I'm curious about how /etc/hosts entries match works in Linux vs others *nix platform (if there is any difference).

In particular I would be interested to understand if "match time" is proportional with the amount of entries or not.

After the first match is found, does the "matching" stop? Or it uses all entries even if a match is already found?

Thank you very much


Under Linux, /etc/hosts is parsed until match to resolve entries. This is also how it was handled in the 1983 release of 4.3 BSD which was the first general release of the modern Unix IP stack.

It is important to remember that at the time of 4.3 BSD, the entire list of Internet connected hosts was kept at a centralized Network Information Center and numbered only about 325. A connected host would retrieve the list of every host on the internet from the NIC, and a linear search through a few hundred lines was good enough. It was about this time that the IETF realized that wasn't going to scale well so proposed the Domain Name System. Thereafter, if you had more than a few hundred lines in /etc/hosts, you were "doing it wrong".

Note too that /etc/hosts is processed by libc, a user-space library. The kernel has no idea that anything exists except a sockaddr. So this answer applies only to the handling of /etc/hosts and specifically ignores overarching name resolver systems which vary widely in their caching behaviors and time complexities.

|improve this answer|||||
  • 1
    +1 for going to the source (literally) and the history lesson. Would upvote this twice if I could. – a CVn Jul 6 '13 at 20:17

How does /etc/hosts match work?

It's depend on /etc/nsswitch.conf and /etc/host.conf to decide whether to read information in /etc/hosts

As @msw said processed by libc, a user-space library, it's read nsswitch.conf and read Tag "hosts: files dns" , then file means read /etc/hosts and dns means /etc/resolve.conf

Now suppose you hit the http://www.google.com in firefox,

  1. then firefox first going to resolve google.com with help of local resolver ( libresolve.so ), then
  2. it's first check the priority of file and dns ,
  3. in default case it will search in file means "/etc/hosts",
  4. in case if google.com is not match then it will refer "/etc/resolv.conf", in this file it's check the nameserver tag if it's not configure then resolver send dns Query to localhost on port 53,
  5. if nameserver define suppose nameserver, then it will send query to eg. dig google.com @ of course now we can get ans of the query from pubic dns.

EDIT 1 Also users can maintain it's own hosts file using "HOSTALIASES" variable, so it will first check this file, before reading /etc/hosts.


echo "fb  www.fb.com" >> ~/my_hosts
echo "export HOSTALIASES=~/my_hosts" >> ~/.bashrc
source ~/.bashrc 
|improve this answer|||||

The 2 functions you need are gethostbyname() and gethostbyaddr(), described in http://linux.die.net/man/3/gethostbyname If you still have nslookup available, try using it on e.g. nslookup www.google.com. You see that one name may lead to different ip addresses. The other way is also normal, the same ip address may point to different hostnames. To verify this, just add ip addresses and hostnames to your /etc/hosts and check it with the mentioned functions.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.