2

I've got an odd DNS issue. I'm running a dual ipv4/ipv6 environment on Gentoo Linux.

Pinging some sites results in ping pinging 127.0.0.1. e.g.

#> ping authserver.mojang.com
PING authserver.mojang.com (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost.localdomain (127.0.0.1): icmp_seq=1 ttl=64 time=0.045 ms
64 bytes from localhost.localdomain (127.0.0.1): icmp_seq=2 ttl=64 time=0.043 ms
64 bytes from localhost.localdomain (127.0.0.1): icmp_seq=3 ttl=64 time=0.058 ms
--- authserver.mojang.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 0.043/0.048/0.058/0.010 ms

Dig, however correctly returns the following:

# dig authserver.mojang.com

; <<>> DiG 9.9.3-P2 <<>> authserver.mojang.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15800
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;authserver.mojang.com.         IN      A

;; ANSWER SECTION:
authserver.mojang.com.  5       IN      A       54.235.119.47

;; Query time: 14 msec
;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888)
;; WHEN: Sat Nov 09 15:34:40 GMT 2013
;; MSG SIZE  rcvd: 66

I'm confused! My web browser returns the correct website, and the same computer booted into Windows also works correctly.

I've not altered /etc/hosts (I've altered my actual computer name to post here): 127.0.0.1 localhost.localdomain localhost

# IPv4 and IPv6 localhost aliases
127.0.0.1       my.computer.com my localhost
::1             my.computer.com my localhost

My resolv.conf:

# Generated by dhcpcd from eth0
options inet6
# Google
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844
nameserver 8.8.8.8
nameserver 8.8.4.4

domain my.domain.com

EDIT: My /etc/nsswitch.conf (untouched):

# /etc/nsswitch.conf:
# $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/nsswitch.conf,v 1.1 2006/09/29     23:52:23 vapier Exp $

passwd:      compat
shadow:      compat
group:       compat

# passwd:    db files nis
# shadow:    db files nis
# group:     db files nis

hosts:       files dns
networks:    files dns

services:    db files
protocols:   db files
rpc:         db files
ethers:      db files
netmasks:    files
netgroup:    files
bootparams:  files

automount:   files
aliases:     files

As suggested, I ran strace on ping: strace log

It's not connecting to ncsd:

connect(4, {sa_family=AF_FILE, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)

Then it tries to connect to Google's DNS:

connect(4, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8888", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
poll([{fd=4, events=POLLOUT}], 1, 0)    = 1 ([{fd=4, revents=POLLOUT}])
sendto(4, "\16\273\1\0\0\1\0\0\0\0\0\0\nauthserver\6mojang\3c"..., 39, MSG_NOSIGNAL, NULL, 0) = 39
poll([{fd=4, events=POLLIN}], 1, 5000)  = 1 ([{fd=4, revents=POLLIN}])
ioctl(4, FIONREAD, [55])                = 0
recvfrom(4, "\16\273\201\200\0\1\0\1\0\0\0\0\nauthserver\6mojang\3c"..., 1024, 0, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8888", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 55
close(4)                                = 0

Still not working!

As suggested, using -e read the last dns lookup is the following:

socket(PF_INET6, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 4
connect(4, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8888", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
poll([{fd=4, events=POLLOUT}], 1, 0)    = 1 ([{fd=4, revents=POLLOUT}])
sendto(4, "M\354\1\0\0\1\0\0\0\0\0\0\nauthserver\6mojang\3c"..., 39, MSG_NOSIGNAL, NULL, 0) = 39
poll([{fd=4, events=POLLIN}], 1, 5000)  = 1 ([{fd=4, revents=POLLIN}])
ioctl(4, FIONREAD, [55])                = 0
recvfrom(4, "M\354\201\200\0\1\0\1\0\0\0\0\nauthserver\6mojang\3c"..., 1024, 0, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "2001:4860:4860::8888", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 55
 | 00000  4d ec 81 80 00 01 00 01  00 00 00 00 0a 61 75 74  M....... .....aut^? |
 | 00010  68 73 65 72 76 65 72 06  6d 6f 6a 61 6e 67 03 63  hserver. mojang.c^? |
 | 00020  6f 6d 00 00 01 00 01 c0  0c 00 01 00 01 00 00 00  om...... ........^? |
 | 00030  05 00 04 17 15 2d ec                              .....-.          ^? |
close(4)                                = 0

I'm afraid I don't know enough about DNS protocol to decode it. Full trace here: Full strace

7
  • 1
    what about /etc/hosts? Dig directly queries nameservers, while you may have some overrides in /etc/hosts or are querying something else.
    – Jure1873
    Nov 9, 2013 at 15:49
  • Did you play with /etc/hosts? What's in your /etc/resolv.conf? Did you use a private DNS? Nov 9, 2013 at 15:49
  • Added files as requested. I haven't changed /hosts, and I use Google's public DNS.
    – AlexW
    Nov 9, 2013 at 16:11
  • What does your /etc/nsswitch.conf look like? Nov 9, 2013 at 16:28
  • 1
    wow, I'm stumped. All I can suggest at this point is using this option. ` -e read=set Perform a full hexadecimal and ASCII dump of all the data read from file descriptors listed in the specified set. For example, to see all input activity on file descriptors 3 and 5 use -e read=3,5. Note that this is independent from the normal tracing of the read(2) system call which is controlled by the option -e trace=read.` Nov 10, 2013 at 17:46

1 Answer 1

3

The symptoms you describe (dig gives correct answer, gethostbyname does not ) means that somewhere in the system there is a cached incorrect answer.

Running

strace ping authserver.mojang.com

should help give you some idea of where that data might be cached. nscd is usually the culprit in this case. Look for connect calls, this is to a dns server.

connect(4, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("134.79.110.9")}, 28) = 0

This one is to the nscd socket.

connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"...}, 110) = 0

You'll see send message with the dns name you're attempting to contact and one will respond with the localhost ip address. This is an example of a successful dns lookup.

sendto(4, "@\330\1\0\0\1\0\0\0\0\0\0\3www\4slac\10stanford\3e"..., 39, MSG_NOSIGNAL, NULL, 0) = 39

recvfrom(4, "@\330\205\200\0\1\0\2\0\4\0\7\3www\4slac\10stanford\3e"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("134.79.110.9")}, [16]) = 309
1
  • Thank you for the idea. Results have been added to the question. It does appear that a correct query is being performed.
    – AlexW
    Nov 10, 2013 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .