nslookup finds server name from ip, but whois claims the name has expired?

Question

I noticed I was getting udp traffic on random ports from an unknown ip address that was definitely not on my domain today. When I looked up the ip using nslookup, it returned a name. But when I did a whois on both name whois complained that the name had expired and didn't give me back any information. So I tried the ip on whois, and whois couldn't find it at all.

How is this possible?

I don't remember :-p I had intended to check it out later, but then I cleared wireshark's cache — Ritwik Bose, Mar 04 '10 at 15:04

score 1 · Answer 1 · answered Mar 04 '10 at 03:55

1

It is possible that the domain has expired very recently and the DNS servers are just returning the name they have cached. If this is the case, the behaviour shouldn't continue for long; 48hrs is usually the max.

answered Mar 04 '10 at 03:55

squircle

504
6
14

score 1 · Answer 2 · edited Apr 13 '17 at 12:14

1

Keep in mind that UDP traffic is not stateful, so these packets could be forged.

edited Apr 13 '17 at 12:14

Community

1

answered Mar 04 '10 at 05:55

Zoredache

128,755
40
271
413

nslookup finds server name from ip, but whois claims the name has expired?

2 Answers2