Bizarre decimal number to in-addr-arpa mapping......

Farid Hamjavar hamjavar at unm.edu
Wed Jun 2 18:33:35 UTC 1999


On Wed, 2 Jun 1999, Michael Fenton wrote:

> Date: Wed, 02 Jun 1999 11:33:33 -0500
> From: Michael Fenton <mfenton at fentonnet.com>
> To: comp-protocols-dns-bind at moderators.uu.net
> Newsgroups: comp.protocols.dns.bind
> Subject: Bizarre decimal number to in-addr-arpa mapping......
> Resent-Date: Wed, 2 Jun 1999 11:06:42 -0700 (PDT)
> Resent-From: Ruth Anne Ladue <Ruth_Anne_Ladue at iengines.net>
> Resent-To: bind-users at isc.org
> 
> I discovered that people on my network are getting around
> our web filtering by using decimal number URL's.
> Check this out:
> gunk:~$ nslookup 3489040081
> Server:  server.tt.net
> Address:  209.98.124.2
> 
> Name:    teen-space.com
> Address:  207.246.134.209
> 
> How the hell does 3489040081 resolve?
> I did a little looking and it seems to map somehow
> to an inaddr-arpa address......
> 
> Anybody know what's going on here?
> 
> Thanks,
> Michael Fenton
> 


FYI: 
I wrote a perl script (qdc) for this:


% qdc 3489040081
#Input is all digits: "3489040081"
#Answer in dotted form: 207.246.134.209 




and other way around [as the script explains what it does]:



%qdc 207.246.134.209 
#Input is in dotted notation: "207.246.134.209"
#OctetIndex[1] is  207  and 207 x 16777216  = 3472883712 
#OctetIndex[2] is  246  and 246 x 65536  = 16121856 
#OctetIndex[3] is  134  and 134 x 256  = 34304 
#OctetIndex[4] is  209  and 209 x 1  = 209 
#
#Answer is in decimal 3489040081 
#Answer is in hex is cff686d1 



Farid



More information about the bind-users mailing list