delayed nslookup response

[Yildiz_1]

Hi all,
actually it is not only nslookup which takes too much time, rlogin, telnet and ftp takes too much time, too. I have attached the complete tusc output where I can see 3 "sleeping", but no idea why. Why does it get "ERR#227 EADDRNOTAVAIL" ? Here is a summary :

12:12:32 [28853] execve("/usr/bin/nslookup", 0x7f7e035c, 0x7f7e0368) [entry]
env[0] @ 0x7f7e003b: "_=/usr/local/bin/tusc"
....
12:12:33 [28855] socket(AF_INET, SOCK_DGRAM, 0) .................. = 5
12:12:33 [28855] connect(5, 0x7f7b61d8, 16) ...................... = 0
12:12:33 [28855] send(5, 0x7f7e0f68, 42, 0) ...................... = 42
\00201\0\001\0\0\0\0\0\0022 0 025 0 021 0 021 0 \ai n - a d d r
04a r p a \0\0\f\001
12:12:33 [28855] select(6, 0x7f7e14d0, NULL, NULL, 0x7f7e14c8) ... = 1
12:12:33 [28855] recv(5, "\0028580\001\001\001\001022 0 02".., 1024, 0) = 104
12:12:33 [28855] close(5) ........................................ = 0
12:12:33 [28855] socket(AF_INET, SOCK_DGRAM, 0) .................. = 5
12:12:33 [28855] connect(5, 0x7f7b61d8, 16) ...................... = 0
12:12:33 [28855] send(5, 0x7f7e1528, 21, 0) ...................... = 21
\00301\0\001\0\0\0\0\0\003a c s \0\001\001
12:12:35 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... [sleeping]
12:12:38 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... = 0
12:12:38 [28855] connect(5, 0x7f7e1a78, 16) ...................... ERR#227 EADDRNOTAVAIL
12:12:38 [28855] sendto(5, 0x7f7e1528, 21, 0, NULL, NULL) ........ = 21
\00301\0\001\0\0\0\0\0\003a c s \0\001\001
12:12:38 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... = 1
12:12:38 [28855] recv(5, "\0038182\001\0\0\0\0\0\003a c s ".., 1024, 0) = 21
12:12:38 [28855] sendto(5, 0x7f7e1528, 21, 0, NULL, NULL) ........ = 21
\00301\0\001\0\0\0\0\0\003a c s \0\001\001
12:12:40 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... [sleeping]
12:12:43 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... = 0
12:12:43 [28855] sendto(5, 0x7f7e1528, 21, 0, NULL, NULL) ........ = 21
\00301\0\001\0\0\0\0\0\003a c s \0\001\001
12:12:45 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... [sleeping]
12:12:53 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... = 0
12:12:53 [28855] sendto(5, 0x7f7e1528, 21, 0, NULL, NULL) ........ = 21
\00301\0\001\0\0\0\0\0\003a c s \0\001\001
12:12:55 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... [sleeping]
12:13:00 [28855] select(6, 0x7f7e1a90, NULL, NULL, 0x7f7e1a88) ... = 1
12:13:00 [28855] recv(5, "\0038182\001\0\0\0\0\0\003a c s ".., 1024, 0) = 21
12:13:00 [28855] close(5) ........................................ = 0
12:13:00 [28855] ioctl(1, TCGETA, 0x7f7e0a28) .................... ERR#25 ENOTTY
12:13:00 [28855] write(1, 0x7f7c9000, 4) ......................... = 4
a c s \n
12:13:00 [28853] read(5, "a c s \n", 8192) ....................... = 4
.....
12:13:00 [28853] write(1, 0x7f7ce000, 15) ........................ = 15
1 0 . 1 0 . 5 0 . 2 9 \n\n
12:13:00 [28853] exit(0) ......................................... WIFEXITED(0)


Either there is something wrong with my DNS setting or the DNS server is not preperly configured, any idea?

[Muthukumar_5]

DNS setting is used by /etc/resolv.conf configuration.

EADDRNOTAVAIL 227 /* Can't assign requested address */

Hope you have to change /etc/nsswitch.conf hosts: entry for better lookup.

Can you post the general information as executing as,

# nslookup hostname-which-usedin-tusc

--
Muthu

[Yildiz_1]

hp1100(235) /etc >nslookup hp1100
Name Server: acs
Address: 10.10.50.20

Trying DNS
Name: hp1100.s.sligos.de
Address: 10.10.50.35

hp1100(261) /etc >cat /etc/nsswitch.conf
hosts: dns [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=return] nis [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] f
iles [NOTFOUND=return UNAVAIL=continue TRYAGAIN=return]
hp1100(262) /etc >
hp1100(262) /etc >cat /etc/resolv.conf
domain s.sligos.de
nameserver 10.10.50.20
nameserver 161.90.180.26
search s.sligos.de sgt.de.int.xxxxxxxxxxx.com


Again the lookup took 28 seconds!

[Bill Hassell · Accepted solution]

According to your nsswitch.conf file, you are looking at DNS first. But sinced there is a delay of about 25 seconds, this is the default timeout for a dead DNS server. Therefore, the first DNS server listed in /etc/resolv.conf is dead, unreachable or refuses to talk to your system. Test all the DNS servers listed in /etc/resolv.conf using nslookup:

nslookup some_host 12.34.56.78
nslookup some_host 12.34.56.89
nslookup some_host 12.34.56.90

(where 12.34.56.## are DNS servers) A maximum of 3 DNS servers are allowed in the /etc/resolv.conf file. Remove the failing DNS server(s) and you'll be back to normal. NOTE: for reliability, always have nsswitch.conf list files, then dns, not dns, nis then files. That way, a failed DNS server will not disable your system (include critical hosts/IP addresses in /etc/hosts)

[Geoff Wild]

You can also decresae the delay by adding the following to resolv.conf

retrans 1000
retry 2


Rgds...Geoff

[Yildiz_1]

hp1100(293) /etc >nslookup hp1100 10.10.50.20
Name Server: acs
Address: 10.10.50.20

Trying DNS
Name: hp1100.s.sligos.de
Address: 10.10.50.35

(takes 1 second)

hp1100(294) /etc >nslookup hp1100
Name Server: acs
Address: 10.10.50.20

Trying DNS
Name: hp1100.s.sligos.de
Address: 10.10.50.35

(takes 25 seconds)


I know have only
nameserver 10.10.50.20
in my resolv.conf and "10.10.50.20" is actually not dead!

[Bill Hassell]

The DNS server that takes 25 seconds is dead as far as DNS is concerned. The server may respond to ping, it may work OK, but it is not responding to DNS requests from your machine. nslookup has two parameters for a targeted lookup: hostname and DNS server. If you do not specify a DNS server for nslookup, the hostname is located following the rules in nsswitch.conf, and in your case, this is the list of servers in resolv.conf. All hostname lookups (nslookup or library call) will be delayed if the first entry in resolv.conf refuses to talk to your machine.

[Yildiz_1]

Hi,
actually the only NS is 10.10.50.20 in my resolv.conf, by the way I think I solved the problem :
I have bind 8.2 running on Linux and each time I run "nslookup hp1100" on my HP box I got 3 lines of errors on my bind server :
15-Feb-2006 11:42:20.745 default: warning: sysquery: no addrs found for root NS ()
15-Feb-2006 11:42:25.861 default: warning: sysquery: no addrs found for root NS ()
15-Feb-2006 11:42:46.307 default: warning: sysquery: no addrs found for root NS ()

Then I have removed the following lines from my named.conf and restarted named :
//zone "." {
// type hint;
// file "xxxx.root";
//};

I now have no delay with "nslookup hp1100".
So it was a linux box making trouble not HP! :)
Thanks for all your help!