Hands-on lab — Day 16: IP Addresses, DNS, and Routing

#!/usr/bin/env bash
# Day 016 lab — completed reference: explore DNS and routing.
#
# Resolves a name to its IPv4/IPv6 addresses, reads its MX record, notes how
# to walk the full DNS hierarchy, traces the route to it (a few hops, with a
# timeout so it never hangs), and classifies each resolved address as public
# or private. Uses example.com — a domain reserved for documentation and
# testing (RFC 2606) — so the lab probes nobody's private systems.
#
# Requires network access. If offline (or dig is missing) it says so plainly
# and still exits cleanly, so you can read the structure before you are online.
set -uo pipefail

DOMAIN="${1:-example.com}"

echo "=== DNS and Routing Report ==="
echo "Generated on: $(date '+%Y-%m-%d')"
echo "Target domain: ${DOMAIN}"
echo

# --- helper: is this IPv4 address in a private / loopback range? -------------
classify_ipv4() {
  local ip="$1"
  case "${ip}" in
    10.*) echo "private (10.0.0.0/8)" ;;
    192.168.*) echo "private (192.168.0.0/16)" ;;
    127.*) echo "loopback (127.0.0.0/8)" ;;
    172.1[6-9].* | 172.2[0-9].* | 172.3[0-1].*) echo "private (172.16.0.0/12)" ;;
    *) echo "public" ;;
  esac
}

# --- preflight: do we have a DNS tool, and are we online? --------------------
have_dig="no"
command -v dig >/dev/null 2>&1 && have_dig="yes"

online="no"
if [ "${have_dig}" = "yes" ]; then
  if dig +time=3 +tries=1 +short A "${DOMAIN}" >/dev/null 2>&1; then
    # A successful command does not guarantee an answer; check for one below.
    online="yes"
  fi
fi

if [ "${have_dig}" != "yes" ]; then
  echo "NOTE: 'dig' is not installed — install it (see requirements/README.md)"
  echo "      or use 'nslookup ${DOMAIN}' by hand. Skipping live DNS queries."
fi

# --- 1. A record (IPv4) ------------------------------------------------------
echo "1. A record (IPv4 addresses)"
a_records=""
if [ "${have_dig}" = "yes" ]; then
  a_records="$(dig +time=3 +tries=1 +short A "${DOMAIN}" 2>/dev/null | grep -E '^[0-9]+\.' || true)"
fi
if [ -n "${a_records}" ]; then
  while IFS= read -r ip; do
    [ -z "${ip}" ] && continue
    echo "   ${ip}   -> $(classify_ipv4 "${ip}")"
  done <<< "${a_records}"
  first_a="$(echo "${a_records}" | head -n 1)"
  echo "   A record IP (first): ${first_a}"
else
  echo "   (no A record retrieved — offline, no dig, or no such record)"
fi
echo

# --- 2. AAAA record (IPv6) ---------------------------------------------------
echo "2. AAAA record (IPv6 addresses)"
aaaa_records=""
if [ "${have_dig}" = "yes" ]; then
  aaaa_records="$(dig +time=3 +tries=1 +short AAAA "${DOMAIN}" 2>/dev/null | grep -E ':' || true)"
fi
if [ -n "${aaaa_records}" ]; then
  echo "${aaaa_records}" | sed 's/^/   /'
  echo "   (IPv6 present)"
else
  echo "   (no AAAA record retrieved — this name may have none, or you are offline)"
fi
echo

# --- 3. MX record (mail exchange) --------------------------------------------
echo "3. MX record (mail exchange)"
mx_records=""
if [ "${have_dig}" = "yes" ]; then
  mx_records="$(dig +time=3 +tries=1 +short MX "${DOMAIN}" 2>/dev/null || true)"
fi
if [ -n "${mx_records}" ]; then
  echo "${mx_records}" | sed 's/^/   /'
else
  echo "   (none — the domain may have no MX record, or a null MX '0 .')"
fi
echo

