Decode the Hostname practice #2

A reverse-DNS name is not a random string. It is a sentence an operator wrote about its own router: which port answered, which router it was, which city it stands in, and which network it belongs to. Network engineers read these fluently — the code that looks like a typo is a city. One name per round, two ways to play it.

The names here are real. Every one of them was read from a live PTR record when this corpus was frozen, and the address it came from is printed with the decode, so you can dig -x <address> and see the same name yourself. Nothing is looked up while this page renders and nothing was invented: names whose city could not be confirmed from the name's own letters were left out rather than guessed.

Which city? What does this label mean?

Reveal the decode

The name was ae-1.a02.frnkge13.de.bb.gin.ntt.net, the PTR of 129.250.2.5.

Label	What it is	What it decodes to
ae-1	interface	aggregated Ethernet: several physical links bundled into one logical interface.
a02	router	another equipment class in the same PoP, in the operator's own naming. What matters is that it is not a city.
frnkge13	city	FRNK = Frankfurt, GE = Germany, 13 = the site number
de	country	the PoP's country: Germany.
bb	role	backbone: the long-haul part of the operator's network, the part that carries traffic between cities.
gin	network	the operator's own name for its whole network — on routers in every city it serves, so it can never say where.
ntt	operator	the operator: NTT, whose own domain this is.
net	root	a top-level domain. A PTR name is always fully qualified, which is what the trailing dot in a `dig -x` answer marks: the name ends at the DNS root.

The router is in Frankfurt, Germany.

The code is a city written in the operator's house style — three or four letters of the city, an airport code, or an airport code plus a country. Every operator has its own style and every operator means the same kind of thing by it. `FRNK` is not a company: it is Frankfurt, and the same `frnkge`, `fra` and `ffm` codes turn up in weather-station hostnames, in BGP metadata and in traceroute output, which is why researchers mine router hostnames for geography in the first place.

Copy result

How to read a name

Read a PTR name from the left, where it is most specific, to the right, where it becomes the operator's own domain. Each label answers one question and none of them answers two:

• the port — ae-5, xe-0/0/1, Te0/1/0/2, ge-0-0-0-100: the interface that answered, and therefore its speed. Juniper writes ge- 1G, xe- 10G, et- 40/100G, ae- a bundle; Cisco writes Gi, Te, Hu, Be.
• the router — r21, ccr21, bbr1, core2: which box it is inside that site. The number means nothing outside it.
• the city — frnkge13, fra06, mem1, Atlanta1: the operator's own code for the place. Some write four letters of the city plus the country (FRNK+GE), some write the airport code (FRA, MEM, CLE), some just spell it out.
• the country or state — de, uk, tx: often written twice, once in the code and once on its own.
• the role — bb backbone, ce customer edge, sa service aggregation: the box's job in the network.
• the network and the operator — gin.ntt.net, atlas.cogentco.com, cbone.comcast.net, zip.zayo.com. This is the part that says who, never where.

A customer line is the same grammar with the place taken out: 63-218-0-33.static.as3491.net is the subscriber's own address, written out with hyphens, marked static or dynamic, in the operator's domain. Watch the direction, though — PCCW writes the address the way you would type it, while Swisscom writes it back to front, so 13.213.200.213 in that name is the address 213.200.213.13: the order a reverse zone is written in. Two carriers, one address, opposite habits.

Why a geo database disagrees

Paste one of these addresses into a geolocation service and it will often name a different city — in this corpus, several routers in Europe are placed in São Paulo or Singapore by the same database, because a backbone interface address is registered to a country-wide block, not to a building. The city code in the name is not a guess: it was written by the operator that owns the router, and the name usually carries a second, independent label saying the same thing. When the two labels agree with each other and with the country domain, the code is a place. That gap between what the router says and what the registry says is a useful thing to know before trusting any single database.

Where the corpus comes from

Each name on this page was read with dig -x against a real address of a real carrier — NTT, Cogent, Zayo, Hurricane Electric, Lumen/Level 3, Arelion, Comcast, Tata Communications, PCCW — and kept only when the city could be read off the name itself. The address travels with every round, so the check is one command away. The same trick is how researchers extract geography from router hostnames at internet scale: see Learning to Extract Geographic Information from Internet Router Hostnames (CAIDA, 2021) — the codes are a city, and the pattern is regular enough to mine.

The tool behind this mechanic: DNS records

More rounds and more games

This is label mode, practice #2 — the same for everyone who asks for that number. /ptr.htm?p=1, ?p=2, ?p=3 … walk through the corpus one name at a time, and ?m=label switches to the questions about single labels.

Like this one? Ping Detective is the same idea with round-trip times instead of names, the traceroute globe shows what a real path looks like, and the network tools will resolve a name back to an address.