging bestbuy.com [69.31.49.73] with 32 bytes of data:...
2
  • probably better for ServerFault.
    – James
    Aug 13, 2010 at 17:52
  • Noted. Sorry about posting in the wrong forum, but thanks for the replies, Guys. Aug 13, 2010 at 18:15

4 Answers 4

7

(Probably a better question for serverfault, but...)

If you do an nslookup on bestbuy.com:

localhost /home/me > nslookup
Default Server:  #############.com
Address:  192.168.252.11

> bestbuy.com
Server:  ####################.com
Address:  192.168.252.11

Non-authoritative answer:
Name:    bestbuy.com
Addresses:  77.67.19.120, 77.67.19.107

>

Note that there are multiple ip addresses that correspond to this ip name. The primary purpose of this is to provide a failover. If one of their web farms goes DOA, then the other will continue to accept inbound traffic. The positive side effect of this is that when everything is operating normally, they can share the traffic load between two farms.

3

Wrong site for this question, but my guess is load balancing

3

The reason for this is because the zonefile for the bestbuy.com zone contains multiple A records for the entry @ eg:

@                IN        A         77.67.19.120
@                IN        A         77.67.19.107 

This is done for load balancing purposes.

3

Look at dig:

# dig bestbuy.com

; <<>> DiG 9.5.0-P2.1 <<>> bestbuy.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 395
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;bestbuy.com.                   IN      A

;; ANSWER SECTION:
bestbuy.com.            20      IN      A       173.223.232.48
bestbuy.com.            20      IN      A       173.223.232.98

;; Query time: 52 msec
;; SERVER: 72.249.191.254#53(72.249.191.254)
;; WHEN: Sat Aug 14 14:26:35 2010
;; MSG SIZE  rcvd: 61

As pointed above, they do it for load balancing, fail over, etc... But it's a pretty unsafe way of doing it because DNS load balancing works close to round robin: every time you ask for a hostname, the DNS server answers with one of the pool (like you see happening in your ping). Unfortunately, it means that in case of one of the "servers" goes down, half of the requests will fail.

It's better to implement that using a true load balancer, or a VIP (virtual ip).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .