Adding DNS Resolver impacts Telnet connection

[Ed Hon]

I've have a N-Class, HP-UX 11, TCP/IP, not running DHCP nor DNS, using /etc/hosts for name resolution. It is on a Windows NT network of PC's with telnet emulators. Each PC has a hosts file, which includes an entry for the N-Class. The local network uses DHCP and is attached to the corporate network, which has a DNS server and a connection to the Internet.

When a PC user telnets to the N-Class, a login screen pops up in about 1 second. However, if I add the DNS Server's IP address to the N-Class as the only DNS Resolver, it takes 3 to 4 minutes for the PC user to get the telnet login screen. The Name Service Switch on the N-Class is /etc/hosts then DNS. If I remove the DNS server from the DNS Resolver list, so that nothing is there, the telnet connection time returns to normal. Performance is otherwise normal. Why do I get a negative impact from adding a DNS Resolver?

[John Bolene]

On your N, can you nslookup the PC names with DNS and without DNS?

Sounds like you are hitting the DNS timeouts for lookups.

If DNS is active, telnet will try to lookup the clients on the host and seems to be failing.

Could you post the contents of your resolv.conf and nsswitch.conf files?

[Vincenzo Restuccia]

You can see /etc/nsswitch.conf

[Ed Hon]

BTW, /etc/hosts does not have entries for the PC's, just print servers.

[Pedro Sousa]

This is strange.
Is your nsswitch.conf configured +/- like:
domain xxx.xxx.xxx
nameserver 111.111.11.11
?
If it is, are you sure the domain is the same, between the PCs and the N server?

Plus, you can allways add the following entries in the end of the file:
"retrans 500" (you can change this value. It's specified in miliseconds)
"retry 1" (number of retries)

also check the following:
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90685/B2355-90685_top.html&con=/hpux/onlinedocs/B2355-90685/00/00/27-con.html&toc=/hpux/onlinedocs/B2355-90685/00/00/27-toc.html&searchterms=retrans&queryid=20010406-064644
good luck.

[Ed Hon]

# more /etc/resolv.conf
nameserver 130.110.1.5

# more /etc/nsswitch.conf
hosts: files[NOTFOUND=continue UNAVAIL=return] dns [NOTFOUND=return UNAVAIL=continue TRYAGAIN=return]

[Ed Hon]

I did some nslookup's. ((My comments))

# nslookup
Using /etc/hosts on: hph70 ((HP in question))

> 10.64.117.101 ((IP of a PC on LAN))
Using /etc/hosts on: hph70

looking up FILES
Trying DNS
((LONG wait here))
*** Request to nms1.abb.com timed-out
> xyz ((meaningless garbage))
Using /etc/hosts on: hph70

looking up FILES
Trying DNS
((Short wait here))
*** nms1.abb.com can't find xyz: Non-existent domain
> hpsym ((An HP Server in /etc/hosts))
Using /etc/hosts on: hph70

looking up FILES
((Instant response))
Name: hpsym
Address: 10.64.116.2

[Kenneth Platz]

Ed,

In my experience, Windows NT DNS administrators are very resistant to adding PTR (ie, address-to-name) records into their DNS databases, believing that PC's don't need to know what name a given IP address is associated with.

However, HP-UX systems will always attempt to do a gethostbyaddr() lookup for any telnet connection that comes into the system. If (as you already discovered) this takes a long time to come back, then the time it takes you to get a telnet prompt back will be adversely impacted.

My first suggestion would be to ask your DNS administrator to see if it is possible to add the PTR records for the various PC's in the network into their DNS database. Beyond that, you may be able to tweak your nsswitch.conf file somewhat to reduce the timeout period. If you have a recent libc patch on your system (PHCO_20441 or later), you can use the "retry" and "retrans" options in your /etc/resolv.conf file to lower this timeout period.

I would recommend simply adding the line:

retry 1

To your /etc/resolv.conf file, and see if this lessens the problem.

I hope this helps.

[Kevin Wright]

I agree with Kenneth, your reverse DNS is not configured correctly. Telnet performs a reverse DNS lookup on the IP of the client. This is timing out in your case because it is not configured.

[Pedro Sousa]

Sorry, but I think that the only thing you need to do is to add your domain line to /etc/resolv.conf:
domain
nameserver 130.110.1.5

try it.

[Pedro Sousa]

Another thing, change your nsswitch.conf to:
"hosts: files[NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] dns"

[Ed Hon]

You're not going to believe it, but the problem seems to have gone away without my making any of the proposed changes (retry, retrans, domain). I can only surmise there was a routing problem somewhere, which eventually cleared itself up.

[John Bolene]

Normally these things in DNS just don't do away.
I would suspect that someone either looked at the DNS logs and noticed that reverse lookups were being asked for or that the refresh interval in the DNS records finally became effective and a new Serial number file was pushed.
I set up my DNS so that it refreshes the db.xx files every 3 hours, but then I only have about 6000 entries to worry about.