nslookup is a tool whereby one: Can find the ``name'' of a computer if the IP address is know, and Can find the IP address if the ``name'' is known. Here, ``name'' is the name in the sense of the ``Domain Name Service'', see Forouzan Ch 16. nslookup forwards the request for information to a ``domain name server''. The response contains the identity of the domain name server that gives the response, as well as the information requested (if available). Example: --- alizarin-41 ott>: nslookup ftp.nl.net Server: dns1.njit.edu Address: 128.235.251.10 Non-authoritative answer: Name: ftp.eu.uu.net Addresses: 195.129.111.8, 195.129.111.9 Aliases: ftp.nl.net --- The server that responds is dns1.njit.edu . Its IP address is 128.235.251.10 . We see that ftp.nl.net is not the ``real'' name, but an alias. The real name is ftp.eu.uu.net , and it has two IP addresses. This often means it is a host with two interfaces. However, in this case I doubt that is the situation: the two interfaces are (almost certainly) on the same network. Lets look further: --- alizarin-44 ott>: nslookup ftp.eu.uu.net Server: dns1.njit.edu Address: 128.235.251.10 Non-authoritative answer: Name: ftp.eu.uu.net Addresses: 195.129.111.9, 195.129.111.8 --- If you ask for ftp.eu.uu.net you do not get the alias(es). Let's look further: --- alizarin-42 ott>: nslookup 195.129.111.8 Server: dns1.njit.edu Address: 128.235.251.10 Name: ftp0.svc.ops.eu.uu.net Address: 195.129.111.8 alizarin-43 ott>: nslookup 195.129.111.9 Server: dns1.njit.edu Address: 128.235.251.10 Name: ftp1.svc.ops.eu.uu.net Address: 195.129.111.9 --- These are two different hosts, almost certainly on the same network. (IP adresses are identical apart from last, 32-ed, bit). My educated guess: these are two hosts (servers) that share workload. Possibly one is standby for the other. Would that be a ``hot'' or ``cold'' standby? Or maybe both are on, sharing the work. Let's use ``ping'' to find out more. --- alizarin-45 ott>: ping ftp0.svc.ops.eu.uu.net ftp0.svc.ops.eu.uu.net is alive alizarin-46 ott>: ping ftp1.svc.ops.eu.uu.net ftp1.svc.ops.eu.uu.net is alive --- Both computers ftp0.svc.ops.eu.uu.net and ftp1.svc.ops.eu.uu.net are alive. So either one is a hot standby for the other, or (more likely) they are sharing the workload. In that case they must have some mechanism for sharing the workload! Pinging the IP addresses instead of the names has the same effect: --- alizarin-47 ott>: ping 195.129.111.8 195.129.111.8 is alive alizarin-48 ott>: ping 195.129.111.9 195.129.111.9 is alive --- Let's find out what happens if we ping the ``joint name'' or the alias: --- alizarin-49 ott>: ping ftp.nl.net ftp.nl.net is alive alizarin-50 ott>: ping ftp.eu.uu.net ftp.eu.uu.net is alive --- This way we do not know who of the two component hosts actually responed! Let's find out: --- alizarin-52 ott>: ping -s ftp.nl.net 100 4 PING ftp.nl.net: 100 data bytes 108 bytes from ftp0.svc.ops.eu.uu.net (195.129.111.8): icmp_seq=0. time=90. ms 108 bytes from ftp0.svc.ops.eu.uu.net (195.129.111.8): icmp_seq=1. time=92. ms 108 bytes from ftp0.svc.ops.eu.uu.net (195.129.111.8): icmp_seq=2. time=92. ms 108 bytes from ftp0.svc.ops.eu.uu.net (195.129.111.8): icmp_seq=3. time=115. ms ----ftp.nl.net PING Statistics---- 4 packets transmitted, 4 packets received, 0% packet loss round-trip (ms) min/avg/max = 90/97/115 alizarin-53 ott>: ping -s ftp.eu.uu.net 100 4 PING ftp.eu.uu.net: 100 data bytes 108 bytes from ftp0.svc.ops.eu.uu.net (195.129.111.8): icmp_seq=0. time=91. ms 108 bytes from ftp0.svc.ops.eu.uu.net (195.129.111.8): icmp_seq=2. time=91. ms 108 bytes from ftp0.svc.ops.eu.uu.net (195.129.111.8): icmp_seq=3. time=91. ms ----ftp.eu.uu.net PING Statistics---- 4 packets transmitted, 3 packets received, 25% packet loss round-trip (ms) min/avg/max = 91/91/91 --- The response comes from the lower of the two addresses. This is a choice made ``by alzarin''. Likely exam question: Here is an output from nslookup . Explain the various fields.