0

The university where I study has an IP range from 144.122.0.0 to 144.122.255.255

I'm going to find out all the domain names for every IP address, and is the IP hosts a web site (online).

Mostly they are like these:
pc-100.dormitory-5.dormitories.name_of_the_university.edu for 144.122.x.100
pc-101.dormitory-5.dormitories.name_of_the_university.edu for 144.122.x.101

I'll do it with PHP from my own computer.

The question is; how does "IP to domain name" thing works? Could it be interpreted as IP scanner? The university lists and blocks IP addresses of infected PCs (students' PSs), thus I don't want to be blocked for that reason.

Note:
I use OpenDNS.
The PHP function is gethostbyaddr();
My aim is to work on arrays on PHP and I wanted to see all the networks out there in the campus, like how many dormitories are there.

ilhan
  • 288
  • 5
  • 15

3 Answers3

1

This is called reverse DNS lookup. Basically, your program will generate DNS queries for special domain names that look like this:

1.0.122.144.in-addr.arpa
2.0.122.144.in-addr.arpa
...
254.255.122.144.in-addr.arpa

As long as you use a DNS server that is not controlled by the university, I don't see how this series of queries could be interpreted as any kind of "scan". However, unless you limit the rate of your queries, the admins of the DNS server you use might decide that you attempted some kind of abuse!

All that being said, I'm not so sure that doing reverse lookups will necessarily get you the information you're looking for. Basically, you're asking for a method to clandestinely scan a network, and I won't provide that.

Steven Monday
  • 13,599
  • 4
  • 36
  • 45
1

The question is; how does "IP to domain name" thing works?

php gethostbyaddr() request PTR DNS record use OpenDSN(same host 144.122.0.0 " or dig -x 144.122.0.0). Read: http://aplawrence.com/Blog/B961.html.

Could it be interpreted as IP scanner?

Yes, if you attempt to determine online host(use ping/curl/wget/...)

The university lists and blocks IP addresses of infected PCs (students' PSs), thus I don't want to be blocked for that reason.

Check online host every hour or even less

bindbn
  • 5,211
  • 2
  • 26
  • 24
0

this sounds like a bad idea if you don't have permission to do this.... YES IF you use an online type icmp request or such thier IDS/IPS will flag you as scanning and possibly a bot or worm.

Liam
  • 499
  • 3
  • 5