Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got an odd DNS issue. I'm running a dual ipv4/ipv6 environment on Gentoo Linux.

Pinging some sites results in ping pinging 127.0.0.1. e.g.

#> ping authserver.mojang.com
PING authserver.mojang.com (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost.localdomain (127.0.0.1): icmp_seq=1 ttl=64 time=0.045 ms
64 bytes from localhost.localdomain (127.0.0.1): icmp_seq=2 ttl=64 time=0.043 ms
64 bytes from localhost.localdomain (127.0.0.1): icmp_seq=3 ttl=64 time=0.058 ms
--- authserver.mojang.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 0.043/0.048/0.058/0.010 ms

Dig, however correctly returns the following:

# dig authserver.mojang.com

; <<>> DiG 9.9.3-P2 <<>> authserver.mojang.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15800
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;authserver.mojang.com.         IN      A

;; ANSWER SECTION:
authserver.mojang.com.  5       IN      A       54.235.119.47

;; Query time: 14 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Sat Nov 09 15:34:40 GMT 2013
;; MSG SIZE  rcvd: 66

I'm confused! My web browser returns the correct website, and the same computer booted into Windows also works correctly.

I've not altered /etc/hosts (I've altered my actual computer name to post here): 127.0.0.1 localhost.localdomain localhost

# IPv4 and IPv6 localhost aliases
127.0.0.1       my.computer.com my localhost
::1             my.computer.com my localhost

My resolv.conf:

# Generated by dhcpcd from eth0
options inet6
# Google
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844
nameserver 8.8.8.8
nameserver 8.8.4.4

domain my.domain.com

EDIT: My /etc/nsswitch.conf (untouched):

# /etc/nsswitch.conf:
# $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/nsswitch.conf,v 1.1 2006/09/29     23:52:23 vapier Exp $

passwd:      compat
shadow:      compat
group:       compat

# passwd:    db files nis
# shadow:    db files nis
# group:     db files nis

hosts:       files dns
networks:    files dns

services:    db files
protocols:   db files
rpc:         db files
ethers:      db files
netmasks:    files
netgroup:    files
bootparams:  files

automount:   files
aliases:     files

As suggested, I ran strace on ping: strace log

It's not connecting to ncsd:

connect(4, {sa_family=AF_FILE, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)

Then it tries to connect to Google's DNS:

connect(4, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8888", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
poll([{fd=4, events=POLLOUT}], 1, 0)    = 1 ([{fd=4, revents=POLLOUT}])
sendto(4, "\16\273\1\0\0\1\0\0\0\0\0\0\nauthserver\6mojang\3c"..., 39, MSG_NOSIGNAL, NULL, 0) = 39
poll([{fd=4, events=POLLIN}], 1, 5000)  = 1 ([{fd=4, revents=POLLIN}])
ioctl(4, FIONREAD, [55])                = 0
recvfrom(4, "\16\273\201\200\0\1\0\1\0\0\0\0\nauthserver\6mojang\3c"..., 1024, 0, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8888", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 55
close(4)                                = 0

Still not working!

As suggested, using -e read the last dns lookup is the following:

socket(PF_INET6, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 4
connect(4, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8888", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
poll([{fd=4, events=POLLOUT}], 1, 0)    = 1 ([{fd=4, revents=POLLOUT}])
sendto(4, "M\354\1\0\0\1\0\0\0\0\0\0\nauthserver\6mojang\3c"..., 39, MSG_NOSIGNAL, NULL, 0) = 39
poll([{fd=4, events=POLLIN}], 1, 5000)  = 1 ([{fd=4, revents=POLLIN}])
ioctl(4, FIONREAD, [55])                = 0
recvfrom(4, "M\354\201\200\0\1\0\1\0\0\0\0\nauthserver\6mojang\3c"..., 1024, 0, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8888", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 55
 | 00000  4d ec 81 80 00 01 00 01  00 00 00 00 0a 61 75 74  M....... .....aut^? |
 | 00010  68 73 65 72 76 65 72 06  6d 6f 6a 61 6e 67 03 63  hserver. mojang.c^? |
 | 00020  6f 6d 00 00 01 00 01 c0  0c 00 01 00 01 00 00 00  om...... ........^? |
 | 00030  05 00 04 17 15 2d ec                              .....-.          ^? |
close(4)                                = 0

I'm afraid I don't know enough about DNS protocol to decode it. Full trace here: Full strace

share|improve this question
1  
what about /etc/hosts? Dig directly queries nameservers, while you may have some overrides in /etc/hosts or are querying something else. –  Jure1873 Nov 9 '13 at 15:49
    
Did you play with /etc/hosts? What's in your /etc/resolv.conf? Did you use a private DNS? –  F. Hauri Nov 9 '13 at 15:49
    
Added files as requested. I haven't changed /hosts, and I use Google's public DNS. –  AlexW Nov 9 '13 at 16:11
    
What does your /etc/nsswitch.conf look like? –  Fred the Magic Wonder Dog Nov 9 '13 at 16:28
    
Try switching the order in nsswitch.conf from files dns to dns files. Also if you are running nscd have it flush the cache. –  Fred the Magic Wonder Dog Nov 9 '13 at 17:30
show 2 more comments

1 Answer 1

The symptoms you describe (dig gives correct answer, gethostbyname does not ) means that somewhere in the system there is a cached incorrect answer.

Running

strace ping authserver.mojang.com

should help give you some idea of where that data might be cached. nscd is usually the culprit in this case. Look for connect calls, this is to a dns server.

connect(4, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("134.79.110.9")}, 28) = 0

This one is to the nscd socket.

connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"...}, 110) = 0

You'll see send message with the dns name you're attempting to contact and one will respond with the localhost ip address. This is an example of a successful dns lookup.

sendto(4, "@\330\1\0\0\1\0\0\0\0\0\0\3www\4slac\10stanford\3e"..., 39, MSG_NOSIGNAL, NULL, 0) = 39

recvfrom(4, "@\330\205\200\0\1\0\2\0\4\0\7\3www\4slac\10stanford\3e"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("134.79.110.9")}, [16]) = 309
share|improve this answer
    
Thank you for the idea. Results have been added to the question. It does appear that a correct query is being performed. –  AlexW Nov 10 '13 at 14:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.