# --- 4. Walking the full hierarchy (note) ------------------------------------
echo "4. Walking the hierarchy"
echo "   To watch the resolver walk root -> TLD -> authoritative yourself, run:"
echo "       dig +trace ${DOMAIN}"
echo "   It prints every referral from the root servers down to the"
echo "   authoritative name servers. (Not run here to keep output short.)"
echo

# --- 5. traceroute (a few hops, with a timeout) ------------------------------
echo "5. Route to ${DOMAIN} (first few hops)"
if command -v traceroute >/dev/null 2>&1; then
  # -m 8: stop after 8 hops.  -w 2: wait at most 2s per hop.  -q 1: one probe.
  # Wrapped so a slow/blocked network never hangs the whole script.
  if hops="$(traceroute -m 8 -w 2 -q 1 "${DOMAIN}" 2>/dev/null)"; then
    echo "${hops}" | sed 's/^/   /'
    hop_count="$(echo "${hops}" | grep -Ec '^[[:space:]]*[0-9]+')"
    echo "   Hops shown: ${hop_count} (capped at 8; '* * *' means a silent router)"
  else
    echo "   (traceroute did not complete — network may block probes; that is normal)"
  fi
else
  echo "   (traceroute not installed — see requirements/README.md; on Windows use 'tracert')"
fi
echo

echo "=== End of report ==="

lesson_id: D016
day: 16
kind: command-line-inspection
languages: [bash]
setup_commands:
  - cd labs/sections/computing-foundations/day-016-ip-addresses-dns-and-routing
run_commands:
  - bash examples/explore_dns.sh
  - bash starter/explore_dns.sh
test_commands:
  - bash tests/run_tests.sh
cleanup_commands:
  - 'git checkout -- starter/explore_dns.sh  # optional: reset your work'
requires_network: true
requires_api_key: false
estimated_minutes: 30
last_executed: '2026-07-12'
executed_on: 'macOS (Apple Silicon), online — bash tests/run_tests.sh → 12 checks, 0 failure(s), 0 skipped'

# Dependencies — Day 016 lab

This lab needs a POSIX shell and two small network tools. Both are free and
open source.

## `dig` (DNS lookup)

- **macOS:** ships with the system on most versions. If missing,
  `brew install bind` provides it.
- **Debian / Ubuntu:** `sudo apt install dnsutils`
- **Fedora / RHEL:** `sudo dnf install bind-utils`
- **Fallback:** `nslookup` is preinstalled almost everywhere (including
  Windows) and answers the same basic questions, just with less detail. The
  scripts prefer `dig`; if it is absent they tell you to use `nslookup`.

## `traceroute` (route tracing)

- **macOS:** preinstalled (`/usr/sbin/traceroute`).
- **Debian / Ubuntu:** `sudo apt install traceroute`
- **Fedora / RHEL:** `sudo dnf install traceroute`
- **Windows:** use the built-in `tracert` command instead.

> Note: `traceroute` can be **slow** (it waits for each hop) and is often
> **rate-limited or blocked** by intermediate networks, which shows up as
> `* * *` lines. That is expected, not a failure. The lab's scripts cap it at
> a few hops with a short per-hop timeout so it never hangs.

## Optional, for the extension exercises

- `whois` — domain and IP registration lookups (`sudo apt install whois` on
  Debian/Ubuntu; preinstalled on macOS).
- `ping` — reachability checks (preinstalled on macOS, Linux, and Windows).

## Network

This lab **requires network access** for its live queries. Run offline, every
script and the test suite still execute and report clearly (network checks are
skipped, not failed) — but you will not see real addresses or hops until you
are online.

There is deliberately no `requirements.txt`/`package.json`: everything here is
a system utility.

