A Web-Based Introduction to Computer Networks for Non-Majors

Name Resolution

Internet Domain Names

Each machine (that is, computer) on the Internet has a unique name called a Fully Qualified Domain Name (FQDN) or Internet domain name. For example, sol.cs.wcu.edu is the domain names for one machine on the Internet. It is guaranteed that only one machine on the Internet has a particular FQDN, e.g. there is only one sol.cs.wcu.edu machine in the world. If you specify a machine's FQDN you should be able to get to it (e.g. if sending email to a person with an account on that machine) from anywhere in the world that is part of the Internet.

Just as the drives, folders (also called directories) and files on a single machine form a hierarchy, all the domain names on the Internet can be viewed as forming a hierarchy or tree with each node in the tree forming a subdomain. Domain names of individual machines are constructed by going up the tree from the machine to the root of the tree. For example, in Figure 1, starting at the machine named sol go to cs and then to wcu and then to edu to construct the domain name sol.cs.wcu.edu.

The interior nodes of the domain name tree are called subdomains. For example edu, wcu.edu, and cs.wcu.edu are each a subdomain. All the machines and subdomains underneath a particular subdomain are said to be in it. For example, the machines sol.cs.wcu.edu and vega.cs.wcu.edu are both in the cs.wcu.edu subdomain. All the machines in the cs.wcu.edu subdomain as well as machines such as email.wcu.edu are in the wcu.edu subdomain.

Some simplifications of Fully Qualified Domain Names are often used to designate a particular machine.

• Simplification One: The first part of a machine's domain name is sufficient if you are currently in the same subdomain as that machine. For example, a computer in the Department of Mathematics and Computer Science at Western is in the subdomain cs.wcu.edu so from such a computer you can refer to the machine sol.wcu.edu just by calling it sol. However, if you are on a machine in Japan, that Japanese machine will not be able to realize that ack really means the machine sol.cs.wcu.edu.
• Simplification Two: Often a machine has a nickname or alias for the first part of its domain name. For example, the machine whose true name is sol.cs.wcu.edu happens to have the alias www.cs.wcu.edu since it is the Web server for the Department of Mathematics and Computer Science. So www is being used as an alias for sol.
• Simplification Three: Often the name of a subdomain is also used as a nickname or alias for a particular machine in that subdomain. For example, the subdomain cs.wcu.edu is also an alias for the machine whose true name is sol.cs.wcu.edu.

Internet domain names are easy to remember so they are widely used by application programs and users (such as when you use a web browser). However, when the TCP/IP protocol stack transfers your message through the Internet the stack does not actually usually Internet domain names because of two problems.

• One problem with Internet domain names is that different names may be of different lengths. For example, www.wcu.edu is 11 characters while www.google.com is 14 characters. Variable-length data is more time-consuming for protocol software to manipulate.
• The second problem is that Internet domain names are relatively long. For example, if each character takes one byte to represent it, than www.google.com takes 17 bytes. Thus, each message to that machine has to waste 17 bytes on the name.

The solution is that the TCP/IP protocol stack sends a different machine identifier called an IP (Internet Protocol) address in each message, instead of the Internet domain name. All IP addresses are four bytes long which is short and constant-length. You might have seen an IP address when using your computer since sometimes software shows them. An example IP address is 152.30.5.1. The addresses are written as four numbers with periods (called "dots") between them. Each number represents the value in one of the four bytes of the address.

Since messages must contain IP addresses, before your message leaves your computer the Internet domain name of the destination computer has to be changed into an IP address. This translation is called name resolution and is typically done by an application program called a name server. Currently, one machine at Western (directory.wcu.edu and has the IP address 152.30.22.212) has a name server program running on it. Whenever any machine A at Western wants to translate an Internet domain name into an IP address in order to send a message x, machine A first sends a message y to directory.wcu.edu requesting the name resolution. That name server then (hopefully) replies with the corresponding IP address. Machine A can then send message x to the desired destination IP address. The name server directory.wcu.edu can not, of course, know the IP address of every domain name in the Internet. Names it can not resolve (that is, domain names whose IP address it does not know) it asks other names servers about. Usually it eventually finds a name server than can do the name resolution. Once directory.wcu.edu has found a name server that can do the name resolution, directory.wcu.edu returns the answer (the desired IP address) to machine A.

Nslookup

Many programs exist that allow you to observe in action some of the protocols in the TCP/IP protocol stack. One of these programs is called nslookup (for Name Server Lookup). You can use nslookup to find the IP address for a given domain name and vice versa. You can also use nslookup to find if a domain name is the true domain name for a machine or just an alias.

