3

I built the getaddrinfo() sample provided at http://beej.us/guide/bgnet/html/multi/syscalls.html#getaddrinfo

When I run it on an example domain, such facebook.com it lists three (3) IP address:

  IPv4: 69.63.189.11
  IPv4: 69.63.189.16
  IPv4: 69.63.181.12

I know, however, that there are quite a few more addresses (at least 20) for facebook.com as the following answer suggests:

http://wiki.answers.com/Q/Discuss:What_is_the_IP_address_for_Facebook

That answer is a snapshot in time and could change in the future. I would like to be able to implement some code that would list all the IP addresses used by a domain at the time running that code.

Is there a way to accomplish that? If so, how?

Improve this question

3 Answers 3

Reset to default
3

You could use a transparent proxy upstream of the computer(s).

For single computers, I've also used the hosts file and a special DNS server to poison DNS records by creating a false entry for facebook.com and www.facebook.com. I point it to a page somewhere with a page saying "You've been busted."

This works okay until your users figure out how to use anonymous proxies.

After a couple of steps, this really becomes a human issue. If at a business, it becomes a business policy and falls under HR. If at home, watch your kids' computer time.

Improve this answer
3
  • 2
    +1 for this, especially the point about policy: in my experience, completely blocking social networking had a negative productivity effect as people complained to their managers, some users tried to circumvent it by looking for proxies or tethering to their smart phones, etc. So what I've been doing now is setting up transparent proxies, logging activity, letting managers view how much time their staff are spending on any given site and dealing with it accordingly.
    – gravyface
    Oct 18, 2010 at 12:53
  • Keith, thanks for your answer. I agree with your comments about the "human issue" but currently its irrelevant to the case I am trying to solve. Can you recommend such a transparent proxy (to run locally, on a single computer)?
    – Android Eve
    Oct 18, 2010 at 14:47
  • You could look at some of the parental control programs and see if they serve your needs. NetNanny is highly recommended and has been around for years.
    – Keith Stokes
    Oct 19, 2010 at 12:45
10

There is not, because it's likely that the DNS server for facebook.com is only serving you with those three: it's simply not telling you about the others.

This is done for many reasons: some servers will be located close to you, geographically, and so the DNS server will prioritise those IPs to you. As a measure to curb potential DoS attacks, the DNS servers will ensure that no one person can ever know about "all" the IPs that facebook.com uses.

But mostly it's about load-balancing. Try again in an hour and you'll probably get three different IPs. This is because they want to spread the load amoung all of their servers and so the DNS will prioritize hosts that aren't getting as much traffic over those that are getting more.

Improve this answer
1
  • +1 for the explanation which makes a lot of sense to me. Indeed, nslookup provides different answers at different times. I can't say that I am happy with the answer, because I am trying to find a way to block a certain domain. I know I can do that via /etc/hosts but that requires reboot or at least closing all browser instances. Is there a better way of accomplishing this?
    – Android Eve
    Oct 18, 2010 at 1:36
2

Depending on dns settings it might not be possible to get all ips. Some services do not expose all host entries for all locations. That is, even if you get all dns entries for a domain you may only get entries related to your specific location.

And I was just about to add round-robin situations but as Dean stated, you will probably get three other ips if you try again. I also did a fast lookup on facebook.com and they have a couple of extra dns security features making it even harder to get any additional info.

Improve this answer
4
  • Getting only entries related to my specific location is perfectly fine in my case. I know, however, that even when dealing with a specific DNS at a specific moment, that DNS provides more IP addresses than the getaddrinfo() sample provides. For example, I just typed 'nslookup www.facebook.com' and received '66.220.147.44'.
    – Android Eve
    Oct 18, 2010 at 1:30
  • Usually you are able to use nslookup to get a somewhat complete list of dns records. I also noticed that there was another entry for the www record then the .facebook record. The www record just serves one round robin adress while the .facebook record serves three (probably static ips). A lookup for the domain name (facebook.com) is often not related to the www record -and without the ability to get the complete list of entries you are kindo stuck with the current round-robbin ips.
    – Simon Karlsson
    Oct 18, 2010 at 2:01
  • OK - so what is the right way of blocking a domain from being accessed on a given computer without requiring a restart of the browser? I know this is possible because there already are several applications (for Windows) that do that. As I mentioned in an earlier comment, modifying /etc/hosts is straightforward but it requires restarting the browser. I want to do this as painless as possible for the lay user. What is the best way to accomplish that?
    – Android Eve
    Oct 18, 2010 at 3:49
  • What you're looking for is webfiltering, there are no easy answers, as it all adds to infrastrcuture. But if you use it as a transparent proxy that'll help.
    – Tubs
    Oct 20, 2010 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .