Difference between nslookup command mode and interactive mode?

[Victoria Leung]

Hi,

I found that there is a difference in using nslookup command mode and interactive mode. Does anyone knows that it is a bug or it is normal? I'm using HP-UX 11.0 and BIND 8.1.2.

1. nslookup 10.1.2.3 10.1.8.9

From the sniffer, I found that the first message going to the DNS 10.1.8.9 is a query of 9.8.1.10.in-addr.arpa.

2. nslookup
>server 10.1.8.9
>10.1.2.3
.....

From the sniffer, the first message going to the DNS 10.1.8.9 is a query of 3.2.1.10.in-addr.arpa.

Why did the command mode of nslookup need to query the PTR of the DNS server first?

Thank you in advance!

Victoria

[Bill Hassell · Accepted solution]

This is a security issue and a common point of failure for DNS servers. nslookup is validating that the DNS server's IP address has an assigned name. If the DNS server doesn't know it's own name, this is an error condition and DNS will be skipped by choosing the next item in /etc/nsswitch.conf (if present).

[Kevin Wright]

Bill, you are exactly right, as usual, nslookup does a reverse lookup of the server to ensure the server is valid. If not valid, it uses secondary means in nsswitch.conf. The question here is what really happens inside nslookup when you issue the server IP directive, does it do a gethostbyIP lookup? I am not sure, but I would guess so.

[rick jones]

it queried the PTR record because it feels compelled to tell you the name of the name server. presumeably, the code that does that is only in the initialization path when a server IP is on the command line, not in the path taken when you just say nslookup.

most folks seem to be suggesting using other tools to query DNS these days. either dig or perhaps nsquery.