I am trying to understand the differences in the behavior of
ping when resolving hostnames to IP addresses. My confusion is summarized by this snippet from my terminal:
lllamnyp@lllamnyp:~/.ssh$ cat /etc/resolv.conf # Generated by NetworkManager nameserver 192.168.221.131 nameserver 127.0.0.53
lllamnyp@lllamnyp:~/.ssh$ nslookup ingress-vpn.do.company.com ;; Got recursion not available from 192.168.221.131, trying next server Server: 127.0.0.53 Address: 127.0.0.53#53 ** server can't find ingress-vpn.do.company.com: NXDOMAIN
lllamnyp@lllamnyp:~/.ssh$ nslookup ingress-vpn.do.company.com 192.168.221.131 Server: 192.168.221.131 Address: 192.168.221.131#53 Name: ingress-vpn.do.company.com Address: 192.168.234.130
lllamnyp@lllamnyp:~/.ssh$ ping ingress-vpn.do.company.com PING ingress-vpn.do.company.com (192.168.234.130) 56(84) bytes of data. ^C --- ingress-vpn.do.company.com ping statistics ---
On request, here's the output for
dig as well. It works:
lllamnyp@lllamnyp:~/.ssh$ dig ingress-vpn.do.company.com ; <<>> DiG 9.11.3-1ubuntu1.14-Ubuntu <<>> ingress-vpn.do.company.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55351 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: fcfdf62ef4bf6a33 (echoed) ;; QUESTION SECTION: ;ingress-vpn.do.company.com. IN A ;; ANSWER SECTION: ingress-vpn.do.company.com. 30 IN A 192.168.234.130 ;; Query time: 161 msec ;; SERVER: 192.168.221.131#53(192.168.221.131) ;; WHEN: Wed Mar 10 12:10:14 MSK 2021 ;; MSG SIZE rcvd: 97
I have observed with
strace that ping reads
nslookup does not, but I'm not well-versed on their internals.
Here are my questions:
- If the problem is a non-recursive server, why does
nslookup <HOSTNAME>fail, but
nslookup <HOSTNAME> <DNS_SERVER_IP>does not?
- If the problem is a non-recursive server, how does
pingsuccessfully resolve the IP, when
- What has recursion got to do with this anyway, when 192.168.221.131 is IP address of the authoritative nameserver for
- Fundamentally, what's the difference between name resolution done by
I am running Ubuntu 18.04 and the nameserver at 192.168.221.131 is CoreDNS 1.6.
Incredibly, while doing nslookup in one tab of the terminal and observing tcpdump in another, I see this:
$ nslookup ingress-vpn.do.company.com ;; Got recursion not available from 192.168.221.131, trying next server Server: 127.0.0.53 Address: 127.0.0.53#53 ** server can't find ingress-vpn.do.company.com: NXDOMAIN
$ sudo tcpdump udp port 53 -i tun0 -n tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes 12:24:12.419836 IP 10.1.1.2.57886 > 192.168.221.131.53: 12557+ A? ingress-vpn.do.company.com. (38) 12:24:12.432512 IP 192.168.221.131.53 > 10.1.1.2.57886: 12557*- 1/0/0 A 192.168.234.130 (74)
nslookup receives the correct responses, but at that point has already given up.