slack 10.2 thinks all subnet ip's are localhost

zux · 02-10-2008, 04:20 PM

it's that sh*ty nameserver!!!!
i tried putting 195.2.96.2 in my local resolv.conf and it also said that 192.168.0.1 is localhost!!!
same thing with 192.168.0.2 or any other 192.168.0.* IP
how can this happen? other nameservers replay host not found like they should.
changed the nameserver to a working one.
could it be that it's the nameserver of the ISP?

Nathanael · 02-10-2008, 04:22 PM

sure it can - but i am doubting that this will solve your issue

as i said before, reverse lookups are only done on request, pining an ip, is not such a request!

zux · 02-10-2008, 04:30 PM

well I don't know DNS that well but I do know if I specify a host in /etc/hosts then i see ip replaced with that hostname everywhere.

and after disabling that nameserver I do see:

Code:

Feb 11 00:26:33 server sshd[24436]: Accepted password for root from 192.168.0.1 port 1028 ssh2

in /var/log/messages

no more:

Code:

Feb 11 00:00:13 server sshd[24383]: Accepted password for root from 192.168.0.1 port 1027 ssh2
Feb 11 00:00:13 server sshd[24386]: Address 192.168.0.1 maps to localhost, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!

so it must be doing reverse lookups.
but why would it?

mRgOBLIN · 02-10-2008, 06:53 PM

yes that DNS server is very broken.

Sounds like the problem is solved.. you should probably use 194.106.96.41 as it seems to be returning the correct results.

Quote:

so it must be doing reverse lookups.
but why would it?

Many applications do a reverse lookup by default unless told otherwise (usually with a -n switch).

That's why I originally asked you to do a `route -n' so we could see the IP instead of the hostname.

Yes we know ping is one that doesn't do reverse lookups but I don't even know why ping was brought into the discussion.