hostname and ip resolving to two different pages

grob115 · 02-13-2013, 10:21 AM

Hi, am playing around with the 'dig' tool and picked Google to experiment with. It appears from anyone of the following tests that the hostname 'vb-in-f139.1e100.net' and the IP '173.194.73.139' are the same box. However, if you type in the hostname and IP as they are in the browser, they get directed to different pages.

For me, the hostname gets resolved to 'www.google.com.hk' loading a page with an animated banner. The ip gets resolved to well ... itself and loaded up a page with just the "Google" static banner.

Any idea what's happening?

Lookup hostname vb-in-f139.1e100.net

Quote:

[root@www local]# dig vb-in-f139.1e100.net

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>> vb-in-f139.1e100.net
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35571
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;vb-in-f139.1e100.net. IN A

;; ANSWER SECTION:
vb-in-f139.1e100.net. 86196 IN A 173.194.73.139

;; Query time: 1 msec
;; SERVER: 66.96.80.194#53(66.96.80.194)
;; WHEN: Wed Feb 13 08:09:55 2013
;; MSG SIZE rcvd: 54

Look up IP 173.194.73.139

Code:

[root@www local]# dig -x 173.194.73.139

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>> -x 173.194.73.139
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27747
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;139.73.194.173.in-addr.arpa.   IN      PTR

;; ANSWER SECTION:
139.73.194.173.in-addr.arpa. 40172 IN   PTR     vb-in-f139.1e100.net.

;; Query time: 1 msec
;; SERVER: 66.96.80.194#53(66.96.80.194)
;; WHEN: Wed Feb 13 08:05:21 2013
;; MSG SIZE  rcvd: 79

Lookup hostname for IP 173.194.73.139

Code:

[root@www local]# nslookup 173.194.73.139
Server:         66.96.80.194
Address:        66.96.80.194#53

Non-authoritative answer:
139.73.194.173.in-addr.arpa     name = vb-in-f139.1e100.net.

Authoritative answers can be found from:

Ping hostname vb-in-f139.1e100.net

Code:

[root@www local]# ping vb-in-f139.1e100.net
PING vb-in-f139.1e100.net (173.194.73.139) 56(84) bytes of data.
64 bytes from vb-in-f139.1e100.net (173.194.73.139): icmp_seq=1 ttl=48 time=35.9 ms

--- vb-in-f139.1e100.net ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 35.951/35.951/35.951/0.000 ms

TenTenths · 02-13-2013, 10:39 AM

Quote:

Originally Posted by grob115

Any idea what's happening?

Yes.

It's perfectly acceptable and normal for this to happen with a web server. There can easily be hundreds of different hostnames pointing to an IP address but there will usually only be one "reverse" of the address.

In the http protocol the browser specifies in the request the hostname that it wants the content for when it makes a connection to the web server.

If the hostname isn't specified, for example if you use just http:// and the IP address then the web server will either have a default config that's used for just the IP or may deny the request.

For example: www.ten-tenths.com and www.marshalsguide.com both resolve to 188.138.103.171. If you reverse 188.138.103.171 you'll get www.ten-tenths.com returned.

If you access either of those sites by hostname then you'll get the respective site, if you access it by IP address http://188.138.103.171 then because of the way the server is configured you'll get the www.ten-tenths.com site.

grob115 · 02-13-2013, 01:46 PM

Ah thanks. Excellent explanation. Reminds me of Apache virtual hosts all on the same network interface.

TenTenths · 02-13-2013, 02:14 PM

Exactly what it is.