Decode the Hostname #296

A reverse-DNS name is not a random string. It is a sentence an operator wrote about its own router: which port answered, which router it was, which city it stands in, and which network it belongs to. Network engineers read these fluently — the code that looks like a typo is a city. One name per round, two ways to play it.

The names here are real. Every one of them was read from a live PTR record when this corpus was frozen, and the address it came from is printed with the decode, so you can dig -x <address> and see the same name yourself. Nothing is looked up while this page renders and nothing was invented: names whose city could not be confirmed from the name's own letters were left out rather than guessed.

Which city? What does this label mean?

Reveal the decode

The name was 13.213.200.213.static.wline.lns.sme.cust.swisscom.ch, the PTR of 213.200.213.13.

Label	What it is	What it decodes to
13.213.200.213	address	the address written back to front: 213.200.213.13 becomes 13.213.200.213, last octet first, exactly the order a reverse-DNS zone is written in. Note that the address is not the same as the label read left to right — `dig -x 13.213.200.213` is a different machine, and today answers with an Amazon name
static	customer	permanently assigned, not from a pool
wline	customer	wireline: the fixed-line half of the operator, as opposed to mobile
lns	customer	L2TP network server — the box that terminates this subscriber's session
sme	customer	the line is sold to a small or medium business
cust	customer	the customer: read from the network outwards, this is where the name stops describing the operator and starts describing the line
swisscom	operator	the operator's own name
ch	country	the country: Switzerland — here the TLD and the country agree

The access line is spelled out from the network towards the customer: the address, then `static` (permanently assigned), `wline` (wireline), `lns` (the L2TP network server terminating the session), `sme` (small and medium business), `cust` (the customer). Every one of those labels describes the line; none of them is a place.

Copy result

How to read a name

Read a PTR name from the left, where it is most specific, to the right, where it becomes the operator's own domain. Each label answers one question and none of them answers two:

• the port — ae-5, xe-0/0/1, Te0/1/0/2, ge-0-0-0-100: the interface that answered, and therefore its speed. Juniper writes ge- 1G, xe- 10G, et- 40/100G, ae- a bundle; Cisco writes Gi, Te, Hu, Be.
• the router — r21, ccr21, bbr1, core2: which box it is inside that site. The number means nothing outside it.
• the city — frnkge13, fra06, mem1, Atlanta1: the operator's own code for the place. Some write four letters of the city plus the country (FRNK+GE), some write the airport code (FRA, MEM, CLE), some just spell it out.
• the country or state — de, uk, tx: often written twice, once in the code and once on its own.
• the role — bb backbone, ce customer edge, sa service aggregation: the box's job in the network.
• the network and the operator — gin.ntt.net, atlas.cogentco.com, cbone.comcast.net, zip.zayo.com. This is the part that says who, never where.

A customer line is the same grammar with the place taken out: 63-218-0-33.static.as3491.net is the subscriber's own address, written out with hyphens, marked static or dynamic, in the operator's domain. Watch the direction, though — PCCW writes the address the way you would type it, while Swisscom writes it back to front, so 13.213.200.213 in that name is the address 213.200.213.13: the order a reverse zone is written in. Two carriers, one address, opposite habits.

Why a geo database disagrees

Paste one of these addresses into a geolocation service and it will often name a different city — in this corpus, several routers in Europe are placed in São Paulo or Singapore by the same database, because a backbone interface address is registered to a country-wide block, not to a building. The city code in the name is not a guess: it was written by the operator that owns the router, and the name usually carries a second, independent label saying the same thing. When the two labels agree with each other and with the country domain, the code is a place. That gap between what the router says and what the registry says is a useful thing to know before trusting any single database.

Where the corpus comes from

Each name on this page was read with dig -x against a real address of a real carrier — NTT, Cogent, Zayo, Hurricane Electric, Lumen/Level 3, Arelion, Comcast, Tata Communications, PCCW — and kept only when the city could be read off the name itself. The address travels with every round, so the check is one command away. The same trick is how researchers extract geography from router hostnames at internet scale: see Learning to Extract Geographic Information from Internet Router Hostnames (CAIDA, 2021) — the codes are a city, and the pattern is regular enough to mine.

The tool behind this mechanic: DNS records

More rounds and more games

This is label mode on the daily round, the same for everyone on 2026-10-23. /ptr.htm?p=1, ?p=2, ?p=3 … walk through the corpus one name at a time, and ?m=label switches to the questions about single labels.

Like this one? Ping Detective is the same idea with round-trip times instead of names, the traceroute globe shows what a real path looks like, and the network tools will resolve a name back to an address.