Networking Basics - NSLookup

NSLookup means Name Server Lookup, and provides you with the DNS name associated with an IP you dont know in addition to the name of the DNS server it fetched that information from.

NSLookup is widely complained about, because >

1. NSLookup requires reverse DNS to be configured.
   If there is a DNS problem it will most likely effect Reverse DNS too, or reverse DNS may not be configured at all.
   
   
2. NSLookup and PING results can differ >
   Ping consults WINS and any HOSTS files present on a client. NSLookup does not.
   
   
3. NSLookup uses different timeouts and queries available name servers in a different order to other tools when attempting name resolution.

Some examples >

C:\>nslookup 10.4.1.7
Server: ukns01.domain.co.uk
Address: 172.16.254.9

Name: dev008.it.domain.co.uk
Address: 10.4.1.7

Omitting parameters put it into interactive mode (note the '>' rather than the DOS command prompt ) >

C:\>nslookup
Default Server: ukns01.domain.co.uk
Address: 172.16.254.9

>

Then, entering some IPs >

> 10.4.1.7
Server: ukns01.domain.co.uk
Address: 172.16.254.9

Name: dev008.it.domain.co.uk
Address: 10.4.1.7

> 127.0.0.1
Server: ukns01.domain.co.uk
Address: 172.16.254.9

Name: localhost
Address: 127.0.0.1

> ls
Server: ukns01.domain.co.uk
Address: 172.16.254.9

The LS command dumps all IPs and servernames the server knows for A & NS record types >

> ls domain.co.uk
[ukns01.domain.co.uk]
domain.co.uk. A 10.10.255.26
domain.co.uk. A 10.10.255.101
domain.co.uk. A 172.16.254.9
domain.co.uk. A 172.16.254.8
domain.co.uk. A 10.10.0.248
domain.co.uk. A 10.10.255.5
domain.co.uk. A 10.59.0.4
domain.co.uk. A 10.10.255.1
domain.co.uk. NS server = uk-dc-1.domain.co.uk
domain.co.uk. NS server = uk2ns02.domain.co.uk
domain.co.uk. NS server = ukns01.domain.co.uk
gc._msdcs A 10.10.255.1
gc._msdcs A 10.47.255.4
gc._msdcs A 10.47.255.2
gc._msdcs A 10.110.255.1
gc._msdcs A 10.128.17.4
gc._msdcs A 10.47.255.10
bacs A 10.10.255.34
bcd NS server = bcd-mail.bcd.domain.co.uk
uk1app01 A 172.29.0.11
uk1app03 A 172.29.0.27
uk1app05 A 172.28.0.6
uk1bacs01 A 172.16.254.16
uk1cpu01 A 172.16.254.35
uk1db01 A 172.29.0.17
uk1ddb01 A 172.29.0.25
uk1dist01 A 172.29.0.8
uk1file01 A 172.29.0.9
uk1rdac01 A 172.29.0.97
uk1rdac03 A 172.29.0.99
uk1rdac05 A 172.29.0.113
uk1sds01 A 172.29.0.13
uk1tdb01 A 172.29.0.21
uk1TSQL A 172.29.0.139
uk1tweb01 A 172.29.0.31
uk1tweb05 A 172.29.0.115
uk1udb01 A 172.29.0.29
uk2dist02 A 172.29.0.2
uk2file02 A 172.29.0.48
uk2file04 A 172.29.0.60
uk2tapp02 A 172.28.0.66
uk2tdb02 A 172.29.0.18
uk2tweb02 A 172.29.0.16
uk2udb02 A 172.29.0.20
uk2uweb02 A 172.29.0.24
uk1ext01 A 193.19.89.11
uk1ext03 A 193.19.89.2
uk1ext05 A 193.19.89.4
uk2ldap02 A 172.16.254.6
uk2mom02 A 172.29.0.124
uk2ns02 A 172.16.254.8
uk2tsp04 A 193.19.88.164
uk2tstbkp02 A 172.29.0.134
uk2vbe02 A 172.16.254.18
uk2wfl02 A 193.19.88.138
uk3CA01 A 10.10.255.21
uk3xvc01 A 10.10.255.35
ukhq NS server = ukhq-pdc.ukhq.domain.co.uk
ukhq-pdc.ukhq A 10.47.255.2
ukhqcsips01 A 10.10.255.41
ukHQCSIPS02 A 10.10.255.40
ukintranet A 212.95.233.40
ukit NS server = uk2ns02.domain.co.uk
ukit NS server = ukit-server.ukit.domain.co.uk
ukit-server.ukit A 10.4.255.2
ukit-server A 10.4.255.2
ukitcsdr01 A 10.4.1.54
uksharepoint A 10.10.255.20
uktestsp01 A 10.10.255.12
ukukdc1amd01 A 172.16.254.73
ukukdc1apn01 A 172.16.254.67
ukukdc1vas01 A 172.16.254.71
ukukdc2amd02 A 172.16.254.72
bsl NS server = bsl-mail.bsl.domain.co.uk
bsl-mail.bsl A 10.110.255.1
bsrdb A 172.29.0.249
dr.build A 10.10.0.7
live.build A 172.29.0.41
test.build A 10.10.0.7
buildsystem A 172.28.0.4
vm.buildsystem A 172.27.3.2
ca A 172.27.0.3
Canon0A59E7 A 10.10.1.55
Canon0A78B8 A 10.47.1.48
Sharepoint A 193.19.88.154
dev.Sharepoint A 10.10.255.12
hq.Sharepoint A 193.19.88.154
ithq.Sharepoint A 193.19.88.154
test.Sharepoint A 193.19.88.164
dc1sdb.sj A 172.28.0.34
dc2sdb.sj A 172.28.0.35
sdb.sj A 172.28.0.36
vm.sdb.sj A 172.27.3.7
staging A 193.19.88.135
stats A 193.19.88.147
webmail A 193.19.88.36
webqa A 193.19.88.135
webtrends A 193.19.89.2
webusagereport A 172.29.0.49
www A 193.19.89.12
XEROX3545 A 10.128.18.46
>

Changing the type of query to see what is handling email (MX records) in the domain >

> ls -t mx domain.co.uk
[ukns01.domain.co.uk]
domain.co.uk. MX 30 uk2ex03.domain.co.uk
domain.co.uk. MX 10 uk1ex01.domain.co.uk
domain.co.uk. MX 20 uk1ex02.domain.co.uk

To exit the interface >

> exit