Demo: following a URL with nslookup and the Network tab

Written Explanation

The plan

We will follow this URL: https://example.com. The domain example.com is reserved by the Internet Assigned Numbers Authority (IANA) for use in documentation and examples, which makes it a considerate choice for practice.

Our plan has two halves.

Half 1: asking DNS with nslookup

What nslookup does

Microsoft's documentation describes nslookup as a tool that displays information you can use to diagnose DNS. It exists in two forms of use:

• Non-interactive mode (also called command mode): you put everything on one line, and it prints an answer and exits. This is what we will use.
• Interactive mode: you type nslookup alone, get a > prompt, and type several lookups. You leave it by typing exit.

In non-interactive mode the first value after the command is the name to look up. An optional second value is the DNS server to ask. If you leave it out, nslookup uses your computer's default DNS server (the resolver from Lesson 3).

The command is available on Windows and is also widely available on macOS and Linux, although on some Linux systems you may need to install it. Menu names for opening a terminal depend on your system, so use these as a guide:

• Windows: search for "Command Prompt" or "PowerShell" in the Start menu.
• macOS: open the app called "Terminal".
• Linux: open your distribution's terminal program.

Running it

Type the following and press Enter:

nslookup example.com

You do not type the word https:// and you do not type a slash. Just the domain.

Reading the output

The exact layout differs between operating systems and versions, so the following is an illustrative example using documentation addresses, not a real result. Your own output will show real values.

Server:   dns.mynetwork.example
Address:  192.0.2.53

Non-authoritative answer:
Name:     example.com
Addresses:  2001:db8::10
            192.0.2.10

How to read it:

• The first block (Server and Address) describes the DNS server that answered you. This is your resolver, not the website. It is easy to mistake the first Address line for the answer, but it is not.
• The block after it, starting with Name, is the answer about the domain you asked for. The lines labelled Address or Addresses here hold the domain's IP addresses. This is where the answer lives.
• You may see two kinds of address. The dotted one (192.0.2.10) is IPv4. The one with colons (2001:db8::10) is IPv6 (Lesson 2).
• The phrase non-authoritative answer commonly appears when the answer came from a resolver's cache rather than straight from the domain's own authoritative server (Lesson 3). It is normal and nothing to worry about. Whether it appears can vary with your network.

So: the IP address of the domain is on the lines after the Name: line, and the address near the top belongs to the DNS server. That is the answer to a typical beginner question: "Which line holds the IP address?"

Why more than one address?

Run the command on two more domains of your choice, for example a news site and a large online service. Some will return one address and some several, and some will return both IPv4 and IPv6. Several addresses usually mean the site runs on more than one server, for capacity and reliability (Lesson 3). If you run the command again a bit later, or on a different network, the list or its order may change. That is normal, and it is why a single number is a snapshot, not a permanent fact.

The result may also differ from the result a friend gets in another country, because big sites often direct visitors to a nearby server.

Common error messages

Microsoft's documentation lists several error messages that nslookup can show. The most useful for you now are:

Exact wording differs between operating systems, so treat these as a guide.

The planned mistake: giving nslookup a URL

Now let us make the planned mistake on purpose. Type:

nslookup https://example.com

This is the kind of thing beginners often try, because the thing in the browser's address bar is a URL. But nslookup works with names (and IP addresses), not URLs. https://example.com is not a domain: it is a scheme (https://) plus a domain. DNS has no record for the whole text, so the lookup fails. You will most likely see an error such as "Nonexistent domain" or a similar message, though the exact text depends on your system and DNS server. If your system behaves differently, note down what you see.

The fix: use only the domain name.

nslookup example.com

The lesson: a URL is more than a domain (Lesson 3). nslookup wants only the domain part, which is the host. When a tool fails, ask first: "Did I give it the kind of thing it expects?"

Half 2: watching the request in the browser

Now we follow the same site in the browser, using what you learned in Lesson 6.

1. Open a new browser tab but do not load a page yet.
2. Open developer tools and select the Network panel. Shortcuts vary by browser; see Lesson 6 or search for "open Network tab" with your browser's name.
3. Type https://example.com and press Enter, or reload the page if it is already open.
4. Find the main document. It is typically the first row, with type document. On a very simple page there may be only a few rows.
5. Read three things from it: the method (usually GET), the status code (usually 200), and the type (document). If the method is not shown as a column, click the row and look at the Headers tab.

Expected result, subject to what your browser and the site show on the day: GET, 200, and document.

If the site redirected you first (for example from http to https), you may see a 301 or 302 row before the 200. Record both. The row for the page that finally arrived is the main document.

Connecting the two halves

This is the moment where the module's diagram becomes real.

One caveat: the address the browser actually connects to may differ from the one nslookup printed, because a domain can have several addresses and the browser picks one. Both belong to the same domain.

Notice also what nslookup cannot tell you. It tells you where the domain points. It does not tell you whether a web server is running there, whether the request will succeed, or what the page contains. That is why you need both tools.

Recording evidence for the lab

The module lab asks for screenshots plus labelled answers. A good way to record your work:

• For each domain, write the domain, the command you typed, and the IP addresses you found, with IPv4 and IPv6 labelled.
• For the browser, take a screenshot of the Network panel that shows the main document row, and write beside it: Method, Status, Type.
• Avoid including cookies, tokens, or personal data in screenshots.