ftp and traceroute ignoring /etc/hosts file

[Paul Condren]

Ok, this one is really hurting my head!

We have a service defined in DNS called BOB on IP address 10.1.1.1 and also one called BOB on IP address 101.2.2.3 defines in /etc/hosts

In the server /etc/hosts we put the service we want to access - 101.2.2.3 BOB and when we do a ping it goes to the correct IP address, as does a telnet.

However ftp and traceroute both try to connect to the one in DNS ignoring the local hosts file! This is causing a lot of problems for me!

The nsswitch.conf states hosts then dns and an lslookup for bob finds the one we want from local hosts however traceroute bob goes to the address from dns.

Ive applied patch PHNE_34698 but this has had no affect.

Incidentaly this only seems to be a problem at HPUX 11.23 as out 11.11 servers do not have this problem with the same configuration.

Is there something overriding our nsswitch.conf for ftp?


Thanks.

Now we could disable dns to resolve this but we dont want to as several other IP addresses and servioces are in DNS only.

[Steve Lewis]

No its probably that traceroute now requires a -i interface or -s source-ip to use as the starting point.
On your 11.11 box if the first interface it found happened to be the one it wanted then it would work. On your 11.23 box its probably the other way round.
man traceroute

[Alan Casey]

Perhaps the problem is due to having multiple ip addresses for a single hostname.

The hostname may already be in the arp table (arp -a) and not need to be resolved.

If this is the case nslookup may update the arp table to the "correct" values according to the resolv.conf file, at least temporarily

[Paul Condren]

The main issue for me is that hosts should always be used befreo looking in DNS and indeed this is the case for a ping or telnet.

Why would ftp be ignoring the hosts entry in favour of a dns entry?

On our 11.11 server it does not happen. Is there an aditional file we need to configure?

[Alan Casey]

I dont think there is anything else to configure.

I think the problem may be that you effectively have a duplicate hostname in use.

Can you try and run
nslookup BOB
Immediately before you ftp?

[spex]

Hi Paul,

You could try manually deleting the entry from the ARP table before you FTP.

# arp -d BOB
# ftp BOB

PCS

[Marco A.]

Hi Paul,

Check your ..

nsswitch.conf file, under /etc

look at the line that says hosts!.. it looks as follows

hosts: files [NOTFOUND=continue] dns

Then, when you make a query, the system will be looking up FILES, and if it fails, Trying DNS.

Check for DNS at. :
/etc/resolv.conf

Check the hosts file for the name bob and the ip address, also try to include the fully qualified name right there.:
/etc/hosts

Also, check if you have something at your

/etc/hosts.allow

and ...

/etc/hosts.deny

Let us know your results,

Marc0

[Rasheed Tamton]

If the arp stuff does not solve the issue, can you do a tusc or trace on ftp process

tusc ftp BOB

Ftp should read nsswitch.conf (any perm issue there)

What is the services entry (if there is one)in /etc/nsswitch.conf Does it point to dns first

Regards,
Rasheed Tamton.

[Paul Condren]

OK - Sussed it. The entry was not in the arp list so no action required there.

It seems that 11.23 has an extra item on the list in sam for the nsswitch.conf file which although not specified in the file is still in play (in sam go network & communications -> Name Service Switch). Its called ipnodes which specifies DNS first then /etc/hosts

Its wird as this item does not exist in the sam espot on 11.11, and also because I dont see this line in my /etc/nsswitch.conf.

However if I edit this in sam to be /etc/hosts fisrts then DNS and apply a line is then written to the end of the nsswitch.conf and now mt ftp to BOB works as hosts files in now used rather than it getting the entry from DNS.

Hoorah!

As stated previously this would only be an issue if you have two services with the same name which is as rare for us an anyone.

[rick jones]

First, ARP is soley and exclusively about mapping IP addresses to MAC addresses. It has _nothing_ to do with mapping hostnames to IP addresses.

Second, wrt files vs ipnodes, IIRC ipnodes is the one consulted by applications making calls to getaddrinfo(). Getaddrinfo() is the "IPv6 ready" replacement for gethostbyname(). There is also getnameinfo() which is the replacement for gethostbyaddr().

That ping and telnet did what you expected and ftp and traceroute did not could simply be that ping and telnet were still using the gethostbyname() calls and ftp and traceroute were using getaddinfo().

I am not sure what clues one would look for to see in say a tusc trace which was calling which since those are library rather than system calls. There may be some ldd/nm/odump/whatever magic one can do to see which symbols the main binary seeks.

Frankly, if ftp is calling getaddrinfo() on 11.23, telnet and ping aught to be too - that suggests either a call to the RC is inorder, or you might be missing a patch :)

[Paul Condren]

It seems that 11.23 has an extra item on the list in sam for the nsswitch.conf file which although not specified in the file is still in play (in sam go network & communications -> Name Service Switch). Its called ipnodes which specifies DNS first then /etc/hosts

Its wird as this item does not exist in the sam espot on 11.11, and also because I dont see this line in my /etc/nsswitch.conf.

However if I edit this in sam to be /etc/hosts fisrts then DNS and apply a line is then written to the end of the nsswitch.conf and now mt ftp to BOB works as hosts files in now used rather than it getting the entry from DNS.

[rick jones]

11.11 (aka 11iv1) Didn't have "out of the box" IPv6 support, just "enablement" which is probably why things like 11.11 SAM didn't do anything with ipnodes. ISTR there are some 11.11 patches related to some of that, especially if you install the TOUR wich gives IPv6 support.

Of course, with 11i v3 (11.31) now shipping and 11.23 (11iv2) out there, everyone is upgrading right?-)