69

What's the command to find the name of a computer given its IP address?

I always forget what this command is, but I know it exists in Windows and I assume it exists on the *nix command-line.

13 Answers 13

54

dig and host should be what you're looking for ;)

http://www.unix.com/unix-dummies-questions-answers/9866-nslookup-linux.html

On *nix system you can do this command : dig -x [address]

Alternatively you can add +short at the end of the dig command to output only the dns result.

On Windows, use nslookup

EDIT : nslookup work too on *nix systems. More infos on nslookup command whether it seems to have been replace since a while now : http://linuxreviews.org/man/nslookup/

  • The same syntax also works with the drill utility from ldns, i.e. drill -x 123.123.123.123 – Tullo_x86 Sep 19 at 1:42
51

On *nix you can use:

dig -x [address]
  • 16
    This definitely seems to be the easiest way. Add +short at the end to return nothing but the rdns result. dig -x [address] +short – ColinM Mar 1 '12 at 3:36
  • 3
    That +short flag is really useful! – Neil Sep 13 '12 at 13:59
  • Does this work with IPv6 addresses? – Geremia Sep 12 '16 at 3:35
  • @ColinM Good point. I've edited my answer based on this. Thanks! – Marc-Andre R. Apr 25 '17 at 11:14
  • Yes, @Geremia, according to man dig, The addr is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. – Ricardo Aug 21 '18 at 22:18
8

On most of the Linux systems that I am aware of you can use:

 nslookup <ip-number EX: 127.0.0.1>

will work on the command line.

Come to think of it, isn't nslookup available on Windows XP?

  • Yes, indeed. And in previous versions of Windows. – kubanczyk Jul 1 '09 at 18:30
3

I'm well aware that dig/host/nslookup are the standard tools for these, but I keep these around for testing the OS's resolution (essentially, to test nsswitch.conf is working correctly):

gethostbyname:

#!/usr/bin/perl

use Socket;

my @t = gethostbyname($ARGV[0]);
print "\$name     = $t[0]\n"; shift(@t);
print "\$aliases  = $t[0]\n"; shift(@t);
print "\$addrtype = $t[0]\n"; shift(@t);
print "\$length   = $t[0]\n"; shift(@t);

foreach (@t) {
  print "          = ", inet_ntoa($_), "\n";
}

gethostbyaddr:

#!/usr/bin/perl

use Socket;

my @t = gethostbyaddr(inet_aton($ARGV[0]), AF_INET);
print "\$name     = $t[0]\n"; shift(@t);
print "\$aliases  = $t[0]\n"; shift(@t);
print "\$addrtype = $t[0]\n"; shift(@t);
print "\$length   = $t[0]\n"; shift(@t);

foreach (@t) {
  print "          = ", inet_ntoa($_), "\n";
}

example:

g3 0 /home/jj33/swap > gethostbyname www.google.com
$name     = www.l.google.com
$aliases  = www.google.com
$addrtype = 2
$length   = 4
          = 72.14.205.147
          = 72.14.205.103
          = 72.14.205.104
          = 72.14.205.99
g3 0 /home/jj33/swap > gethostbyaddr 72.14.205.147 
$name     = qb-in-f147.google.com
$aliases  = 
$addrtype = 2
$length   = 4
          = 72.14.205.147
  • 4
    you can do "getent hosts [IP or HOSTNAME]" – hayalci May 27 '09 at 9:44
  • Hmmm... I wrote the tools originally just to play with the functions, so no loss there but I certainly wouldn't have pasted them into serverfault if I had known about the getent tool. Thanks for the pointer. – jj33 May 27 '09 at 14:06
  • -1: they are limited to IPv4, gethostbyname does not retrieve IPv6 addresses when they exist and gethostbyaddr does not accept IPv6 addresses. – bortzmeyer Sep 23 '09 at 7:14
  • These functions are many years obsolete. They were even obsolete when this was written. In perl and most other languages you should be using getaddrinfo and getnameinfo. – Michael Hampton Feb 3 '16 at 23:58
3

On Windows I got in to the habit of using:

ping -a <ip address>

as this will also reflect data from your hosts file and WINS and so on.