Nslookup comes with the Windows XP operating system. These utilities can be run using the command line interface to Windows XP. To reach the command line interface, click on the Start button, choose Programs, choose Accessories, and then choose the Command Prompt menu item. A window will appear with a command line prompt in it. At the command prompt, enter the command nslookup. The nslookup program will then display its prompt. At the nslookup prompt enter the domain name of a machine to find its IP address or aliases. At the nslookup prompt enter the IP address of a machine to find its domain name and any aliases. When you enter a request at the nslookup prompt, nslookup asks a name server to resolve the request. The first part of the response to the request is the domain name and IP address of the name server that resolved the request.

The next screenshot shows the output of the nslookup program. The domain name entered, www.si.edu, is that of the Smithsonian Institute in Washington, D.C. The first two lines of the output indicate the domain name and IP address of the first name server that nslookup contacts asking for a name resolution. The next two lines indicate the domain name and IP address of the name server that responds. In this case, the initial name server is also the name server who responds. The last four lines are the answer with the Fully Qualified Domain Name, the IP address, and any aliases shown. In this case, it turns out that www.si.edu is actually an alias for the real name of the machine running the Smithsonian's web site.

As an example of how you could use nslookup below are a series of questions that students at Western Carolina University answered using nslookup as part of an assignment.

1. The machine on which students have accounts is called sol. What is sol's Fully Qualified Domain Name? What is sol's IP address?
2. Western's Web page is maintained by Western's web server which has the domain name www.wcu.edu. That domain name is an alias. What is the real Fully Qualified Domain Name of Western's web server?
3. The program that determines the IP address for a domain name, the domain name for an IP address, and shows aliases for domain names is called a name server. What is the Fully Qualified Domain Name for Western's name server? The response from nslookup lists at the beginning the server used where server means name server.
4. What happens when you give nslookup the domain name wcu.edu? The name wcu.edu is not a Fully Qualified Domain Name of a single machine; instead it is the name of a subdomain. What is happening is that the name wcu.edu is being used as an alias.
5. What is the Fully Qualified Domain Name of the machine whose IP address is 152.30.5.1?
6. What is the IP address of the machine whitehouse.gov?

The Windows XP operating system comes with a number of other utilities that you can use to observe the TCP/IP protocol stack. These utilities can be run using the command line interface to Windows XP. To reach the command line interface, click on the Start button, choose Programs, choose Accessories, and then choose the Command Prompt menu item. A window will appear with a command line prompt in it. Enter the name of the utility to run it.

Each utility can take several arguments on the command line. To find out what arguments are possible, for ping, tracert, and arp, just enter the name of the utility without any arguments and a list of possible arguments will be displayed. To find out what arguments are possible for netstat, enter netstat ? at the command line.

The four utilities are:

• ping. The ping utility will send a message to the designated destination machine and the destination machine will then return a reply message. Ping will indicate that a reply message had been received, the number of bytes in the original message and in the response, and the length of time between when the initial message was sent and the reply message was received. Ping is useful when you think the destination machine might not be operational. The message ping sends is rather low-level so if no reply message is returned to ping, the destination machine is probably not accessible. For example, here is a sample ping session.

• tracert. The tracert utility displays the route (tracert is short for traceroute) that your message takes to the destination machine. For example, here is a sample tracert session showing the route a message took from the Department of Mathematics and Computer Science at Western Carolina University to whitehouse.gov. Each hop along the route is shown on a separate line. Each line indicates the number of the hop, the duration of that hop, and the Fully Qualified Domain Name and IP address of the router being used in that hop.

• netstat. Netstat is a powerful utility for exploring the behavior of a number of features of the TCP/IP protocol stack. For example, the following session shows the number of messages (called packets) sent and received at the level of the actual Ethernet network.

The following session shows the current TCP connections and statistics on the history of the number of connections. TCP (Transmission Control Protocol) is one of the two protocols at the transport layer of the TCP/IP protocol stack. One of TCP's functions is to error control; to ensure reliable delivery of messages to the destination.

The following session shows the routing table on the current computer. The routing table tells the protocol stack where to send each message on its first hop towards the message's destination.

• arp: The arp utility displays some information about the arp protocol which is part of the TCP/IP protocol stack. The function of the arp protocol is outside of the scope of these notes, but part of that function is to maintain copies on the local computer of the addresses of some other computers. The arp utility displays which copies, if any, the local computer currently has. For example, here is a sample arp session.