Decode the Hostname practice #3

A reverse-DNS name is not a random string. It is a sentence an operator wrote about its own router: which port answered, which router it was, which city it stands in, and which network it belongs to. Network engineers read these fluently — the code that looks like a typo is a city. One name per round, two ways to play it.

The names here are real. Every one of them was read from a live PTR record when this corpus was frozen, and the address it came from is printed with the decode, so you can dig -x <address> and see the same name yourself. Nothing is looked up while this page renders and nothing was invented: names whose city could not be confirmed from the name's own letters were left out rather than guessed.

Which city? What does this label mean?

Reveal the decode

The name was be31-994.core4.lon2.he.net, the PTR of 184.104.192.13.

Label	What it is	What it decodes to
be31-994	interface	bundle Ethernet: a link-aggregation bundle, the same idea as `ae-`.
core4	router	a core router.
lon2	city	LON = London, 2 = the site number
he	operator	the operator: Hurricane Electric.
net	root	a top-level domain. A PTR name is always fully qualified, which is what the trailing dot in a `dig -x` answer marks: the name ends at the DNS root.

The router is in London, United Kingdom.

Same city, another operator: NTT writes `londen12` for London. Two companies, two codes, one place — which is why `lon2` is a city and not a company, and why the same kind of code shows up in weather-station hostnames and in BGP metadata too.

Copy result

How to read a name

Read a PTR name from the left, where it is most specific, to the right, where it becomes the operator's own domain. Each label answers one question and none of them answers two:

• the port — ae-5, xe-0/0/1, Te0/1/0/2, ge-0-0-0-100: the interface that answered, and therefore its speed. Juniper writes ge- 1G, xe- 10G, et- 40/100G, ae- a bundle; Cisco writes Gi, Te, Hu, Be.
• the router — r21, ccr21, bbr1, core2: which box it is inside that site. The number means nothing outside it.
• the city — frnkge13, fra06, mem1, Atlanta1: the operator's own code for the place. Some write four letters of the city plus the country (FRNK+GE), some write the airport code (FRA, MEM, CLE), some just spell it out.
• the country or state — de, uk, tx: often written twice, once in the code and once on its own.
• the role — bb backbone, ce customer edge, sa service aggregation: the box's job in the network.
• the network and the operator — gin.ntt.net, atlas.cogentco.com, cbone.comcast.net, zip.zayo.com. This is the part that says who, never where.

A customer line is the same grammar with the place taken out: 63-218-0-33.static.as3491.net is the subscriber's own address, written out with hyphens, marked static or dynamic, in the operator's domain. Watch the direction, though — PCCW writes the address the way you would type it, while Swisscom writes it back to front, so 13.213.200.213 in that name is the address 213.200.213.13: the order a reverse zone is written in. Two carriers, one address, opposite habits.

Why a geo database disagrees

Paste one of these addresses into a geolocation service and it will often name a different city — in this corpus, several routers in Europe are placed in São Paulo or Singapore by the same database, because a backbone interface address is registered to a country-wide block, not to a building. The city code in the name is not a guess: it was written by the operator that owns the router, and the name usually carries a second, independent label saying the same thing. When the two labels agree with each other and with the country domain, the code is a place. That gap between what the router says and what the registry says is a useful thing to know before trusting any single database.

Where the corpus comes from

Each name on this page was read with dig -x against a real address of a real carrier — NTT, Cogent, Zayo, Hurricane Electric, Lumen/Level 3, Arelion, Comcast, Tata Communications, PCCW — and kept only when the city could be read off the name itself. The address travels with every round, so the check is one command away. The same trick is how researchers extract geography from router hostnames at internet scale: see Learning to Extract Geographic Information from Internet Router Hostnames (CAIDA, 2021) — the codes are a city, and the pattern is regular enough to mine.

The tool behind this mechanic: DNS records

More rounds and more games

This is city mode, practice #3 — the same for everyone who asks for that number. /ptr.htm?p=1, ?p=2, ?p=3 … walk through the corpus one name at a time, and ?m=label switches to the questions about single labels.

Like this one? Ping Detective is the same idea with round-trip times instead of names, the traceroute globe shows what a real path looks like, and the network tools will resolve a name back to an address.