untangling_the_web

DOClD: 4046925
UNCLASSIFIEDJlFQR QFFIGIAL l:JSE QNLY
possible for users to navigate the web and which Internet resources these tools
access in order to provide information about domain names and IP addresses.
After the DNS, the Whois databases maintained by the Regional Internet Registries
are the second major source of information about Internet addresses. The Whois
databases contain records of IP address registrations. Searches that access the
Whois databases are generally known as network lookups or network Whois
lookups. In contrast to the DNS, the five Whois databases-ARIN, APNIC, AfriNIC,
LACNIC, and RIPE-are not distributed on servers across the Internet but must be
queried individually. In addition, these databases are designed to search on IP
addresses, not domain names. A different type of tool should be used when
searching on domain names. Unfortunately, to add to the confusion, this tool is also
referred to as a Whois lookup!
In order to distinguish this third major resource from "true" Whois lookups, I will call it
domain name (Whois) lookup. Domain name lookups search one or more domain
name registries. Domain name registries are the places on the Internet where
individuals and organizations go to register a name generally intended to be
associated with a website, e.g., amazon.com. These registries include the generic
top-level domain (gTLD) registries for .com, .net, .org, .biz, .info, and a few other
gTLDs, as well as country code top-level domain (ccTLD) registries, e.g., .uk, .it,
.ru, et al. Domain name (Whois) lookups differ from network Whois lookups in that
they are primarily designed to search on a domain name instead of an IP address.
All of the domain lookup tools described here can search more than one domain
registry, and in some cases, will automatically search across all of them.
These are the various types of lookups that can be performed to learn more about
Internet addresses.
~ NSLookup-input format: either IP address or domain name
Using the DNS, a domain name is converted to its IP address (forward DNS
lookup) or an IP address is converted to its host name (reverse DNS lookup).
NSLookup is a UNIX tool that allows anyone using the Internet to access the
DNS and match domain names to IP addresses, or vice versa. Web interface
query forms for NSLookup are very numerous. Although NSLookup doesn't do
anything more than match domain names and IP addresses, this may be all you
need or may give you the information you need to keep looking. For example, I
have had domain names I could not match to any IP number using a Whois
search. By running an NSLookup query I have found an IP number that I could
then use to track down registration information about that domain.
The advantage of NSLookup is that, unlike Whois requests, NSLookup queries
can be run from anywhere on the Internet because the DNS data is not located
in one database on one server but is distributed across a collection of inter-
452 UNCLASSIFIEDllf6R OFFICIAL l:JSE ONLY