Bizarre decimal number to in-addr-arpa mapping......
Michael Voight
mvoight at cisco.com
Wed Jun 2 18:35:14 UTC 1999
Michael Fenton wrote:
>
> I discovered that people on my network are getting around
> our web filtering by using decimal number URL's.
> Check this out:
> gunk:~$ nslookup 3489040081
> Server: server.tt.net
> Address: 209.98.124.2
>
> Name: teen-space.com
> Address: 207.246.134.209
>
> How the hell does 3489040081 resolve?
> I did a little looking and it seems to map somehow
> to an inaddr-arpa address......
Convert 3489040081 to hex
Now, separate by octet and convert to decimal.
I rushed through this so my figures might be out of sync, but you should
get the idea
207.246.134.209 is CF F6 86 D1
Now, convert CFF686D1 as if it were not divided by octet.
This would give you 12 * 16^7 + 15 * 16^6 and so on.
Michael Voight
Michael
More information about the bind-users
mailing list