When 'dig' returns a single A record, the IP address changes between calls. What is this a sign of?
Mar 19
In my internal work network, whenever I launch dig against a particular hostname, I get result similar to this:
;; ANSWER SECTION:
some.internal.host.com. 10 IN A 10.210.54.121
If I keep spamming the same dig some.internal.host.com command, the response always has a single A record, but the IP address is changing between calls.
I assume it is some form of load-balancing, but the full list of IP addresses in the pool is hidden from inquisitive persons.
What could be the technique that is used here to achieve the described result?
1 answer
Accepted answer · original discussion
Mar 19
'10' in the output is TTL. It is short, 10 seconds, so one can guess that this is dynamically changing. That's why it should not live in DNS recursive servers' cache for more than 10 seconds.
How is it done? It depends on remote DNS server and the way it is implemented. Either hidden nodes dynamically (de-)register into DNS or DNS could be "detecting" alive backend hosts itself.
0 question comments
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.