Bizarre decimal number to in-addr-arpa mapping......

Michael Voight mvoight at cisco.com
Wed Jun 2 18:35:14 UTC 1999



Michael Fenton wrote:
> 
> I discovered that people on my network are getting around
> our web filtering by using decimal number URL's.
> Check this out:
> gunk:~$ nslookup 3489040081
> Server:  server.tt.net
> Address:  209.98.124.2
> 
> Name:    teen-space.com
> Address:  207.246.134.209
> 
> How the hell does 3489040081 resolve?
> I did a little looking and it seems to map somehow
> to an inaddr-arpa address......

Convert 3489040081 to hex

Now, separate by octet and convert to decimal.

I rushed through this so my figures might be out of sync, but you should
get the idea

207.246.134.209 is CF F6 86 D1
Now, convert CFF686D1 as if it were not divided by octet.
This would give you 12 * 16^7 + 15 * 16^6 and so on.

Michael Voight




Michael



More information about the bind-users mailing list