Reverse ip lookup does not use /etc/hosts
I am investigating a problem on my LAN - some
operations seemed very slow.
There are 3 machines on the LAN. Two (leo.galaxy and
orion.galaxy) are only connected to the LAN. The third
(ursa.galaxy) is the firewall/gateway and also has a
connection thru a cable modem to the internet.
The test: on orion, I do: telnet leo 25. Port 25 is
the smtp port and leo is set up to run exim. I am
running iptraf on leo to see what happens. Both leo
and orion are in /etc/hosts on all 3 machines. So I do
not expect to see any traffic to my ISP's DNS.
Here is what I see (iptraf log):
----start log extract-----
Fri Oct 8 19:12:39 2004; UDP; eth0; 56 bytes; from
leo.galaxy:59023 to ns1.ggamaur.net:domain
Fri Oct 8 19:12:44 2004; UDP; eth0; 56 bytes; from
leo.galaxy:59024 to ns2.ggamaur.net:domain
Fri Oct 8 19:12:49 2004; UDP; eth0; 49 bytes; from
leo.galaxy:59025 to ns1.ggamaur.net:domain
Fri Oct 8 19:12:54 2004; UDP; eth0; 49 bytes; from
leo.galaxy:59026 to ns2.ggamaur.net:domain
Fri Oct 8 19:12:59 2004; UDP; eth0; 49 bytes; from
leo.galaxy:59025 to ns1.ggamaur.net:domain
Fri Oct 8 19:13:04 2004; UDP; eth0; 49 bytes; from
leo.galaxy:59026 to ns2.ggamaur.net:domain
Fri Oct 8 19:13:09 2004; TCP; eth0; 60 bytes; from
leo.galaxy:36716 to orion.galaxy:auth; first packet
(SYN)
--------end log extract----
The ISP's DNS are ns{1,2}.ggamaur.net so what seems to
be happening is that something on leo (exim?) is doing
a lookup, then times out after 40 seconds. The lookup
is completely pointless because after it fails, exim
continues anyway (and I see its prompt on orion). But
my question is, why is it going to the nameserver
anyway? Here's the relevant part of /etc/hosts:
127.0.0.1 localhost
192.168.1.9 ursa.galaxy ursa
192.168.1.5 orion.galaxy orion
192.168.1.11 leo.galaxy leo
And here's /etc/nsswitch.conf:
passwd: compat
group: compat
shadow: compat
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
Both leo and orion are running sarge. Here's the
output of uname -a on leo:
Linux Leo 2.6.3-1-k7 #2 Tue Feb 24 20:39:50 EST 2004
i686 GNU/Linux
Everything is up-to-date, I did apt-get update and
upgrade about a week ago.
Help!
Nick
Reply to: