0

I am trying to troubleshoot certain CDN problem, testing what kind of download speeds I get on different servers. Let's say it is host.example.com which will return me some IP address, not sure which one (there are various, and they seem to offer different download speeds).

By default I seem to get a certain IP address, not sure how it decides which IP address it gives to me or anyone else (not important at this point), but I try to test some other servers in that pool by using the hosts file in Windows 11. I enter it into the hosts file and:

ipconfig /flushdns
ping host.example.com
nslookup host.example.com

Ping gives the IP address which I entered into the hosts file, while nslookup gives the one that I'd receive from DNS without the hosts file?

I am unsure if that is how it is supposed to work, ie. nslookup doesn't care about the hosts file, but I think I did get the hosts file IP address when I tried this same test in a Linux machine.

In addition, I realize that if the browser uses e.g. DNS-over-HTTPS, it would completely bypass the hosts file and instead use the IP address it gets from the DoH-capable DNS server, whatever it is. I've tried to make sure DoH is disabled in the browser.

So, now in Windows I am unsure what is the actual IP-address that the browser will use, if it tries to access host.example.com. So my question is: Is there some way to check that within the browser itself, whether it uses the entry in the hosts file or not? That is, to check what is the IP address that the browser (not ping or nslookup) thinks is the correct one for host.example.com?

Improve this question
1
  • The solution is to run your own dns server and replace the record you want to change. Hosts file is a horrible way to change DNS records.
    – Ramhound
    Commented Jun 22 at 15:23

1 Answer 1

Reset to default
0

nslookup is looking up a nameserver. Ping is resolving as per your hosts file, and firing off a ICMP packet. Both of these are the 'wrong' tools.

Its worth a closer look at your nslookup output. In my case, very handily I'm using a simple dns server for filtering to lookup a system I have at home. I'm running windows and nslookup tells you what server you're using

PS C:\Users\faile> nslookup zimanas.home
Server:  utilitybox
Address:  192.168.2.149

Non-authoritative answer:
Name:    nas.home
Address:  192.168.2.152

Now if I change it - it'll still be looking up whatever nameserver its told to look up not the hosts file.

hosts files bypass it for name resolution but nslookup is still looking up your nameserver.

I suspect part of the potential confusion here is misunderstanding what nslookup does - which is look up your default name server. That's its entire point. Its a way to test dns resolution, not host name resolution.

I suspect the 'easiest' way to do this would be to use devtools (f12 on chromium based browsers) . I run vivaldi, but I'm fairly certain chrome and firefox will run similarly - I had to open up the remote address column separately but, you can get the actual IP the resources a page is using that way

enter image description here

This should get you the actual IP a specific resource on a page is using

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .