1

I am trying to understand the differences in the behavior of nslookup and ping when resolving hostnames to IP addresses. My confusion is summarized by this snippet from my terminal:

lllamnyp@lllamnyp:~/.ssh$ cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 192.168.221.131
nameserver 127.0.0.53

lllamnyp@lllamnyp:~/.ssh$ nslookup ingress-vpn.do.company.com
;; Got recursion not available from 192.168.221.131, trying next server
Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find ingress-vpn.do.company.com: NXDOMAIN

lllamnyp@lllamnyp:~/.ssh$ nslookup ingress-vpn.do.company.com 192.168.221.131
Server:     192.168.221.131
Address:    192.168.221.131#53

Name:   ingress-vpn.do.company.com
Address: 192.168.234.130

lllamnyp@lllamnyp:~/.ssh$ ping ingress-vpn.do.company.com
PING ingress-vpn.do.company.com (192.168.234.130) 56(84) bytes of data.
^C
--- ingress-vpn.do.company.com ping statistics ---

On request, here's the output for dig as well. It works:

lllamnyp@lllamnyp:~/.ssh$ dig ingress-vpn.do.company.com

; <<>> DiG 9.11.3-1ubuntu1.14-Ubuntu <<>> ingress-vpn.do.company.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55351
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: fcfdf62ef4bf6a33 (echoed)
;; QUESTION SECTION:
;ingress-vpn.do.company.com.        IN  A

;; ANSWER SECTION:
ingress-vpn.do.company.com. 30  IN  A   192.168.234.130

;; Query time: 161 msec
;; SERVER: 192.168.221.131#53(192.168.221.131)
;; WHEN: Wed Mar 10 12:10:14 MSK 2021
;; MSG SIZE  rcvd: 97

I have observed with strace that ping reads /etc/nsswitch.conf, while nslookup does not, but I'm not well-versed on their internals.

Here are my questions:

  • If the problem is a non-recursive server, why does nslookup <HOSTNAME> fail, but nslookup <HOSTNAME> <DNS_SERVER_IP> does not?
  • If the problem is a non-recursive server, how does ping successfully resolve the IP, when nslookup cannot?
  • What has recursion got to do with this anyway, when 192.168.221.131 is IP address of the authoritative nameserver for do.company.com?
  • Fundamentally, what's the difference between name resolution done by ping and by nslookup?

I am running Ubuntu 18.04 and the nameserver at 192.168.221.131 is CoreDNS 1.6.


Extra details:

Incredibly, while doing nslookup in one tab of the terminal and observing tcpdump in another, I see this:

Nslookup:

$ nslookup ingress-vpn.do.company.com
;; Got recursion not available from 192.168.221.131, trying next server
Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find ingress-vpn.do.company.com: NXDOMAIN

Tcpdump:

$ sudo tcpdump udp port 53 -i tun0 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
12:24:12.419836 IP 10.1.1.2.57886 > 192.168.221.131.53: 12557+ A? ingress-vpn.do.company.com. (38)
12:24:12.432512 IP 192.168.221.131.53 > 10.1.1.2.57886: 12557*- 1/0/0 A 192.168.234.130 (74)

i.e nslookup receives the correct responses, but at that point has already given up.

7
  • Welcome, 192.168.221.131 is an ip not a nameserver. Mar 10 at 9:03
  • @schrodigerscatcuriosity thanks, I have clarified, that 192.168.221.131 is the IP address of a nameserver. Let me know if I can improve the question in any other way.
    – LLlAMnYP
    Mar 10 at 9:06
  • How does dig behave in this case?
    – muru
    Mar 10 at 9:08
  • @muru dig works fine, added the output.
    – LLlAMnYP
    Mar 10 at 9:14
  • 1
    Short answer: Don't use nslookup. See jdebp.uk/FGA/nslookup-flaws.html. Mar 10 at 9:20
5

Fundamentally, what's the difference between name resolution done by ping and by nslookup?

ping can employ various different ways of getting an IP address, (all listed in /etc/nsswitch.conf), while nslookup only asks the designated nameserver.

1
  • 2
    Yes, and nslookup never consults /etc/hosts
    – Chota
    Mar 11 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.