What an nslookup command return if multiple sites are assigned to the same IP

Question

I read in a book that nslookup command is used to find the IP address from a domain name and vice-versa. And domain name are just the names given to the IP Addresses as it is easy to remember names than the numbers.

When I type a domain name into the browser, DNS server resolves the IP Address from the domain name. But as there may be multiple sites that may have the same IP address, so what happened If I type the IP address in the browser instead of the domain name? How does the DNS server know on which website I want to go?

I have listed five websites.

all of them have the same IP address

http://166.62.28.108/

When I type nslookup in the cmd, so sometimes it returning me delhians.com, sometimes finitecolors.com, sometimes garbagevalue.com and so on.

So how the DNS decide which domain name to return in cmd as well as in browser?

score 1 · Answer 1 · answered May 31 '17 at 12:45

But as there may be multiple sites that may have the same IP address, so what happened If I type the IP address in the browser instead of the domain name? How does the DNS server know on which website I want to go?

It doesn't.

When you look up a PTR record with nslookup it returns the ip address to name mapping for that ip address, which is maintained by the netblock owner and not necessarily (or likely) the web hosting company, and may not even exist.

Best case scenario is you'll get the default website bound to that ip address.

score 0 · Answer 2 · answered Nov 23 '22 at 02:10

Different web servers (IIS/nginx) have different ways to host multiple web apps, but a common logic there is that you can host many sites (server block in nginx) on the same IP:80 binding for HTTP (or *IP:443 binding for HTTPS).

When an HTTP request arrives, the web server will check its Host header to decide to which web site (or server block) this request should be dispatched to. So, in your case www.delhians.com and www.finitecolors.com will be hosted separately and receive different traffic.

So, in your case if only IP address is used in URL, the Host name will be the IP address and it relies on the web server configuration to decide how to dispatch the request. Usually you won't configure a site (server block) for the IP address, but both IIS and nginx allow a default site (server block) (catch-all site) to handle such.

HTTPS is more complex to explain, as it requires SNI settings to map certificates to different host names.

More importantly, DNS is only used by the browser to determine to which IP address it should send the HTTP request, so when http://166.62.28.108/ is there in the address bar, no DNS query will be performed by the browser.

score 0 · Answer 3 · answered May 31 '17 at 07:34

0

You may need to look at virtual hosting specifically name-based one. In short, the web server can figure out which website you are requesting by looking at Host HTTP header.

When you request any website of these by IP, you will get a default page instead of getting a response from any of them. This is simply because web server does not know which website you want to access.

answered May 31 '17 at 07:34

Khaled

36,533
8
72
99

and that **default** page is not any of the websites that are assigned to that IP, right? – sirajalam049 May 31 '17 at 07:39
and, if we talk about the command prompt, why it is returning any random name? Is there any sequence or system that decide which name to return or it just happened randomly? – sirajalam049 May 31 '17 at 07:40

What an nslookup command return if multiple sites are assigned to the same IP

3 Answers3