Americas

  • United States
sandra_henrystocker
Unix Dweeb

Digging up IP addresses with the Linux dig command

How-To
Feb 14, 20204 mins
Linux

The dig command is extremely versatile both for retrieving information from domain name servers and for troubleshooting.

sort filter gold digging panning for gold
Credit: Thinkstock

Not unlike nslookup in function, but with a lot more options, the dig command provides information that name servers manage and can be very useful for troubleshooting problems. It’s both simple to use and has lots of useful options.

The name “dig” stands for “domain information groper” since domain groping is basically what it does. The amount of information that it provides depends on a series of options that you can use to tailor its output to your needs. Dig can provide a lot of detail or be surprisingly terse.

Just the IP, please

To get just the IP address for a system, add the +short option to your dig command like this:

$ dig facebook.com +short
31.13.66.35

Don’t be surprised, however, if some domains are tied to multiple IP addresses to make the sites they support more reliable.

$ dig networkworld.com +short
151.101.2.165
151.101.66.165
151.101.130.165
151.101.194.165

Also, don’t be surprised if the order of the IP addresses changes from one query to the next. This is a side effect of load balancing.

$ dig networkworld.com +short
151.101.130.165
151.101.194.165
151.101.2.165
151.101.66.165

Standard dig output

The standard dig display provides details on dig itself along with the response from the name server.

$ dig networkworld.com

; > DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu *gt; networkworld.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER

Since name servers generally cache collected data for a while, the query time shown at the bottom of dig output might sometimes might say "0 msec":

;; Query time: 0 msec        

Who you gonna ask?

By default, dig will refer to your /etc/resolv.conf file to determine what name server to query, but you can refer queries to other DNS servers by adding an @ option.

In the example below, for example, the query is being sent to Google's name server (i.e., 8.8.8.8).

$ dig @8.8.8.8 networkworld.com

; > DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu > @8.8.8.8 networkworld.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER

To determine what version of dig you’re using, use the -v option. You should see something like this:

$ dig -v
DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu

or this:

$ dig -v
DiG 9.11.4-P2-RedHat-9.11.4-22.P2.el8

To get just the answer portion of this response, you can omit name server details, but still get the answer you're looking for by using both a +noall (don't show everything) and a +answer (but show the answer section) like this:

$ dig networkworld.com +noall +answer

; > DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu > networkworld.com +noall +answer
;; global options: +cmd
networkworld.com.       300     IN      A       151.101.194.165
networkworld.com.       300     IN      A       151.101.130.165
networkworld.com.       300     IN      A       151.101.66.165
networkworld.com.       300     IN      A       151.101.2.165

Looking up a batch of systems

If you want to dig for a series of domain names, you can list the domain names in a file and then use a command like this one to have dig run through the list and provide the information.

$ dig +noall +answer -f domains
networkworld.com.       300     IN      A       151.101.66.165
networkworld.com.       300     IN      A       151.101.2.165
networkworld.com.       300     IN      A       151.101.130.165
networkworld.com.       300     IN      A       151.101.194.165
world.std.com.          77972   IN      A       192.74.137.5
uushenandoah.org.       1982    IN      A       162.241.24.209
amazon.com.             18      IN      A       176.32.103.205
amazon.com.             18      IN      A       176.32.98.166
amazon.com.             18      IN      A       205.251.242.103

You could add +short to the command above but, with some sites having multiple IP addresses, this might not be very useful. To cut down on the detail but be sure that you can tell which IP belongs to which domain, you could instead pass the output to awk to display just the first and last columns of data:

$ dig +noall +answer -f domains | awk '{print $1,$NF}'
networkworld.com. 151.101.66.165
networkworld.com. 151.101.130.165
networkworld.com. 151.101.194.165
networkworld.com. 151.101.2.165
world.std.com. 192.74.137.5
amazon.com. 176.32.98.166
amazon.com. 205.251.242.103
amazon.com. 176.32.103.205
sandra_henrystocker
Unix Dweeb

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

The opinions expressed in this blog are those of Sandra Henry-Stocker and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author