3

This question already has a million answers, but I'm gonna add another one. Here's a little function I wrote for easily doing reverse DNS with dig. Add this to your ~/.bashrc file, reload your shell, and then you can do reverse DNS lookups with revdns 1.2.3.4:

function revdns() {
    octets=""
    addr="in-addr.arpa"

    # split the IP address into an array of octets
    IFS="." read -r -a octets <<< "$1"

    # add each octet to our $addr string in reverse order
    for octet in "${octets[@]}"; do
         addr=$octet"."$addr
    done

    # run a DNS pointer lookup with dig
    # `+short` makes dig's output very terse (un-verbose)
    # `"${@:2}"` passes any extra params from this command to dig
    dig ptr +short $addr "${@:2}"
}

Reverse DNS lookups are done by checking the pointer (PTR) records. If you wanna do reverse DNS for "1.2.3.4", you have to lookup pointer records for "4.3.2.1.in-addr.arpa". My function takes in an IP address, reverses the order of the octets (i.e. changes it from 1.2.3.4 to 4.3.2.1), and then uses dig to execute the PTR lookup I just described.

You can, of course, just use nslookup 1.2.3.4 if you have it, but I prefer this dig-based solution because it uses the OS' DNS servers instead of nslookup-provided ones (if you want, by the way, you can add additional dig flags when you call revdns, and they will get passed to dig)

  • According to its help dig -x dot-notation is the "shortcut for reverse lookups". I was wondering what the long version would be. Thanks for explaining! :) – webwurst Jul 11 '18 at 15:43
  • from man dig: When the -x is used, there is no need to provide the name, class and type arguments. dig automatically performs a lookup for a name like 94.2.0.192.in-addr.arpa and sets the query type and class to PTR and IN respectively. – Ricardo Aug 21 '18 at 22:15
2

Try "host"

  • Forward lookup with host:

    $ host google-public-dns-b.google.com.
    google-public-dns-b.google.com has address 8.8.4.4
    google-public-dns-b.google.com has IPv6 address 2001:4860:4860::8844
    
  • Reverse lookup with host:

    $ host 8.8.4.4
    4.4.8.8.in-addr.arpa domain name pointer google-public-dns-b.google.com.
    

Similar to dig

  • Forward lookup with dig:

    $ dig google-public-dns-b.google.com. +short
    8.8.4.4
    
  • Reverse lookup with dig:

    $ dig -x 8.8.4.4 +short
    google-public-dns-b.google.com.
    
1

If you're using nslookup it's this (assuming 192.168.0.1 as the IP in question)

> set type=ptr
> 1.0.168.192.in-addr.arpa

EDIT: Remember a reverse lookup only works if there is a PTR record created for the IP, and it's not guaranteed to return the hostname you're looking for. Completely depends on how DNS is configured and maintained in your situation.

  • 5
    nsloookup is no longer maintained and its authors recommend dig. Besides, dig -x is much simpler than inversing the bytes yourself. – bortzmeyer May 12 '09 at 13:23
  • That's good to know, thanks a lot for the input! Old habits die hard ;) – squillman May 12 '09 at 13:47
1

Powershell:

[net.dns]::gethostentry("69.59.196.212").HostName
0

Well, some friendly person just wrote nslookup is the command, and he's right. It works on both Unix and Windows. Not sure why you deleted your answer, but you are correct sir.

  • err, maybe not. – Peter Turner May 11 '09 at 15:57
  • Yeah well, I did post a bit fast, and after a check I wasn't sure at all of my answer, I just put back my post and edit it to add more details ;) – Marc-Andre R. May 11 '09 at 15:58
  • OK, it is, but it isn't I'm accepting that answer. Too bad we can't get that real time Googley AJAX here. – Peter Turner May 11 '09 at 15:59
  • lol yeah well, we can't have everything ;) Have a nice day, I hope I help you ;) – Marc-Andre R. May 11 '09 at 16:05
0

I prefer the command-line dig for Windows (available here: http://members.shaw.ca/nicholas.fong/dig/) to nslookup any day.

If you have to test/administer DNS from a Windows workstation, grab this tool. Then:

C:\dig>dig -x <IP Address>

...also, remember to add c:\dig to your path!

0

Her's my take on a more complete DNS reverse lookup. Hope this will come in handy to future viewers of this page.

for ip in {1..254..1}; do dig -x 1.1.1.$ip | grep $ip >> dns.txt; done;
-1

nbtstat -a < ip address >

  • nbstat isn't a DNS utility but rather WINS/NetBIOS – user2320464 Feb 4 '16 at 1:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.