2

I have a system with a static IP address of 192.168.1.150. I configured /etc/network/interfaces manually (i.e. without using NetworkManager.) It is a web server hosting three sites. I am having several issues, the root of all of them being DNS resolution (I think). For some reason I cannot understand, the server thinks its IP address resolves to 192.168.1.251.

I've read about dnsmasq possibly causing this issue: I have searched running processes and don't see it running. I shut DHCP off (I thought) and I don't see it under running processes either. I have diligently researched each individual issue, and they all seem to point to a server misconfiguration of some sort--but I am stumped as to what to change. I would appreciate any help you can provide to fix the problem, or short of that, help me learn more so I can troubleshoot it more effectively. I am maddened by the tedium of having to track down an annoying and debilitating problem with a system that was functioning very well just two days ago.

I cannot be sure, but since I changed nothing, but downloaded several security updates from Ubuntu, I am of course suspicious that one of the things I downloaded upset things.

/etc/network/interfaces:

auto lo eth0
iface lo inet loopback

iface eth0 inet static
    address 192.168.1.150
    netmask 255.255.255.0
    broadcast 192.168.1.255
    network 192.168.1.0
    gateway 192.168.1.1
    dns-nameservers 8.8.8.8 68.87.69.150

/etc/resolv.conf:

    # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
    #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
    nameserver 8.8.8.8
    nameserver 68.87.69.150

/etc/hosts:

    127.0.0.1   localhost.localdomain localhost             
    127.0.1.1   nimue
    192.168.1.150   babaluis.com
    192.168.1.150   coyote.homeip.net
    192.168.1.150   hamiltonpdx.com 

    # The following lines are desirable for IPv6 capable hosts
    ::1     localhost ip6-localhost ip6-loopback
    fe00::0 ip6-localnet
    ff00::0 ip6-mcastprefix
    ff02::1 ip6-allnodes
    ff02::2 ip6-allrouters
    ff02::3 ip6-allhosts

/etc/nsswitch.conf:

    # /etc/nsswitch.conf
    #
    # Example configuration of GNU Name Service Switch functionality.
    # If you have the `glibc-doc-reference' and `info' packages installed,         try:
    # `info libc "Name Service Switch"' for information about this file.

    passwd:         compat
    group:          compat
    shadow:         compat

    hosts:          dns files mdns4_minimal [NOTFOUND=return] mdns4
    networks:       files

    protocols:      db files
    services:       db files
    ethers:         db files
    rpc:            db files

    netgroup:       nis

route -n:

    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use         Iface
    0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0         eth0
    169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0         eth0
    192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0         eth0

nmap -sV nimue:

    Starting Nmap 5.21 ( http://nmap.org ) at 2012-12-05 22:39 PST
    Nmap scan report for nimue (192.168.1.251)
    Host is up (0.00075s latency).
    Not shown: 998 closed ports
    PORT   STATE SERVICE VERSION
    53/tcp open  domain  dnsmasq 2.41
    80/tcp open  http    lighttpd 1.4.18
    MAC Address: E0:46:9A:24:F2:D4 (Unknown)

    Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 19.20 seconds

If there is other information you need in order to help, please ask.

UPDATE Output of dig +trace nimue:

; <<>> DiG 9.8.1-P1 <<>> +trace nimue
;; global options: +cmd
.           21088   IN  NS  a.root-servers.net.
.           21088   IN  NS  b.root-servers.net.
.           21088   IN  NS  c.root-servers.net.
.           21088   IN  NS  d.root-servers.net.
.           21088   IN  NS  e.root-servers.net.
.           21088   IN  NS  f.root-servers.net.
.           21088   IN  NS  g.root-servers.net.
.           21088   IN  NS  h.root-servers.net.
.           21088   IN  NS  i.root-servers.net.
.           21088   IN  NS  j.root-servers.net.
.           21088   IN  NS  k.root-servers.net.
.           21088   IN  NS  l.root-servers.net.
.           21088   IN  NS  m.root-servers.net.
;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 29 ms

;; Received 23 bytes from 192.168.1.251#53(192.168.1.251) in 62 ms

The output of netstat -tlpen is:

