17

If I have the following entries in a hosts file:

192.168.100.1 bugs 192.168.100.2 daffy.example.com 192.168.100.3 elmer.example.com.

Will IP->name resolution attempts by local utilies (I assume using 'gethostbyaddr' or the Windows equivalent) honour these entries? Is this behaviour configurable? How does it vary between operating systems? Does it matter whether the 'hosts' file entries are fully qualified or not?

EDIT: In response to Russell, my test Linux system is running RHEL 4. My /etc/nsswitch.conf contains the following 'hosts' line:

hosts: files dns nis

If I ping any of my hosts by name (e.g. bugs, daffy), the forward resolution works correctly. If I traceroute any of them by IP address, the reverse lookup functions as expected. However, if I ping them by IP, ping doesn't appear to resolve their host names. My understanding was that Linux ping would always attempt to resolve IPs to names unless instructed otherwise. Why would traceroute be able to handle reverse lookups in hosts files, but ping not?

Improve this question

3 Answers 3

Reset to default
17

Generally the hosts file will be used for both forward and reverse lookups. The preference on a Unix system this will depend on the order of entries in you nsswitch.conf file.

e.g. the line below will make the hosts file override DNS. Reversing the entries will make DNS override the hosts file.

 hosts: files dns

I am not sure if you can tune to order of preference on a windows system.

I have had a look at the source for ping in inetutils-20071127 (the version installed on my Ubuntu 9.04 box) and the source seems to enable numeric only mode if you ping an IP address rather than a hostname:

 if (inet_aton(target, &whereto.sin_addr) == 1) { hostname = target; if (argc == 1) options |= F_NUMERIC;

This could explain why you don't get a reverse lookup when you ping your host by IP address.

Improve this answer
3
  • That was my thought, but this doesn't seem to be the case. See updated question for details. Commented Jul 20, 2009 at 11:46
  • I haven't had a chance to look at the source yet; however a quick look at ldd output shows that on my system ping is linked directly to the libresolv DNS resolver library, which could imply that it is bypassing the nsswitch file and doing its reverse lookups directly... Commented Jul 20, 2009 at 12:15
  • When using the ISC host utility, one may get the impression that editing /etc/hosts has no effect. host 10.0.0.1 will do a DNS query and ignore the hosts file. This allows checking the system resolver: perl -MSocket -le '$a=inet_aton(shift); $_=gethostbyaddr $a, AF_INET; print' 10.0.0.1 Commented May 17, 2015 at 16:43
8

I found a reference to changing registry entries to alter the name resolution order on Windows:

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=963485

Quoting from there:

By default, Windows checks name resolution providers in the following order:

Local, (NetBT local name cache), Hosts, DNS, NetBT (WINS).

You want the order to be Hosts, DNS, Local, NetBT.

In what follows, lower numbers are higher priority.

The following registry keys in

HKEY_LOCAL_MACHINE\SYSTEM\CurentControlSet\ServicessTcpip\ServiceProvider

need to be modified.

DnsPriority= 0x3e8 (Decimal: 1000) HostsPriority= 0x1f4 (Decimal: 500) LocalPriority= 0x5dc (Decimal: 1500) NetbtPriority= 0x7d1 (Decimal: 2001)
Improve this answer
1
  • How do they get such "innerworkings" information from? Commented Jan 23, 2015 at 7:44
2

The /etc/host.conf file specifies which order is used for discovering IP addresses. Mine contains the following by default:

# # /etc/host.conf # order hosts,bind multi on

This means that the hosts file is always checked first and then DNS (bind).

If nis is not specified here then it will never look at /etc/nsswitch.conf.

Documentation link: http://tldp.org/LDP/nag/node82.html

Improve this answer
1
  • The /etc/host.conf method is outdated for some systems, only nsswitch.conf is used (like glibc and eglibc based systems). These versions of glibc will parse the '/etc/host.conf' without warning and discard the 'order' line. Commented Sep 18, 2012 at 15:32

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.