0

There's this network I connect to often. After some experimentation, I figured out that when you connect to the network, the DHCP server assigns you an FQDN that usually follows the scheme <your-hostname>.subdomain.sld.tld (obviously the DHCP server also assigns you an IP address). A DNS record is created for you that maps your FQDN to your current IP address. In addition to that, a reverse DNS record is created mapping your IP address to your hostname. When you leave the network (when your lease expires), both DNS records are deleted.

My question is, what's the purpose of having a reverse DNS record for all devices on the network? They're all private IP addresses. The only thing it does AFAICS is make it easy to enumerate all the devices (hostnames) on the network - just run a reverse scan of 10.0.0.0/8 (and/or 192.168.0.0/16, and/or 172.16.0.0/12).

kimbo
  • 63
  • 5

1 Answers1

1

It is a kind of zero-configuration networking, probably done by a small DHCP/DNS/TFTP server called dnsmasq. The PTR record allows you to see the hostname of other machines connecting to your computer, which might be meaningful on a small network, where people know each other.

As for scanning the network, other technologies announce on broadcast or multicast the presence of computers and their hostnames:

  1. NetBIOS in the Windows world (yes, it is still alive),
  2. LLMNR/SSDP in the Windows world,
  3. mDNS/DNS-SD in the Apple/UNIX world,
  4. ARP broadcasts might give a hint on which IPs are active.
Piotr P. Karwasz
  • 5,748
  • 2
  • 11
  • 21
  • I asked a colleague of mine and he said it can also be used for identification of devices, e.g., for forensics, incident management. I suppose it can be useful. Thanks for your answer. – kimbo Feb 29 '20 at 00:58