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0 0.0.0.0:10000           0.0.0.0:*               LISTEN      0          13295       2823/perl       
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      0          14864       2721/apache2    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          569634      8196/sshd       
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      0          9609        957/cupsd       
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      0          12833       2656/master     
tcp        0      0 0.0.0.0:538             0.0.0.0:*               LISTEN      0          12696       2540/gdomap     
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      0          11088       1018/dovecot    
tcp        0      0 0.0.0.0:9571            0.0.0.0:*               LISTEN      0          12710       2558/inetd      
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN      0          11078       1018/dovecot    
tcp        0      0 127.0.0.1:10024         0.0.0.0:*               LISTEN      123        9127        1216/amavisd (maste
tcp        0      0 127.0.0.1:10025         0.0.0.0:*               LISTEN      0          14818       2656/master     
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      116        11120       1051/mysqld     
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN      0          11076       1018/dovecot    
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      0          11086       1018/dovecot    
tcp        0      0 127.0.0.1:783           0.0.0.0:*               LISTEN      0          10252       1241/spamd.pid  
tcp6       0      0 :::22                   :::*                    LISTEN      0          569636      8196/sshd       
tcp6       0      0 ::1:631                 :::*                    LISTEN      0          9608        957/cupsd       
tcp6       0      0 :::25                   :::*                    LISTEN      0          12834       2656/master     
tcp6       0      0 :::993                  :::*                    LISTEN      0          11089       1018/dovecot    
tcp6       0      0 :::995                  :::*                    LISTEN      0          11079       1018/dovecot    
tcp6       0      0 :::110                  :::*                    LISTEN      0          11077       1018/dovecot    
tcp6       0      0 :::143                  :::*                    LISTEN      0          11087       1018/dovecot

NetworkManager is running (from ps -aux):

root       944  0.0  0.0 163016  5760 ?        Ssl  Dec05   0:00 NetworkManager
root       957  0.0  0.0 104104  3596 ?        Ss   Dec05   0:00 /usr/sbin/cupsd -F
root       972  0.0  0.0  19984   936 tty4     Ss+  Dec05   0:00 /sbin/getty -8 38400 tty4

I do not think nscd is running; I don't see it in ps -aux anywhere. There is no socket for /var/run/nscd/socket.

There is not a LOCALDOMAIN env var.

The output of env -i /usr/bin/getent hosts nimue is:

192.168.1.251   nimue

I moved DNS to the beginning of the list in /etc/nsswitch.conf based on reading a post somewhere that said it should precede the other options. It had no effect on the problem.

ANOTHER UPDATE I shut down Network Manager so that it no longer runs when the system is booted. I also removed the DHCP server. Nonetheless, nmap continues to report that the server's IP address is 192.168.1.251.

|improve this question
  • 2
    Hi! Welcome to SE. Can you please add the output of dig +trace nimue. Is network-manager still running? And apparently dnsmasq is running (nmap output). Use netstat -tlpen to get the PID of the process listening on TCP Port 53. – Bananguin Dec 6 '12 at 7:23
  • Is nscd running? Is there a /var/run/nscd/socket socket? Is there a LOCALDOMAIN env var? What does env -i /usr/bin/getent hosts nimue return? – Stéphane Chazelas Dec 6 '12 at 8:25
  • Why do you have "dns" before "files" in nsswitch.conf – Stéphane Chazelas Dec 6 '12 at 8:36
  • Here is the output of dig +trace: – nanci Dec 6 '12 at 15:22
  • Output of dig +trace nimue: – nanci Dec 6 '12 at 15:45
2

I changed /etc/nsswitch.conf so that "files" is listed first in the list of services for "hosts", and I also (as I said in the comments section) completely disabled Network Manager and uninstalled DHCP. These actions had no effect on the problem. Nor did rebooting.

What did solve the problem was to power down the Linksys router and the cable modem, so that they would reset. I did not expect this to have any effect, but I thought I had ruled out any possible software configuration issues (unless I was crazy misunderstanding what should be ruling IP address assignment), so what was left? I was pleasantly surprised when it did fix the problem. The DNS errors that I was seeing are cured.

My thanks to those of you who helped. I learned a lot about how to use netstat especially for troubleshooting.

|improve this answer
  • Perhaps it was a caching issue? – user28454 Dec 7 '12 at 18:18
  • 1
    I'm with user28454. This smells exactly like nsswitch.conf resolving via DNS first, and a utility like nscd running which was caching the old value after you had changed it. Also if you were using dig to verify, dig does not observe nsswitch.conf (and thus /etc/hosts), it always uses DNS. – Patrick Jul 20 '13 at 18:15

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.