3

I'm using nslookup and findstr in a simple batch script to check if a website is up.
However findstr keeps printing lines which doesn't contain any matches. The command goes like this:

nslookup goofdedwsgle.com  | findstr /X /C:"Non-existent domain"

which results in

*** one.one.one.one can't find goofdedwsgle.com: Non-existent domain

Which is what I'm looking for. However if I use an existent domain:

nslookup google.com 1.1.1.1 | findstr /X /C:"Non-existent domain"

I get this which is definitely not a match:

Non-authoritative answer:

It seems this is from the full nslookup output:

Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
Name:    google.com
Addresses:  2404:6800:4004:80a::200e
          142.250.66.78

but why does findstr print out that line? /X should guarantee findstr only print out matches right?
Even weirder, if I make a txt file with that same content as the nslookup result, then run findstr /X /C:"Non-existent domain" on that, it shows up empty.
What is the issue here?

Mizuki
  • 33
  • 5
  • @KamilMaciorowski okay this is getting weirder, `nslookup google.com 1.0.0.1 > file.txt` *also* gets me `Non-authoritative answer:`, and the file content *lacks* that line. seems this is a `nslookup` issue and not a `findstr` one... – Mizuki Aug 25 '23 at 16:10
  • 1
    @Mizuki you can also `findstr fsdsdfsdfsdfsf` on that and it'll also report that line. Not exactly sure why, but weird for sure. And yes, looks like `nslookup` issue as it also happens with bunch of PowerShell functions or `grep`. – Destroy666 Aug 25 '23 at 16:28
  • 1
    @Destroy666 ah I see, `stdout` and `stderr` are different things even though they both are printed onto the `cmd` result, and only `stdout` is redirected with `>`. I see! thank you ^^ – Mizuki Aug 25 '23 at 16:48
  • To be clear, this checks only existence of DNS A or AAAA record(s) (or CNAME pointing to same); it doesn't check 'the' website is up or even exists (_lots_ of domain names aren't websites, and some addresses aren't actual machines). – dave_thompson_085 Aug 29 '23 at 08:23

2 Answers2

1

nslookup seems to always output Non-authoritative answer: in stderr stream which is the issue here. Even though that case is common.

You can redirect stderr to nul (or &1 = stdin if needed) as a workaround:

nslookup google.com 1.1.1.1 2>nul | findstr /X /C:"Name:    google.com"

Result:

Name: google.com

Or use more modern PowerShell functions which don't have this issue and filtering on them is also easier:

Resolve-DnsName -Name google.com -Server 1.1.1.1
Destroy666
  • 5,299
  • 7
  • 16
  • 35
  • 1
    aw thank you! yeah I'll try pwsh ^^ – Mizuki Aug 25 '23 at 16:46
  • @Destroyer666 and yeah, it seems pwsh is the only way for me. Because both `Non-authoritative answer:` and `Non-existent domain` are on `stderr` so redirecting like that won't work...I can use `busybox sed` to filter only the former out but seems like a lot of work – Mizuki Aug 25 '23 at 17:12
  • update: `nslookup gccggoogle.com 8.8.8.8 2>&1 | findstr /C:"Non-existent domain"` works for some reason... – Mizuki Aug 25 '23 at 17:37
  • 1
    It works if you need your other use case of some error output working as it redirects errors to standard output, so that won't get displayed constantly and you can search text in other errors. I'd recommend PowerShell regardless and in general. – Destroy666 Aug 25 '23 at 17:41
0

You can also redirect stderr "2" to >& the stdout "1" and filter with a simpler find "string" command, or findstr /end "string", or even with with a simple findstr "string"

Redirect stderr to stdout 2&1:

nslookup google.com 1.1.1.1 2>&1 | findstr /e "google.com"
Nome:    google.com

nslookup google.com 1.1.1.1 2>&1 | findstr "google.com"
Nome:    google.com

nslookup google.com 1.1.1.1 2>&1 | find "google.com"
Nome:    google.com

Obs.1: As much as the output is/returns Name:[some spaces]google.com, you can also consider that what you see in this "vacant" space are spaces, but it can be a TAB, and rarely some non-printable character. so that would explain some behavior when using /x, even though stderr messages appear to you.

Name:TABgoogle.com
Name:SpaceSpaceSpaceSpacegoogle.com
Name: One or More Nonprinting Characters google.com

Obs.2: I'm not saying that nsloopkup generates any of these characters, I'm telling you to observe when using /x in the output treatment that because they don't "print" something visible, any occurrence of these potential characters can interfere with findstr's behavior when filtering specifically the /x same character and/or /x same_characters_strings.

Additional resources:

Io-oI
  • 7,588
  • 3
  • 12
  • 41