Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I verify, when I parse a packet, whether the IP address for the packet is one from a specific DNS name that for has many IP's listed (i.e. this DNS name does a round robin type approach & is acting as the main company proxy server DNS name - however it hands off to one of many actual proxy servers in real time)


share|improve this question
up vote 1 down vote accepted

Well I suppose you are doing it on a script or program, but if you can use the dig tool you can check all the IP address listed for a name:

# dig +short

I suppose you can get it using a function or method in your preferred language.

share|improve this answer
@coredump - this would be great if it worked and worked consistently. When I run the same dig command against google, interestingly enough, I only get one result which is curious. Do you know how robust this approach would be? Would it work with all DNS servers for example (i.e. would DNS servers typically respect providing back the full list of IPs?). – GregH Aug 16 '10 at 11:56
Probably because Google uses some kind of geographic load balancing. Maybe in my country it answers with a certain list of IPs, while in other countries it answers with another list. That will happen with Akamai or other CDN services as well, AFAIK. About it working with other DNS servers, if they follow the DNS spec they will answer the full list. – coredump Aug 16 '10 at 14:57
unfortunately doesn't seem to work on our DNS server - just hands back one – GregH Aug 16 '10 at 23:49
If it's an internal thing, maybe you can do a zone transfer from the server and check it against the result? – coredump Aug 17 '10 at 2:46
@coredump - I'm not familiar with "zone transfer", however would I be right in saying it would require some level admin access to the company DNS? (i.e. as this would not be the case for my scenario). In which case would this mean there's no robust way to get the full list of IP's then? thanks again – GregH Aug 17 '10 at 23:51

This is not going to be possible at the Layer 3/4 level. It is possible that the packet payload may contain the DNS name that, but that depends on the application (e.g. HTTP replies contain a HOST field, but this is only in the header - additional packets will not contain the information).

share|improve this answer
thanks - no other ideas then re how to distinguish internet bound (i.e. via proxy) traffic packets from internal traffic (note in a large internal network with multiple sub-domains)? – GregH Aug 16 '10 at 11:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.