Now in this video we're going to cover nslookup,
dig, and hostname.
These are three command line tools,
and you need to understand how to use them in maintaining
and troubleshooting your networks.
First we have nslookup.
nslookup stands for Name Server Lookup,
and it's going to be used to query the domain name system
to provide the mapping between domain names and IP addresses
or other DNS records.
Now, if we need to get the IP address
of a fully qualified domain name,
nslookup is the tool that will help us do that.
For example, let's pretend you wanted
to find out the IP address for diontraining.com.
Well, you can open up your command prompt
and you can type in nslookup www.diontraining.com
and press Enter.
When you do that,
you're going to get the IP address shown on your screen
that tells you where Dion Training servers are.
Now, when you enter the command
and the domain name like this all one line,
we call this the Non-interactive Mode.
Now with non-interactive modes,
you're going to be able to display just the name
and the requested information for a host
or domain name to your screen,
but you can also use nslookup in an interactive mode.
Now, interactive mode allows a user to query name service
for information about various hosts and domains,
or allows 'em to print a list of hosts inside of a domain.
To enter the interactive mode,
you just type nslookup at the prompt and hit Enter.
Now you're going to enter the nslookup shell,
and you can perform more in-depth queries here.
Using this interactive mode will allow you
to have more detailed control over the environment,
including allowing you to change the server you're using
to conduct those lookups
and changing the different types of records
that you want to respond with.
Now, if you want to change the DNS server that's being used
for the query, just enter the term server
and the DNS server's name or IP address and hit Enter.
Now, if you instead want to change the type
of record you want to search for,
you can enter set q = and then the record type.
This stands for set query type equals, and then that thing.
So for example, if I wanted to search for mail records,
which are known as mx Records in DNS,
I would type set q = mx and hit Enter.
Then I get my next prompt
and I can start searching mail records for any domain name.
So I'm going to be able to find all the different mail records,
for instance, for diontraining.com.
Here I can see all five mail exchange server records
for diontraining.com,
and you can see they're all hosted by Google,
because Google Workspace is what we use
for our company's email and file servers.
Now, next to each mx record,
you can also see the preferences
with one being the highest preference
and the two being listed with five acting
in a load balance configuration.
And then we have those backed up
by two more exchange mail servers
that have a preference of 10,
which is also load balance between those two servers.
Next, let's search for some CNAME or canonical name records.
To do this, I first need to set my query type to CNAME,
because we're still set to mx records at this point in time.
So I'm going to enter set q=CNAME and hit Enter.
Then I enter the domain name that I want
to get the CNAME records for,
and again, in this case, I'm going to use diontraining.com.
Now, in response to this,
the nslookup is going to display all the CNAME records
right there on my screen.
Here, I'm just showing you the first one,
because I have about 20 different CNAME records
for diontraining.com.
If we scroll down through these screens,
you'd be able to see each and every one of them.
As you can see, nslookup is a very useful tool
when it comes to troubleshooting your DNS records
and other DNS issues
that you may be experiencing.
If you become a cybersecurity analyst
later on in your career,
you can also use nslookup
to conduct reconnaissance against other organizations
that you may be hired to work for during a penetration test.
nslookup exists for Windows, Linux, Unix, and OS X systems.
In these examples, I was using the Windows version,
but the other versions operate the exact same way.
The only difference is that you will use something
like set type = mx
instead of set q = mx
if you're using things on a Linux, Unix,
or OS X system and doing record type searches.
Next we have the dig command.
dig is another tool that's used
to conduct queries against DNS name servers.
dig is only available for Linux, Unix,
and OS X systems by default,
but there are Windows versions
that can be installed if you'd like
to use it on a Windows machine.
Now, to use dig,
it works a lot like the non-interactive mode nslookup.
If you enter dig and the domain name like diontraining.com,
you're going to get back the A records for that domain name,
and those A records contain the IP addresses
for that domain.
Now, in this example, you can see there are two A records
for diontraining.com,
because we use a load balancing web cluster
to host our website.
Now, dig does not support an interactive mode
the way nslookup does.
So if you want to search for other types of records,
you're simply going to specify those when entering the command.
For example, let's say I wanted to look
for those mail exchange or mx records.
I'm going to enter dig -t, which stands for type,
and then mx, which stands for mail exchange,
and then I'm going to enter the domain name,
in this case, diontraining.com.
Here again, you can see we have five mx records associated
with diontraining.com,
and they're all pointing to the Google Mail servers,
because that's who's hosting our company's email
using Google Workspaces.
Now, finally, we have the hostname command.
The hostname command is going to be used
to display the hostname portion
of the full computer name for a given system.
Now the hostname command works on Windows, Linux, Unix,
and OS X operating systems.
Now to use hostname, you simply enter hostname
and press Enter at the command prompt.
As an example, I entered the hostname command
on an OS X system here, in this case, my MacBook Pro.
Now, you can quickly see the full name
of my laptop is Jasons-MBP.localdomain.
Now, this means the computer
is going to be named Jason's MacBook Pro or Jason's MBP,
and it exists on our local domain,
because here I'm not connected
to an active-directory-based domain environment.
At some organizations I worked for in the past,
we run large active-directory-based Windows domains,
and for those systems you might see something
like jasonspc.intranet.diontraining.com,
as it's FQDN or fully qualified host and domain name,
since it's becoming a member of that domain.