5 ms·

> every customer's IP resolves back to localhost What does this even mean? First of all, what does it mean than an IP resolves to a hostname? I thought it's t

by hasenj 12y ago

> every customer's IP resolves back to localhost What does this even mean? First of all, what does it mean than an IP resolves to a hostname? I thought it's the otherway around: hostnames resolve to IPs. Second, isn't this .. normal? localhost is always your local machine. Please help me understand

forkerenok 12y ago
The OP article probably means rDNS lookup, where IP is resolved to DNS name. For consumer IP's it would look something like 12-23-45-234.gw123.vietnamtelecom.net. Edit: which usually gives a better idea of the host's origin than raw IP.
danieldk 12y ago
First of all, what does it mean than an IP resolves to a hostname? You can do a reverse DNS lookup, which uses PTR records. See: https://tools.ietf.org/html/rfc1033 https://tools.ietf.org/html/rfc1033
blfr 12y ago
DNS works both ways. It has pointer (PTR) records which allow you to assosciate an IP address you control with a domain name. Those are the opposite of an address record (A) with which you assosciate a domain name you control with an IP address. For Google.com, I can get an A record (IP address) $ dig +short google.com a 216.58.208.238 but I can also get a domain name for that IP $ dig -x 216.58.208.238 +short par10s22-in-f14.1e100.net. par10s22-in-f14.1e100.net. Google uses a service domain 1e100.net for their machines. Although maybe OP only means the hostname in the banner message. I grepped my mail logs for hostnames from Vietnam and couldn't find any IPs that would resolve back to localhost. EDIT: 'nanofortnight https://news.ycombinator.com/item?id=9068054 https://news.ycombinator.com/item?id=9068054 found a range of addresses that do. $ dig +short -x 123.26.2.1 localhost.
- Tiksi 12y ago
  To be a bit pedantic, you don't actually resolve the ip address itself. A reverse dns lookup actually just does a lookup of {the ip address with octets reversed}.in-addr.arpa: > host 216.58.208.238 238.208.58.216.in-addr.arpa domain name pointer par10s22-in-f14.1e100.net. You can actually look that up directly too: > dig +short ptr 238.208.58.216.in-addr.arpa par10s22-in-f14.1e100.net. When an isp gets a ip allocation, they specify the nameservers to use, and are responsible for that "subdomain" of the in-addr.arpa domain. If you trace the full resolve, it first goes to the root .in-addr.arpa servers, then arin.net nameserver, then finally you end up at: ;; AUTHORITY SECTION: 208.58.216.in-addr.arpa. 86400 IN NS ns3.google.com. which will return the actual ptr record.
- expertonkappa 12y ago
  Related http://arstechnica.com/civis/viewtopic.php?f=10&t=257855 http://arstechnica.com/civis/viewtopic.php?f=10&t=257855 222.252.56.* also resolves to localhost for example.
- achillean 12y ago
  The linked reports also include the search query that was performed to get the data, which in this case is: https://www.shodan.io/search?query=hostname%3Alocalhost https://www.shodan.io/search?query=hostname%3Alocalhost That gives you a list of IPs that you can check for yourself are affected by the issue.

by hasenj 12y ago

forkerenok 12y ago

The OP article probably means rDNS lookup, where IP is resolved to DNS name. For consumer IP's it would look something like 12-23-45-234.gw123.vietnamtelecom.net. Edit: which usually gives a better idea of the host's origin than raw IP.

danieldk 12y ago

First of all, what does it mean than an IP resolves to a hostname? You can do a reverse DNS lookup, which uses PTR records. See: https://tools.ietf.org/html/rfc1033 https://tools.ietf.org/html/rfc1033

blfr 12y ago

DNS works both ways. It has pointer (PTR) records which allow you to assosciate an IP address you control with a domain name. Those are the opposite of an address record (A) with which you assosciate a domain name you control with an IP address. For Google.com, I can get an A record (IP address) $ dig +short google.com a 216.58.208.238 but I can also get a domain name for that IP $ dig -x 216.58.208.238 +short par10s22-in-f14.1e100.net. par10s22-in-f14.1e100.net. Google uses a service domain 1e100.net for their machines. Although maybe OP only means the hostname in the banner message. I grepped my mail logs for hostnames from Vietnam and couldn't find any IPs that would resolve back to localhost. EDIT: 'nanofortnight https://news.ycombinator.com/item?id=9068054 https://news.ycombinator.com/item?id=9068054 found a range of addresses that do. $ dig +short -x 123.26.2.1 localhost.

Tiksi 12y ago
To be a bit pedantic, you don't actually resolve the ip address itself. A reverse dns lookup actually just does a lookup of {the ip address with octets reversed}.in-addr.arpa: > host 216.58.208.238 238.208.58.216.in-addr.arpa domain name pointer par10s22-in-f14.1e100.net. You can actually look that up directly too: > dig +short ptr 238.208.58.216.in-addr.arpa par10s22-in-f14.1e100.net. When an isp gets a ip allocation, they specify the nameservers to use, and are responsible for that "subdomain" of the in-addr.arpa domain. If you trace the full resolve, it first goes to the root .in-addr.arpa servers, then arin.net nameserver, then finally you end up at: ;; AUTHORITY SECTION: 208.58.216.in-addr.arpa. 86400 IN NS ns3.google.com. which will return the actual ptr record.
expertonkappa 12y ago
Related http://arstechnica.com/civis/viewtopic.php?f=10&t=257855 http://arstechnica.com/civis/viewtopic.php?f=10&t=257855 222.252.56.* also resolves to localhost for example.
achillean 12y ago
The linked reports also include the search query that was performed to get the data, which in this case is: https://www.shodan.io/search?query=hostname%3Alocalhost https://www.shodan.io/search?query=hostname%3Alocalhost That gives you a list of IPs that you can check for yourself are affected by the issue.