topic Re: Difference between nslookup command mode and interactive mode? in Operating System - HP-UX

Difference between nslookup command mode and interactive mode?

Victoria Leung — Thu, 13 Sep 2001 09:15:07 GMT

Hi,

I found that there is a difference in using nslookup command mode and interactive mode. Does anyone knows that it is a bug or it is normal? I'm using HP-UX 11.0 and BIND 8.1.2.

1. nslookup 10.1.2.3 10.1.8.9

From the sniffer, I found that the first message going to the DNS 10.1.8.9 is a query of 9.8.1.10.in-addr.arpa.

2. nslookup
>server 10.1.8.9
>10.1.2.3
.....

From the sniffer, the first message going to the DNS 10.1.8.9 is a query of 3.2.1.10.in-addr.arpa.

Why did the command mode of nslookup need to query the PTR of the DNS server first?

Thank you in advance!

Victoria

Re: Difference between nslookup command mode and interactive mode?

Bill Hassell — Thu, 13 Sep 2001 11:26:24 GMT

This is a security issue and a common point of failure for DNS servers. nslookup is validating that the DNS server's IP address has an assigned name. If the DNS server doesn't know it's own name, this is an error condition and DNS will be skipped by choosing the next item in /etc/nsswitch.conf (if present).

Re: Difference between nslookup command mode and interactive mode?

Kevin Wright — Thu, 13 Sep 2001 15:50:04 GMT

Bill, you are exactly right, as usual, nslookup does a reverse lookup of the server to ensure the server is valid. If not valid, it uses secondary means in nsswitch.conf. The question here is what really happens inside nslookup when you issue the server IP directive, does it do a gethostbyIP lookup? I am not sure, but I would guess so.

Re: Difference between nslookup command mode and interactive mode?

rick jones — Thu, 13 Sep 2001 19:14:10 GMT

it queried the PTR record because it feels compelled to tell you the name of the name server. presumeably, the code that does that is only in the initialization path when a server IP is on the command line, not in the path taken when you just say nslookup.

most folks seem to be suggesting using other tools to query DNS these days. either dig or perhaps nsquery.