20

Changes to /etc/hosts file seem to take effect immediately. I'm curious about the implementation. What magic is used to achieve this feature?

  1. Ask Ubuntu: After modifying /etc/hosts which service needs to be restarted?
  2. NetApp Support: How the /etc/hosts file works
Improve this question
2
  • 5
    Just a note on speed the hosts file is typically tiny, rarely above a few KB. It's most likely smaller than the compiled library used to read the file. A small regularly used file will often stay cached in memory. So even if the file were read for every request the overhead for doing so would be minimal (ie: very fast).
    – Philip Couling
    Jun 25, 2019 at 12:00
  • 2
    Relating unix.stackexchange.com/questions/388875/… to Philip's comment :)
    – Jeff Schaller ♦
    Jun 25, 2019 at 17:07

2 Answers 2

Reset to default
29

The magic is opening the /etc/hosts file and reading it:

strace -e trace=file wget -O /dev/null http://www.google.com http://www.facebook.com http://unix.stackexchange.com 2>&1 | grep hosts
open("/etc/hosts", O_RDONLY|O_CLOEXEC)  = 4
open("/etc/hosts", O_RDONLY|O_CLOEXEC)  = 5
open("/etc/hosts", O_RDONLY|O_CLOEXEC)  = 4

The getaddrinfo(3) function, which is the only standard name resolving interface, will just open and read /etc/hosts each time it is called to resolve a hostname.

More sophisticated applications which are not using the standard getaddrinfo(3), but are still somehow adding /etc/hosts to the mix (e.g. the dnsmasq DNS server) may be using inotify(7) to monitor changes to the /etc/hosts files and re-read it only if needed.

Browsers and other such applications will not do that. They will open and read /etc/hosts each time they need to resolve a host name, even if they're not using libc's resolver directly, but are replicating its workings by other means.

Improve this answer
3
  • 1
    Could you elaborate more on what the snippet do please? What I'm interested in is how the changes is immediately reflect in running code (should be network part in OS right?).
    – rudwna
    Jun 25, 2019 at 9:59
  • 7
    @rudwna: He means: "Every time a hostname needs to be looked up, the resolver (part of the C library) is opening /etc/hosts and reads it. So if the file contents change between reads, the next read will use the new contents".
    – dirkt
    Jun 25, 2019 at 11:59
  • 3
    @rudwna also, regarding "running code", the reason you see changes immediately is that many standard programs do not cache addresses (or they have some intelligent caching strategy that listens for updates to /etc/hosts). There are certainly programs out there that will NOT immediately see changes to /etc/hosts and need to be restarted. It's entirely up to whoever wrote the code. There is nothing magical about /etc/hosts itself.
    – SamYonnou
    Jun 25, 2019 at 20:13
9

Name resolution, amongst other things, is managed by /etc/nsswitch.conf. Here is an excerpt:

passwd:     files sss
shadow:     files sss
group:      files sss
hosts:      files dns myhostname
(...)

Note the hosts line. It says: "When resolving a hostname, first read /etc/hosts file to lookup the hostname, if not found then run a DNS query, if not found then try the locally configured system hostname".

So here's why it is so fast. Note that it does not depend on the network services on the machine, so there's no service to restart or reload.

Improve this answer
2
  • 1
    But it could use a cached (say, parsed and in main memory) version of file /etc/hosts. Why isn't it using a cached version?
    – Peter Mortensen
    Jun 25, 2019 at 22:54
  • 2
    @PeterMortensen because the OS already caches file access, and even handles writes correctly.
    – Michael Borgwardt
    Jun 26, 2019 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.