Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found this fun little example of traceroute being used to output Star Wars stuff.

It came from http://beaglenetworks.net originally.

% traceroute -m 100 -U -p 3550 obiwan.scrye.net
traceroute to obiwan.scrye.net (216.81.59.173), 100 hops max, 60 byte packets
 1  pfsense.zeebox.com (192.168.1.1)  0.185 ms  0.136 ms  0.114 ms
 2  ser014173.thca.uk.exponential-e.net (83.244.231.177)  19.416 ms  23.226 ms  24.093 ms
 3  1-1-2.pr01.thca.uk.exponential-e.net (195.66.224.186)  15.108 ms  15.090 ms  15.072 ms
 4  10gigabitethernet1-1.core1.lon1.he.net (195.66.224.21)  14.979 ms  14.999 ms  17.027 ms
 7  10gigabitethernet1-2.core1.atl1.he.net (184.105.213.110)  115.214 ms  101.668 ms  108.998 ms
 8  216.66.0.26 (216.66.0.26)  101.521 ms  109.526 ms  109.521 ms
 9  * * *
10  Episode.IV (206.214.251.1)  148.498 ms  149.193 ms  149.059 ms
11  A.NEW.HOPE (206.214.251.6)  149.804 ms  144.125 ms  148.881 ms
12  It.is.a.period.of.civil.war (206.214.251.9)  147.718 ms  145.229 ms  145.045 ms

So the first couple of IP addresses seem to be resolving via DNS.

But the later ones are definitely not TLD based.

Later on, even more obviously so.

52  0------------------0 (206.214.251.97)  146.877 ms  153.889 ms  146.824 ms

So where are these names coming from? Is it just a formatting trick or are they being resolved in another manner.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

It seems that they have just entered the story in the DNS PTR records (line by line), and chained the routers to forward packets as the story goes.

Although it's not "nice", but you can enter almost anything (no spaces etc.) in the PTR field. It does not have to be a valid TLD (since valid TLDs are added/removed every now and then, and internal pages such as http://intranet/ would fail, if there was any validity checking implemented in both DNS and rDNS)

;; ANSWER SECTION:
1.251.214.206.in-addr.arpa. 242 IN      PTR     Episode.IV.

Edit: Reverse DNS - PTR records

share|improve this answer
    
Ah, so traceroute looks at the PTR field first then? –  Bryan Hunt Feb 27 '13 at 11:03
    
Traceroute get's the routers IP address, and (by default) checks the PTR record, to get the domain name for that IP. Added link to rDNS –  mulaz Feb 27 '13 at 11:05
add comment

The last few are genuine reverse DNS records, they just don't point to valid FQDNs.

DNS can be used to go from and FQDN -> IP (forward lookup) and IP -> FQDN (reverse lookup).

Each direction is a separate database of mappings. In general they are configured symmetrically but that is not mandated and in particular a single IP address can be associated with a number of different FQDNs so when you do the reverse lookup of the IP, you may only get a single FQDN

If you run the command ping -a <IP address> it does a reverse lookup so an example of one of the IPs above:

ping -a 206.214.251.49

Pinging an.armored.space.station [206.214.251.49] with 32 bytes of data:
share|improve this answer
    
This isn't legal. But as PTR records are usually missing or badly mangled, and not to be trusted, most software just don't use them for real. –  vonbrand Feb 27 '13 at 12:53
    
Legal is a strong term, I think what you are implying is it is not RFC compliant? –  drinxy Feb 28 '13 at 7:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.