11

How are the host names in this trace route able to use random top level domains? I didn't know there was an 'Empire' or 'victory' top level domain.

C:\Users\Chloe> tracert 216.81.59.173

Tracing route to read.more.at.beaglenetworks.net [216.81.59.173]
over a maximum of 30 hops:

  1     *        *        *     Request timed out.
  2    27 ms    15 ms    11 ms  
  3    11 ms    11 ms    21 ms  
  4    12 ms    11 ms    11 ms  
  5    14 ms    15 ms    14 ms  
  6    17 ms    14 ms    15 ms  
  7    13 ms    14 ms    15 ms  
  8    15 ms    24 ms    23 ms  
  9    21 ms    23 ms    24 ms  100gigabitethernet11-1.core1.ash1.he.net [184.105.223.165]
 10    33 ms    31 ms    49 ms  10gigabitethernet1-2.core1.atl1.he.net [184.105.213.110]
 11    33 ms    30 ms    31 ms  216.66.0.26
 12    73 ms    72 ms    73 ms  10.26.26.22
 13    71 ms    73 ms    72 ms  Episode.IV [206.214.251.1]
 14    73 ms    72 ms    72 ms  A.NEW.HOPE [206.214.251.6]
 15    71 ms    71 ms    72 ms  It.is.a.period.of.civil.war [206.214.251.9]
 16    72 ms    72 ms    73 ms  Rebel.spaceships [206.214.251.14]
 17    73 ms    71 ms    73 ms  striking.from.a.hidden.base [206.214.251.17]
 18    73 ms    71 ms   101 ms  have.won.their.first.victory [206.214.251.22]
 19    72 ms    71 ms    72 ms  against.the.evil.Galactic.Empire [206.214.251.25]
 20    74 ms    72 ms    72 ms  During.the.battle [206.214.251.30]
 21    71 ms    73 ms    72 ms  Rebel.spies.managed [206.214.251.33]
 22    72 ms    72 ms    72 ms  to.steal.secret.plans [206.214.251.38]
 23    73 ms    91 ms    72 ms  to.the.Empires.ultimate.weapon [206.214.251.41]
 24    72 ms    71 ms    75 ms  the.DEATH.STAR [206.214.251.46]
 25    72 ms    75 ms    73 ms  an.armored.space.station [206.214.251.49]
 26    75 ms    72 ms    71 ms  with.enough.power.to [206.214.251.54]
 27    75 ms    75 ms    72 ms  destroy.an.entire.planet [206.214.251.57]
 28    72 ms    75 ms    71 ms  Pursued.by.the.Empires [206.214.251.62]
 29    77 ms    73 ms    71 ms  sinister.agents [206.214.251.65]
 30    71 ms    72 ms    71 ms  Princess.Leia.races.home [206.214.251.70]

Trace complete.
1
  • 2
    +1 for the question and answer. But I disagree: it's far from random ;) Nov 5 '13 at 18:07
13

This RFC explains the DNS system http://www.ietf.org/rfc/rfc1035.txt. And most importantly, the section "3.5. IN-ADDR.ARPA domain" explains how these names are set for reverse lookup of the IP addresses.

So yes, for intermittent hosts which are probably routers, one can set these to pretty much random names and these would turn up in the X.Y.Z.W.IN-ADDR.ARPA queries.

The downside is that you can't really access that host throught the DNS name reported - but then, if they are part of the core infra, this should not be a major problem anyway.

8

The PTR record doesn't have to be a valid FQDN. (for internal / non-internet DNS servers, this is not uncommon.)

Eg:

1.1.168.192.in-addr.arpa. IN PTR i.saw.a.squirrel.

1
  • 1
    It was doin' like this. <chitter>
    – mskfisher
    Nov 5 '13 at 13:29
5

This is almost certainly single host with many IP addresses routed to it and simple script to make it appear like it's traversing many hosts.

Comparable hack for IPv6 can be seen here https://github.com/job/ipv6-traceroute-faker

Like Ricky+Laazik say no limits what PTR can point to, like no limits where A can point to, just you won't be able to have it PTR -> A -> PTR unless you control both. Obviously the person does not control A record for those hosts and couldn't have A resolve for them.

Not the answer you're looking for? Browse other questions tagged or ask your own question.