What is Request.UserHostName actually returning and is it possible to convert it to something that I can get a host entry for?

Question

I think I may be in a situation where the answer is this is not possible but in case not here goes...

I have written an ASP .NET MVC 3 application and I am using the Request.UserHostName property and then passing the value that that returns into Dns.GetHostEntry to find out all the possible IPs and the host name for the currently connected client, for example:

var clientAddress = Request.UserHostName;
var entry = Dns.GetHostEntry(clientAddress);

Generally that is fine except I have a case where I get a "host not found" SocketException from the Dns.GetHostEntry call.

The really odd thing is that the address that is returned from the Request.UserHostName property is not the public address or any of the private addresses. To prove this I ran this bit of code on the client machine in question...

var host = Dns.GetHostEntry(Dns.GetHostName());

foreach (var a in host.Aliases)
{
    Console.WriteLine("alias '{0}'", a);
}

foreach (var a in host.AddressList)
{
    Console.WriteLine("ip address '{0}'", a);
}

// ...from http://stackoverflow.com/a/2353177/1039947...
String direction = "";
WebRequest request = WebRequest.Create("http://checkip.dyndns.org/");
using (WebResponse response = request.GetResponse())
{
    using (var stream = new StreamReader(response.GetResponseStream()))
    {
        direction = stream.ReadToEnd();
    }
}

int first = direction.IndexOf("Address: ") + 9;
int last = direction.LastIndexOf("</body>");
direction = direction.Substring(first, last - first);

Console.WriteLine("Public IP: '{0}'", direction);

It prints three IP addresses (::1, one private and one public) but none of them are the address that is returned from Request.UserHostName.

If I pass in any of the addresses printed from the above test application into the Dns.GetHostEntry method I get a sensible value back.

So, is there any way that I could get from this strange IP address that is not the public nor any of the privates, to one where I could get the host entry for it without an exception (and what is this address)?

By the way, there is no X_FORWARD_FOR header or anything else that I may be able to identify the client with, as far as I can tell, in the HTTP message?

Background to the Question

So it was pointed out (thanks Damien) that if I explained why I am asking this perhaps someone can provide an alternative approach so here is some background...

I have a requirement that the administrator of the application should be allowed to specify in the configuration a single machine that is allowed to view the page - IP address or machine name - I can probably get the machine name requirement removed but even if they specify the IP address in the configuration it will still not match the IP address that is returned from the UserHostName property since they will use the IP address that is returned when they ping the machine name.

My thinking, therefore, was that if I take whatever is sent in the HTTP header and pass that into GetHostEntry then take all the possible results from that (all the IPs and the host name) and see if any of them match the configured value I could say "allow" otherwise "disallow" (I was going to remove the part of the host name before the first dot too, to cover that eventuality). That scheme has been blown out of the water by this situation I have where the IP address is not at all what I would expect.

Answer 1

The host name of the client is not normally known because it is not transmitted at the HTTP level. The server cannot know it. Look at the HTTP requests with Fiddler to see for yourself that there is not a lot of information available to the server (and the client can forge all request contents of course).

Use the UserHostAddress property to get the IP address. That is the most you can reliably find out. Once you have that you can try to reverse the IP to a host name but that is not always possible.

Answer 2

I have a more specific answer to your question. By examining the source code for HttpRequest.UserHostName here, I found that it maps to a IIS server variable named REMOTE_HOST which is described here. The property will return the IP adddress of the client, unless you have configured IIS in the way described, in which case IIS will do a reverse DNS lookup to attempt to return the name associated with the IP.