[SOLVED] ping doesn't make a dns request

eantoranz · 03-06-2012, 01:22 PM

I'm trying to figure out why ping (and probably the whole ns system) is not asking to resolve one name to the configured DNS servers.

I have a hunch that it's because the name I'm trying to resolve is using a non-standard root domain name.

For example:

Code:

antoranz@pingui:~$ ping whatever.xxxxxxxxx.local
ping: unknown host whatever.xxxxxxxxx.local

It fais after a couple of seconds, by the way. And in wireshark I don't see any dns traffic going out.

If it's because of the "local", where can I set the permitted root domain names? Thanks in advance.

---------- Post added 03-06-12 at 04:23 PM ----------

Oh.... and I forgot to say that if I try with dig, the DNS request does go out and the name is resolved correctly.

ButterflyMelissa · 03-06-2012, 01:26 PM

Hi,

What's the contents of /etc/resolv.conf?

If there are no nameservers set there, my gues is that (some) stuff on your box will not use DNS...

Just a thought...

Thor

eantoranz · 03-06-2012, 01:40 PM

DNS servers are set there (as a matter of fact, when I make the dig request I don't set the DNS server so it uses the ones in /etc/resolv.conf).

eantoranz · 03-06-2012, 03:10 PM

A little more feedback, this is the strace result around the time when the timeout happens:

Code:

_llseek(3, 0, 0xbfb849c8, SEEK_CUR)     = -1 ESPIPE (Illegal seek)
write(3, "RESOLVE-HOSTNAME-IPV4 yyyy.xxxx."..., 38) = 38
read(3, "-15 Timeout reached\n", 4096)  = 20
close(3)                                = 0
munmap(0xb77fe000, 4096)                = 0
write(2, "ping: unknown host yyyy.xxxx.loc"..., 35ping: unknown host plata.cps.local
) = 35
exit_group(2)                           = ?

strace stops for some seconds on the read(3, .... then it finishes printing "-15 Timeout...."). I suppose there's a funcion call that should return either the final result of the name resolution or (as in this case), an error.

Skaperen · 03-06-2012, 03:28 PM

What is the contents of /etc/nsswitch.conf ?

The strace output shown is incomplete. Maybe the DNS query is elsewhere?

If you do not see DNS traffic "go out" maybe it is because the name server is local, or there is no route for the name server IP address.

Watch ALL IP traffic, including local (you can limit it to just port 53), and store the complete strace output. Something might be in there.

eantoranz · 03-06-2012, 04:02 PM

Code:

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat
group:          compat
shadow:         compat

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

Code:

$ strace ping yyyyy.xxx.local
execve("/bin/ping", ["ping", "yyyyy.xxx.local"], [/* 46 vars */]) = 0
brk(0)                                  = 0x8909000
fcntl64(0, F_GETFD)                     = 0
fcntl64(1, F_GETFD)                     = 0
fcntl64(2, F_GETFD)                     = 0
access("/etc/suid-debug", F_OK)         = -1 ENOENT (No such file or directory)
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7845000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=76757, ...}) = 0
mmap2(NULL, 76757, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7832000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\222\1\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1544392, ...}) = 0
mmap2(NULL, 1554968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x110000
mmap2(0x286000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x176) = 0x286000
mmap2(0x289000, 10776, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x289000
close(3)                                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7831000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb78318d0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0x286000, 8192, PROT_READ)     = 0
mprotect(0x8050000, 4096, PROT_READ)    = 0
mprotect(0xb9f000, 4096, PROT_READ)     = 0
munmap(0xb7832000, 76757)               = 0
socket(PF_INET, SOCK_RAW, IPPROTO_ICMP) = -1 EPERM (Operation not permitted)
getuid32()                              = 1000
setuid32(1000)                          = 0
brk(0)                                  = 0x8909000
brk(0x892a000)                          = 0x892a000
getpid()                                = 26358
open("/etc/resolv.conf", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=123, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7844000                                                                                              
read(3, "# Generated by NetworkManager\ndo"..., 4096) = 123                                                                                                                         
read(3, "", 4096)                       = 0                                                                                                                                         
close(3)                                = 0                                                                                                                                         
munmap(0xb7844000, 4096)                = 0                                                                                                                                         
stat64("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=123, ...}) = 0                                                                                                            
open("/etc/resolv.conf", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=123, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7844000
read(3, "# Generated by NetworkManager\ndo"..., 4096) = 123
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0xb7844000, 4096)                = 0
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
open("/etc/nsswitch.conf", O_RDONLY)    = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=513, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7844000
read(3, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 513
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0xb7844000, 4096)                = 0
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=76757, ...}) = 0
mmap2(NULL, 76757, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7832000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/libnss_files.so.2", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340\32\0\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=46736, ...}) = 0
mmap2(NULL, 49880, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x64d000
mmap2(0x658000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xa) = 0x658000
close(3)                                = 0
mprotect(0x658000, 4096, PROT_READ)     = 0
munmap(0xb7832000, 76757)               = 0
open("/etc/host.conf", O_RDONLY)        = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=92, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7844000
read(3, "# The \"order\" line is only used "..., 4096) = 92
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0xb7844000, 4096)                = 0
open("/etc/hosts", O_RDONLY|O_CLOEXEC)  = 3
fcntl64(3, F_GETFD)                     = 0x1 (flags FD_CLOEXEC)
fstat64(3, {st_mode=S_IFREG|0644, st_size=221, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7844000
read(3, "127.0.0.1\tlocalhost\n127.0.1.1\tpi"..., 4096) = 221
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0xb7844000, 4096)                = 0
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=76757, ...}) = 0
mmap2(NULL, 76757, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7832000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/libnss_mdns4_minimal.so.2", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0\10\0\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=9580, ...}) = 0
mmap2(NULL, 12388, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xdad000
mmap2(0xdaf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1) = 0xdaf000
close(3)                                = 0
mprotect(0xdaf000, 4096, PROT_READ)     = 0
munmap(0xb7832000, 76757)               = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 3
fcntl64(3, F_GETFD)                     = 0
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
connect(3, {sa_family=AF_FILE, path="/var/run/avahi-daemon/socket"}, 110) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fstat64(3, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7844000
_llseek(3, 0, 0xbfdda7d8, SEEK_CUR)     = -1 ESPIPE (Illegal seek)
write(3, "RESOLVE-HOSTNAME-IPV4 yyyyy.xxx."..., 38) = 38
read(3, "-15 Timeout reached\n", 4096)  = 20
close(3)                                = 0
munmap(0xb7844000, 4096)                = 0
write(2, "ping: unknown host yyyyy.xxx.loc"..., 35ping: unknown host yyyyy.xxx.local
) = 35
exit_group(2)                           = ?

And there's no dns traffic. I'm sniffing with wireshark "udp and port 53" on the right interface (which does show traffic when using dig).

eantoranz · 03-06-2012, 04:10 PM

I'm checking the strace of the domain with local and a domain with com at the end.

The traces look very simillar until it reaches this part on the local trace:

Code:

socket(PF_FILE, SOCK_STREAM, 0)         = 3
fcntl64(3, F_GETFD)                     = 0
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
connect(3, {sa_family=AF_FILE, path="/var/run/avahi-daemon/socket"}, 110) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fstat64(3, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb787f000
_llseek(3, 0, 0xbf8f90f8, SEEK_CUR)     = -1 ESPIPE (Illegal seek)
write(3, "RESOLVE-HOSTNAME-IPV4 yyyyy.xxx."..., 38) = 38
read(3, "-15 Timeout reached\n", 4096)  = 20
close(3)                                = 0

But on the one with "com" instead of local I see this:

Code:

open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=76757, ...}) = 0
mmap2(NULL, 76757, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb77d1000
close(3)                                = 0

What do you think? Could it be something dealing with avahi?

eantoranz · 03-06-2012, 04:17 PM

Taken from /etc/avahi/hosts:

Code:

# Examples:
# 192.168.0.1 router.local
# 2001::81:1 test.local

Seems like I'll have to tweek avahi so that it doesn't resolve .local names or something like that. Let's see what I can do.

Thanks for your help. When I have the solution in place, I'll let you know.

eantoranz · 03-06-2012, 04:19 PM

Effectively shutting down avahi makes the dns request go through normally and now name resolution is working. J!

I'll dig (pun intended) for other possible hacks.

eantoranz · 03-06-2012, 04:28 PM

I should be able to thank myself, don't you think? :-)

Skaperen · 03-06-2012, 06:24 PM

Well, now I know to not run avahi. Oh wait ... it is running. But I guess it's only an issue with XXXX.local names. But thanks for revealing what it has been up to.