# DNS and Routing worksheet — Day 016

Fill in every value using `bash starter/explore_dns.sh` (once you have
completed the four exercises) or the individual commands from the lesson's
hands-on section. Use `example.com` for the first column; optionally repeat
for one more site of your choice in the second.

| Field | example.com | (your choice) |
| --- | --- | --- |
| Date measured | | |
| A record — first IPv4 address | | |
| Is that A-record address public or private? | | |
| AAAA record present? (yes / no) | | |
| One AAAA (IPv6) address, if any | | |
| MX record (address, `0 .` null MX, or "none") | | |
| Number of hops from traceroute to the host | | |
| Your default gateway (hop 1 of traceroute) | | |

## How the lookup happened, in my own words

Write 4–6 sentences narrating the journey for `example.com`: your request to
the resolver, the resolver walking root → TLD → authoritative, the address
coming back, and your packets hopping to it. Use your own captured numbers,
and state explicitly whether the final address is public or private and how
you can tell.

## One thing that surprised me

One or two sentences (for example: a hop that stayed silent as `* * *`, a
domain with no MX record, or how few hops it took to cross the world).

#!/usr/bin/env bash
# Day 016 lab — STARTER: explore DNS and routing.
#
# Your task: complete the four exercises below by replacing each `REPLACE_ME`
# with the exact command named in its comment (keep the surrounding "$( )" so
# the command's output is captured into the variable). Then run:
#
#     bash starter/explore_dns.sh
#
# A completed reference version is in examples/explore_dns.sh — try it first.
# This uses example.com, a domain reserved for documentation and testing.
set -uo pipefail

DOMAIN="${1:-example.com}"

echo "=== DNS and Routing Report ==="
echo "Generated on: $(date '+%Y-%m-%d')"
echo "Target domain: ${DOMAIN}"
echo

# --- Exercise 1: resolve the A record (IPv4 address) -------------------------
# Command:  dig +short A "${DOMAIN}"
# Replace REPLACE_ME below with:  $(dig +short A "${DOMAIN}")
a_records="REPLACE_ME"
echo "1. A record (IPv4 addresses)"
echo "${a_records}" | sed 's/^/   /'
echo

# --- Exercise 2: resolve the AAAA record (IPv6 address) ---------------------
# Command:  dig +short AAAA "${DOMAIN}"
# Replace REPLACE_ME below with:  $(dig +short AAAA "${DOMAIN}")
aaaa_records="REPLACE_ME"
echo "2. AAAA record (IPv6 addresses)"
echo "${aaaa_records}" | sed 's/^/   /'
echo

# --- Exercise 3: read the MX record (mail exchange) -------------------------
# Command:  dig +short MX "${DOMAIN}"
# Replace REPLACE_ME below with:  $(dig +short MX "${DOMAIN}")
mx_records="REPLACE_ME"
echo "3. MX record (mail exchange)"
echo "${mx_records}" | sed 's/^/   /'
echo

# --- Exercise 4: trace the route to the domain (first few hops) -------------
# Command:  traceroute -m 8 -w 2 -q 1 "${DOMAIN}"
#   -m 8 stops after 8 hops, -w 2 waits at most 2s per hop, -q 1 sends one
#   probe per hop — so it finishes quickly and never hangs.
# Replace REPLACE_ME below with:  $(traceroute -m 8 -w 2 -q 1 "${DOMAIN}" 2>&1)
route_output="REPLACE_ME"
echo "4. Route to ${DOMAIN} (first few hops)"
echo "${route_output}" | sed 's/^/   /'
echo

echo "Tip: to watch the DNS hierarchy walk from root to authoritative, run:"
echo "     dig +trace ${DOMAIN}"
echo
echo "=== End of report ==="

#!/usr/bin/env bash
# Tests for the Day 016 lab. Run from the lab directory:
#   bash tests/run_tests.sh
#
# Structural checks always run (the reference script must produce a
# well-formed report and exit cleanly). Network checks (dig returns a real
# IP) run only when the machine is online; offline they are SKIPPED with a
# message and the suite still passes. Exit status is 0 when all run checks
# pass, non-zero on any structural failure — so it is CI-safe either way.
set -u

lab_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
failures=0
checks=0
skips=0

check() {
  local label="$1" ok="$2"
  checks=$((checks + 1))
  if [ "${ok}" = "yes" ]; then
    echo "  ok: ${label}"
  else
    echo "  FAIL: ${label}"
    failures=$((failures + 1))
  fi
}

