slow netstat

[Stefan Sisolak]

"netstat -a" is not using DNS for reverse lookup. And for all IP addr. which is not in /etc/hosts file there is very long time out. I don't want to use "netstat -an". How can I force the netstat to use DNS? Or how can I decrease the time-outs?

> uname -mrs
OSF1 V5.1 alpha

/etc/resolv.conf - contains the correct domain and also the correct DNS servers. nslookup is working fine.

/etc/nsswitch.conf:
aliases: files dns
auth_default: files
auth_devassign: files
auth_files: files
auth_prpasswd: files
auth_ttys: files
group: compat
group_compat: nis
hosts: files dns
netgroup: nis
networks: files
passwd: compat
passwd_compat: nis
protocols: files
rpc: files
services: files


> ps -e | grep netst
921398 pts/0 S + 0:00.00 grep netst
912451 pts/1 S + 0:00.01 netstat -a
> lsof -p 912451
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
netstat 912451 root cwd VDIR 0,0 / (cluster_root#root)
netstat 912451 root rtd VDIR 0,0 / (cluster_root#root)
netstat 912451 root txt VREG 0,0 /usr -- sbin/netstat
netstat 912451 root txt *056 unknown type
netstat 912451 root 0u VCHR 0,0 0t1637 4856 /dev/console
netstat 912451 root 2u VCHR 0,0 0t1637 4856 /dev/console
netstat 912451 root 4u VCHR 0,0 0t1637 4856 /dev/console
netstat 912451 root 6r VCHR 0,0 0xfffffc0022988ee0 4856 /dev/console
netstat 912451 root 8r VREG 0,0 / -- etc/protocols
netstat 912451 root 10r VREG 0,0 / -- etc/hosts
netstat 912451 root 12r VREG 0,0 / -- etc/ipnodes
netstat 912451 root 14r VREG 0,0 / -- etc/hosts
netstat 912451 root 16r VREG 0,0 / -- etc/ipnodes
netstat 912451 root 18r VREG 0,0 / -- etc/hosts
netstat 912451 root 20r VREG 0,0 / -- etc/ipnodes
>

[Ivan Ferreira]

>>> How can I force the netstat to use DNS?


First, check /etc/svc.conf. How do do ensure that netstat is not using DNS? Can you do a reverse lookup of the non resolved address with nslookup? The timeout you have is the response time from the DNS server trying to resolve the reverse query.

[Stefan Sisolak]

The timeout for each IP which is not in /etc/hosts file is around 5 min.

>>> Can you do a reverse lookup of the non resolved address with nslookup?

Yes.


>>> How do do ensure that netstat is not using DNS?

I added entry for one of IP addr. on which the netstat hung into /etc/hosts file, and next time I started the netstat this IP was resoled immediately.



/etc/svc.conf:
aliases=local,bind
auth=local
group=local,yp
hosts=local,bind
netgroup=yp
networks=local
passwd=local,yp
protocols=local
rpc=local
services=local
SECLEVEL=BSD # for backwards compatibility ONLY

Output from svcsetup:
Enter your selection [M]: p

aliases: files dns
auth_default: files
auth_devassign: files
auth_files: files
auth_prpasswd: files
auth_ttys: files
group: compat
group_compat: nis
hosts: files dns
netgroup: nis
networks: files
passwd: compat
passwd_compat: nis
protocols: files
rpc: files
services: files

[Rob Leadbeater]

Hi,

> The timeout for each IP which is not in /etc/hosts file is around 5 min.

That sounds excessive. A DNS timeout is usually in the order of 30 seconds...

I would probably sanity check with nslookup that the reverse lookups are really working as expected. Put nslookup in debug mode to check.

You might also want to test the name and reverse lookups from another machine (non Tru64 ?) to see if you get the same problems there...

Hope this helps,

Regards,

Rob