Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to understand better the different network-query tools such as nc, curl, whois, dig, nslookup and at the same time a bit more about the architecture of internet requests, servers, and the like (NIC, A Record, MX) whilst already knowing a little about TCP, nameservers, domain registrars, packet sniffers, HTTP headers, and IP addresses. That's my background, here's my question.

When I dig or whois let's say (or I get at least two different IP answers: and

$ nslookup

Non-authoritative answer:

Trying to browse to either of these in w3m or chromium leads to a 403 Forbidden error. Furthermore I'm not sure which one to navigate to, but ping is somehow able to figure it out! If I ping (or ping it chooses

$ ping
PING ( 56(84) bytes of data.
64 bytes from icmp_req=1 ttl=50 time=80.2 ms

How did it know to do that? And what other tool should I be using to find out how my browser goes from to and loads something?

share|improve this question

migrated from Aug 26 '13 at 18:09

This question came from our site for system and network administrators.

This is pretty off-topic for here. I'll help get you started though: The first 'two answers' you get are not two different answers. The first address is the address of YOUR dns server; the server nslookup sent the query to. The only 'answer' there is This is for professionals, not people seeking to learn the basics. – yoonix Aug 26 '13 at 17:47
@yoonix I did actually look at man ping before asking here but it doesn't answer my question. – isomorphismes Aug 26 '13 at 18:06

There are different programs and protocols at work here each is configured to respond independently of the others.

To find an IP address, a linux host will generally use the hosts: directive in /etc/nsswitch.conf to determine which order to query the various sources. A typical entry would be

hosts:      files dns

which says check the files (typically /etc/hosts ) then the dns system. So a search will be conducted of the /etc/hosts file and if it contains an entry for the associated IP address will be returned. If /etc/hosts doesn't contain an entry for, then a request will be made to the DNS. This involves reading the contents of /etc/resolv.conf to determine which servers should be contacted to request DNS information ...

Looking at the output from your command, you're not getting two different addresses. The first part of the output is telling you which server was contacted by nslookup ( and also on which port (#53) to get the answer. We also know that there is no correctly configured PTR record for as, as RobM's answer shows, the Server would be shown as a name if it were.

The second part of the output is the information that you requested and tells you that is the IPv4 address of

When you contact on port 80 (http) directly you get a 403 forbidden because that's how the http server at that address has been configured. It is most likely configured as a name based virtual server and thus requires a valid http Host: (sec 14.23) header to route your request to the appropriate vhost.

The ping command is part if the ICMP protocol suite and is an ICMP echo request, the host at responds to ping because it has been configured to do so and sends an ICMP Echo Reply to each Echo Request.

share|improve this answer

You need to understand how nslookup works.


The first part of the answer, as should become clearer here, is the name server you're talking to. The answer it provides is the second part

So in my example, I'm asking nslookup to query my currently configured DNS server about where it thinks is to be found.

nslookup replies with the address of the server it used to run the query, and the answer it gave. This is important if you're specifying a particular DNS server to run dig or nslookup against, which is a fairly normal part of troubleshooting name resolution issues.

share|improve this answer

You misunderstand the output of nslookup. It isn't giving two answers, but just one. The first address is where it got the answer from. ping performs exactly the same task and gets exactly the same result. The reason you get the 403 when you try to give the IP address to the browser is because the server is running virtual hosting. With virtual hosting, a server can have multiple sites with only a single IP address. It decides which site to serve you based on the name the browswer tells it you entered. When you enter the IP address, the server doesn't know which site you wanted.

share|improve this answer

it will depend on your OS and ping version. if it is linux, you can find out all what is doing by using strace.

strace ping

step by step it will show you. too long to post, but here is my output so that i know at some point it checks the hosts file


open("/etc/host.conf", O_RDONLY)        = 3
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .