-2

I am trying to understand how /etc/resolv.conf /etc/nsswitch.conf exactly works and what is significance of nameserver entry 127.0.1.1

I did strace ping google.com to get to know about the system calls involved , one part is :

stat64("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=172, ...}) = 0
socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 4
connect(4, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.1.1")}, 16) = 0
gettimeofday({1413780874, 913366}, NULL) = 0
poll([{fd=4, events=POLLOUT}], 1, 0)    = 1 ([{fd=4, revents=POLLOUT}])
send(4, "\0040\1\0\0\1\0\0\0\0\0\0\6google\3com\0\0\1\0\1", 28, MSG_NOSIGNAL) = 28
poll([{fd=4, events=POLLIN}], 1, 5000)  = 1 ([{fd=4, revents=POLLIN}])
ioctl(4, FIONREAD, [204])               = 0
recvfrom(4, "\0040\201\200\0\1\0\v\0\0\0\0\6google\3com\0\0\1\0\1\300\f\0\1"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.1.1")}, [16]) = 204
close(4)                                = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
connect(4, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("173.194.123.36")}, 16) = 0
getsockname(4, {sa_family=AF_INET, sin_port=htons(58830), sin_addr=inet_addr("192.168.1.13")}, [16]) = 0
close(4)

can any one please explain what is going on here ? specially connect on 127.0.1.1 as it is namsserver entry in my resolv.conf Why we need to make socket connection to 127.0.1.1 ? and how do we get response from it ?

dmourati
  • 25,540
  • 2
  • 42
  • 72
Ameyj
  • 17
  • 5

3 Answers3

1

Presumably your resolv.conf includes nameserver 127.0.1.1.

When pinging google.com in your example this name first needs to be looked up so that ping knows an IP address which it can send the ICMP echo request packets to.

To find the IP address it consults the configured nameserver, hence why it communicates with 127.0.1.1 on 53/udp.

Håkan Lindqvist
  • 35,011
  • 5
  • 69
  • 94
  • alright, how nameserver is confiugured, and which process exactly responds to this request , if it is localhost then why it is not 127.0.0.1? I mean I am using fresh ubuntu installation so how 127.0.1.1 is set up as nameserver ? – Ameyj Oct 20 '14 at 06:12
  • @Ameyj `127/8` is reserved for loopback, `127.0.0.1` is just the first loopback address. You can investigate which process has bound to 127.0.1.1 53 using for instance `netstat -plnut` or `lsof`. As for why Ubuntu have set things up this way I think you will have to check their documentation. – Håkan Lindqvist Oct 20 '14 at 06:17
0

127.0.0.1 is still a IP so it makes a socket connection for UDP to 127.0.0.1.

Mike
  • 22,310
  • 7
  • 56
  • 79
0

First, the existance of /etc/resolv.conf is checked with stat(). Second, the socket for the resolving is prepared with socket(). Then this socket is initialized with connect() to the IP address of the resolver, udp protocol and port number 53. Then the request is sent with send() and the reply is read with recvfrom(). Then the socket is closed with close().

drookie
  • 8,625
  • 1
  • 19
  • 29