skip() {
  skips=$((skips + 1))
  echo "  SKIP: $1"
}

# --- Are we online with a working DNS tool? ---------------------------------
network_ok="no"
if command -v dig >/dev/null 2>&1; then
  if dig +time=3 +tries=1 +short A example.com 2>/dev/null | grep -qE '^[0-9]+\.'; then
    network_ok="yes"
  fi
fi
if [ "${network_ok}" = "yes" ]; then
  echo "Network: online (dig resolved example.com) — running full checks."
else
  echo "Network: offline or 'dig' unavailable — network checks will be SKIPPED."
fi
echo

# --- Structural checks against the reference script -------------------------
ref="${lab_dir}/examples/explore_dns.sh"
echo "Testing ${ref} ..."
if output="$(bash "${ref}" 2>&1)"; then
  check "reference script exits successfully" "yes"
else
  check "reference script exits successfully" "no"
  echo "${output}" | sed 's/^/    /'
fi

echo "${output}" | grep -q '^=== DNS and Routing Report ===$' && check "prints report header" "yes" || check "prints report header" "no"
echo "${output}" | grep -q '^=== End of report ===$' && check "prints report footer" "yes" || check "prints report footer" "no"
echo "${output}" | grep -q 'A record (IPv4' && check "has A-record section" "yes" || check "has A-record section" "no"
echo "${output}" | grep -q 'AAAA record (IPv6' && check "has AAAA-record section" "yes" || check "has AAAA-record section" "no"
echo "${output}" | grep -q 'MX record' && check "has MX-record section" "yes" || check "has MX-record section" "no"
echo "${output}" | grep -q 'Route to' && check "has route section" "yes" || check "has route section" "no"
echo "${output}" | grep -q 'dig +trace' && check "mentions dig +trace for the hierarchy" "yes" || check "mentions dig +trace for the hierarchy" "no"

# --- Network-dependent checks -----------------------------------------------
if [ "${network_ok}" = "yes" ]; then
  if echo "${output}" | grep -qE 'A record IP \(first\): [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'; then
    check "reference script resolved a real IPv4 address" "yes"
  else
    check "reference script resolved a real IPv4 address" "no"
  fi
  if dig +time=3 +tries=1 +short A example.com 2>/dev/null | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
    check "dig independently returns an IPv4 for example.com" "yes"
  else
    check "dig independently returns an IPv4 for example.com" "no"
  fi
else
  skip "network check: reference script resolves an IPv4 (offline)"
  skip "network check: dig returns an IPv4 for example.com (offline)"
fi

# --- Structural checks against the starter ----------------------------------
starter="${lab_dir}/starter/explore_dns.sh"
echo "Testing ${starter} ..."
if bash "${starter}" >/dev/null 2>&1; then
  check "starter script exits successfully" "yes"
else
  check "starter script exits successfully" "no"
fi
if grep -q '"REPLACE_ME"' "${starter}"; then
  echo "  Note: starter still has unfinished exercises (REPLACE_ME) — structure only."
  check "starter names the four required commands in comments" \
    "$(grep -qE 'dig \+short A' "${starter}" && grep -qE 'dig \+short AAAA' "${starter}" && grep -qE 'dig \+short MX' "${starter}" && grep -qE 'traceroute' "${starter}" && echo yes || echo no)"
else
  # Learner has completed it: hold it to the same output shape.
  sout="$(bash "${starter}" 2>&1 || true)"
  echo "${sout}" | grep -q '^=== DNS and Routing Report ===$' && check "completed starter prints header" "yes" || check "completed starter prints header" "no"
  if [ "${network_ok}" = "yes" ]; then
    echo "${sout}" | grep -qE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' && check "completed starter shows a resolved IPv4" "yes" || check "completed starter shows a resolved IPv4" "no"
  else
    skip "network check: completed starter shows a resolved IPv4 (offline)"
  fi
fi

echo
echo "${checks} checks, ${failures} failure(s), ${skips} skipped."
[ "${failures}" -eq 0 ]