Host lookup takes exceptionally long time
 

Hi there,

I'm having a problem with my Internet access. Whenever I request a page on any web browser, it takes at least six seconds to look up the host name. Even if I am traveling between pages on the same server. I do not get this problem when I am in Windows. I am currently using Mandrake 9.2.

Here is my hosts file:

127.0.0.1 localhost
127.0.0.1 CPE002078...

CPE002078... is the string of characters in my bash prompt after my user name (e.g. vicente@CPE002078...). If I leave this line out, GNOME gives me an error message every time I log on.

Here is my resolv.conf:
search bloor.phub.net.cable.rogers.com
nameserver 24.153.22.195
nameserver 24.153.23.66

My internet connection is set up in Mandrake as a LAN. Is this a problem? Because I am really using a cable modem.

What do you think is the problem?

What's your /etc/nsswitch.conf file look like?

Also, because you really won't be looking for anything under "bloor.phub.net.cable.rogers.com" you can take that out.

> grep host /etc/nsswitch.conf
#hosts: db files nisplus nis dns
hosts: files dns

And you can always try swapping the two nameservers.

Here is my nsswitch.conf file:

passwd: files nisplus nis
shadow: files nisplus nis
group: files nisplus nis
hosts: files nisplus nis dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: nisplus
publickey: nisplus
automount: files nisplus
aliases: files nisplus

What do you suggest?

So I don't need the bloor.phub.net.cable.rogers.com? Rogers Cable is my cable company though.

What search does in your resolve.conf is this.

Say I want to telnet to pariah under the technoslave.net domain. If I don't have search technoslave.net in there, then I need to type telnet pariah.technoslave.net, if I have search technoslave.net in my resolv.conf file, then all I'd need to type is telnet pariah

I doubt you'll be trying to get in to any hosts on your network via some type of domain name system.

Second, in your nsswitch.conf file, you can get rid of nisplus and nis ( for everything ), and then I'd swap files with dns, so that your hosts line looks like -

hosts: dns files

If you're still experiencing problems, then you can switch the IP addresses for your nameservers...it's possible that those nameservers are under load, so might be slow in responding.

I agree with everything Technoslave wrote, except for the part of putting dns before files. That would prevent you from overriding certain hosts by putting an entry in /etc/hosts. Personally I very much like the ability to "lie" to my machine if I want to and override certain thing (like resolving sitefinder.verisign.net to 127.0.0.1, etc). It won't cause any perceivable delay because it just has to take a quick peek in a tiny file. With nis and nisplus, you have to wait for an nis query to file which will definitely take time (for each).

Thanks. What do nis and nisplus do and when would I ever need those options there?

Chort, I too have files before dns, however, I don't think that this individual will be doing this...if he does, then great, but I really don't think it's going to be the case.

NIS was/is a Sun thing ( I believe ) a sort of login manager ( a little more than that...but if you want the real skinny, man -k nis, then go to town ), that used unencrypted passwords. NIS+ is the same thing, but with encrypted passwords. I don't use it, nor have I ever in the 10+ years I've been doing UNIX admin work...but I'm sure someone, somewhere does.

Ok, I took out the nis and nisplus entries but I've still got the same slow speed.

Any ideas?

Hold on a second, I missed this the first time (I thought it said "except if I am..."). This wouldn't be a DNS resolution problem, then. It doesn't have to resolve DNS again each time you make a GET request to the same host. You have some other problem. Have you looked at the output of ifconfig eth0 to see if you have errors or collisions?

Here's my output from the ifconfig command:

eth0 Link encap:Ethernet HWaddr 00:20:78:05:D9:7A
inet addr:65.63.89.53 Bcast:65.63.89.127 Mask:255.255.255.128
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:221 errors:0 dropped:0 overruns:0 frame:0
TX packets:138 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:87042 (85.0 Kb) TX bytes:20858 (20.3 Kb)
Interrupt:3 Base address:0xd800

lo
.
.
.

What should I do?

Edit: Actually, most of the time pages on the same host load quickly but occasionally it takes as long as pages on other hosts. So it might not have to do with collisions.

Well then, try timing DNS requests.

You can do
$ time host www.google.com
(although that's likely to be cached and retrieved very fast)

$ time host thinkofsomeobscuredomainhere.tld
etc...

The point of this would be to determine if it really is the DNS resolution portion that is taking a long time. Of course, network latency could still have something to do with it. After you resolve the host, try pinging it and see what the latency is.

The last thing you can try is downloading pages with wget and time that as well. This would narrow it to potentially a problem with the browser you're using.

Hmm, I guess DNS is not the problem:

[root@CPE00207805d97a-CM000a7369e75e root]# time host google.com
google.com has address 216.239.57.99
google.com has address 216.239.37.99
0.03user 0.00system 0:01.21elapsed 2%CPU (0avgtext+0avgdata 0maxresident)k
0inputs+0outputs (330major+223minor)pagefaults 0swaps
[root@CPE00207805d97a-CM000a7369e75e root]# time host linuxquestions.org
linuxquestions.org has address 64.179.4.146
0.03user 0.00system 0:01.10elapsed 2%CPU (0avgtext+0avgdata 0maxresident)k
0inputs+0outputs (330major+223minor)pagefaults 0swaps
[root@CPE00207805d97a-CM000a7369e75e root]# time host thestar.com
thestar.com has address 192.206.150.204
0.03user 0.01system 0:01.06elapsed 3%CPU (0avgtext+0avgdata 0maxresident)k
0inputs+0outputs (329major+222minor)pagefaults 0swaps
[root@CPE00207805d97a-CM000a7369e75e root]# time host www.cia.gov
www.cia.gov is an alias for www.odci.gov.
www.odci.gov has address 198.81.129.100
0.04user 0.01system 0:01.05elapsed 4%CPU (0avgtext+0avgdata 0maxresident)k
0inputs+0outputs (330major+223minor)pagefaults 0swaps
[root@CPE00207805d97a-CM000a7369e75e root]# time host www.distrowatch.com
www.distrowatch.com is an alias for distrowatch.com.
distrowatch.com has address 66.111.55.60
0.04user 0.01system 0:01.05elapsed 4%CPU (0avgtext+0avgdata 0maxresident)k
0inputs+0outputs (330major+223minor)pagefaults 0swaps

But then why does it take 6 seconds to "resolve" every host? This does not happen in Windows.

Anyone?

So DNS is not my problem. Then why does it take so long the resolve the host? This is getting really annoying.

DNS IS host resolution. It must be either your browser or OS configuration.

By the way, I've never seen time output in that format before, but if it's in the format minutes:seconds.miliseconds, then you have problems. That would indicating that it's taking over a second just to resolve the hostname. That is slooooow. I'm not sure if I'm interpreting the output correctly, though. Check your man page for a description of the output fields.