22

How can I get all IPs of a domain name, say, www.google.com?

Of course, nslookup and host command will give me IPs of a domain. But what shall I do if I want a list ALL (or, at least a lot more than just one or two..) IPs of that domain?

3 Answers 3

18

Try doing dig google.com a. For me, it shows a consistent list of 6 IPv4 addresses.

9
  • 4
    True,.. it lists 6 IPv4 addresses. But for domains like google.com, I'm expecting hundreds of results.. Thanks any way.
    – DenMark
    Jun 15, 2010 at 9:38
  • 5
    Your expectations are wrong. Yes, Google has hundreds of servers, but they are backends. Each of these IP addresses really maps to hurd of servers, but they are hidden in Google's DC. Moreover, the single IP address may map to different servers over all the world like their DNS service does: code.google.com/speed/public-dns/faq.html#anycast.
    – Catherine
    Jun 15, 2010 at 10:11
  • 3
    Oh, That. You're correct.. There might be much less than hundreds of IPs. Yet, I'm pretty sure there're more than just 6 IPs bound to that domain. For I know other IPs that serves the same content (sure, owned by Google). Of course, one can argue that IP is serving the same content yet not bound to a domain. But It does not make much sense to do so (AFAIS).
    – DenMark
    Jun 15, 2010 at 14:09
  • This may be correct too: I read somewhere that Google serves different IP's from theirs DNS servers based on client GeoIP data. You can still lookup Google AS in the WHOIS database to get the list of all assigned IP's, but I do not know a clear way to get a list of all IP's that can be served to clients all over the world. Also this will be probably useless because of anycast routing.
    – Catherine
    Jun 15, 2010 at 15:31
  • 4
    -1 Sorry, but this simply isn't correct. dig imap.googlemail.com a only returns one IP address and I know very well that there are more IP addresses than just that one.
    – zelanix
    Jan 30, 2014 at 14:53
5

You might use the actual whois command, which should work on any IP address. The whois command will also return information such as the numbers of network bits (17). From this, you can determine the actual number of IP addresses. For example, if I whois the IP address 209.85.135.147, I will get:

NetRange:   209.85.128.0 - 209.85.255.255
CIDR:       209.85.128.0/17
NetName:    GOOGLE
NetHandle:  NET-209-85-128-0-1
Parent:     NET-209-0-0-0-0
NetType:    Direct Allocation

The /17 means that a sub-class-B network, and that the number of possible addresses is :

2^(32-17) - 2

or

2^15 - 2

or

32,768 - 2

or

32766 possible IP addresses. The -2 is because of the very first address (the network address 209.85.128.0) , and the very last one, which is the broadcast address (209.85.255.255), both addresses cannot be used to point to a host.

This is for IPv4 addresses, of course.

The whois will return different information when you use a domain name such as google.com. Finally, keep in mind that the returned IP for a host name can depend on the country where you actually are.

host google.com will return a single IP address when queried from Ottawa, Canada.

$ host google.com
google.com has address 173.194.32.104
google.com mail is handled by 100 google.com.s9a1.psmtp.com.
google.com mail is handled by 200 google.com.s9a2.psmtp.com.
google.com mail is handled by 300 google.com.s9b1.psmtp.com.
google.com mail is handled by 400 google.com.s9b2.psmtp.com.
$
2
  • 2
    but you cant tell if all of the ip addresses in that range are used by this domain withhout more complicated checks and even then there can be more ranges associated to that domain Jul 7, 2010 at 21:26
  • True, but this is a good start. Ultimately, the best way to know whether an IP will actually respond is to try to access it, and even then, different IPs will reply to different ports, based on their use. As well, you cannot know all IP ranges for a given name, especially for an international domain name like google.com. The reply will vary depending on the source IP of the query. But this is a start.
    – jfmessier
    Jul 8, 2010 at 9:52
0

You could give robtex a shot, it's pretty comprehensive.

3
  • Seems it lists only a few IPs.
    – DenMark
    Jun 15, 2010 at 9:35
  • If you look down the page a little for www.google.com you'll find a table and a graph, click a link or two...
    – Pulse
    Jun 15, 2010 at 9:43
  • Still, I can only see 4 A records, nothing more..
    – DenMark
    Jun 17, 2010 at 1:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .