up vote 1 down vote favorite
share [g+] share [fb]

How can I get all IPs of a domain name, say, www.google.com?

Of course, nslookup and host command will give me IPs of a domain. But what shall I do if I want a list ALL (or, at least a lot more than just one or two..) IPs of that domain?

link|improve this question
feedback

3 Answers

up vote 3 down vote

Try doing dig google.com a. For me, it shows a consistent list of 6 IPv4 addresses.

link|improve this answer
True,.. it lists 6 IPv4 addresses. But for domains like google.com, I'm expecting hundreds of results.. Thanks any way. – DenMark Jun 15 '10 at 9:38
3  
Your expectations are wrong. Yes, Google has hundreds of servers, but they are backends. Each of these IP addresses really maps to hurd of servers, but they are hidden in Google's DC. Moreover, the single IP address may map to different servers over all the world like their DNS service does: code.google.com/speed/public-dns/faq.html#anycast. – whitequark Jun 15 '10 at 10:11
Oh, That. You're correct.. There might be much less than hundreds of IPs. Yet, I'm pretty sure there're more than just 6 IPs bound to that domain. For I know other IPs that serves the same content (sure, owned by Google). Of course, one can argue that IP is serving the same content yet not bound to a domain. But It does not make much sense to do so (AFAIS). – DenMark Jun 15 '10 at 14:09
This may be correct too: I read somewhere that Google serves different IP's from theirs DNS servers based on client GeoIP data. You can still lookup Google AS in the WHOIS database to get the list of all assigned IP's, but I do not know a clear way to get a list of all IP's that can be served to clients all over the world. Also this will be probably useless because of anycast routing. – whitequark Jun 15 '10 at 15:31
Actually, I'm looking for a way around IP blocking of a domain. So, anycast routing seems not be a problem. Thanks again :) Oh, and yes exactly, I'm looking for a list of all IPs that can be served to clients all over the world. Just wonder if there is a way to achieve this. – DenMark Jun 17 '10 at 1:42
feedback
up vote 2 down vote

You might use the actual whois command, which should work on any IP address. The whois command will also return information such as the numbers of network bits (17). From this, you can determine the actual number of IP addresses. For example, if I whois the IP address 209.85.135.147, I will get: 

NetRange:   209.85.128.0 - 209.85.255.255
CIDR:       209.85.128.0/17
NetName:    GOOGLE
NetHandle:  NET-209-85-128-0-1
Parent:     NET-209-0-0-0-0
NetType:    Direct Allocation

The /17 means that a sub-class-B network, and that the number of possible addresses is :

2^(32-17) - 2

or

2^15 - 2

or

32,768 - 2

or

32766 possible IP addresses. The -2 is because of the very first address (the network address 209.85.128.0) , and the very last one, which is the broadcast address (209.85.255.255), both addresses cannot be used to point to a host.

This is for IPv4 addresses, of course.

The whois will return different information when you use a domain name such as google.com. Finally, keep in mind that the returned IP for a host name can depend on the country where you actually are.

host google.com will return a single IP address when queried from Ottawa, Canada.

$ host google.com
google.com has address 173.194.32.104
google.com mail is handled by 100 google.com.s9a1.psmtp.com.
google.com mail is handled by 200 google.com.s9a2.psmtp.com.
google.com mail is handled by 300 google.com.s9b1.psmtp.com.
google.com mail is handled by 400 google.com.s9b2.psmtp.com.
$
link|improve this answer
but you cant tell if all of the ip addresses in that range are used by this domain withhout more complicated checks and even then there can be more ranges associated to that domain – mugen kenichi Jul 7 '10 at 21:26
True, but this is a good start. Ultimately, the best way to know whether an IP will actually respond is to try to access it, and even then, different IPs will reply to different ports, based on their use. As well, you cannot know all IP ranges for a given name, especially for an international domain name like google.com. The reply will vary depending on the source IP of the query. But this is a start. – jfmessier Jul 8 '10 at 9:52
feedback
up vote 0 down vote

You could give robtex a shot, it's pretty comprehensive.

link|improve this answer
Seems it lists only a few IPs. – DenMark Jun 15 '10 at 9:35
If you look down the page a little for www.google.com you'll find a table and a graph, click a link or two... – Pulse Jun 15 '10 at 9:43
Still, I can only see 4 A records, nothing more.. – DenMark Jun 17 '10 at 1:54
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.