| View previous topic :: View next topic |
| Author |
Message |
ansel
n00b
Joined: 24 Oct 2005
Posts: 8
|
 Posted: Thu Apr 20, 2006 7:56 pm Post subject: Disable reverse dns lookup (for generic Linux)? [SOLVED] |
 |
|
Hi,
I built a embedded Linux box (non-gentoo) which provides some network services (for example, ftpd, sshd, httpd, etc.) for the local network. I noticed that there's some delay (about 30 seconds) when clients connect to the box, and I believe this is caused by reverse dns lookup (the clients often do not have a valid dns environment, and my Linux box's resource is limited to run its own dns server).
I know for some servers (f.g, sshd), you can disable reverse dns lookup by modifying configuration, but for some others you can't.
I also think about adding all LAN IPs in /etc/hosts, but for a class A LAN, the file will be huge.
I can also change /etc/nsswitch.conf to remove dns entry from "hosts" line, but this also disables the normal dns lookup.
So my question is: is there any way that I can disable reverse dns lookup for the whole system?
TIA!
Last edited by ansel on Sun Apr 23, 2006 12:52 am; edited 1 time in total |
|
| Back to top |
|
 |
sschlueter
Guru
Joined: 26 Jul 2002
Posts: 578
Location: Dortmund, Germany
|
| Posted: Thu Apr 20, 2006 10:04 pm Post subject: Re: Disable reverse dns lookup (for generic Linux)? |
|
|
| ansel wrote: | | I built a embedded Linux box (non-gentoo) which provides some network services (for example, ftpd, sshd, httpd, etc.) for the local network. I noticed that there's some delay (about 30 seconds) when clients connect to the box, and I believe this is caused by reverse dns lookup (the clients often do not have a valid dns environment, and my Linux box's resource is limited to run its own dns server). |
Have you verified this (e.g. via packet sniffing)?
Given that this is the problem, I would recommend using dnsmasq. It can be configured to immediately return reverse queries for private IPs. The option is called "bogus-priv".
| Code: | # tethereal -p -i lo -n -t d
Capturing on lo
1 0.000000 192.168.1.1 -> 192.168.1.1 DNS Standard query PTR 10.10.10.10.in-addr.arpa
2 0.003249 192.168.1.1 -> 192.168.1.1 DNS Standard query response, No such name
|
|
|
| Back to top |
|
|
ansel
n00b
Joined: 24 Oct 2005
Posts: 8
|
| Posted: Sat Apr 22, 2006 8:37 pm Post subject: Re: Disable reverse dns lookup (for generic Linux)? |
|
|
| sschlueter wrote: | | ansel wrote: | | I built a embedded Linux box (non-gentoo) which provides some network services (for example, ftpd, sshd, httpd, etc.) for the local network. I noticed that there's some delay (about 30 seconds) when clients connect to the box, and I believe this is caused by reverse dns lookup (the clients often do not have a valid dns environment, and my Linux box's resource is limited to run its own dns server). |
Have you verified this (e.g. via packet sniffing)?
Given that this is the problem, I would recommend using dnsmasq. It can be configured to immediately return reverse queries for private IPs. The option is called "bogus-priv".
| Code: | # tethereal -p -i lo -n -t d
Capturing on lo
1 0.000000 192.168.1.1 -> 192.168.1.1 DNS Standard query PTR 10.10.10.10.in-addr.arpa
2 0.003249 192.168.1.1 -> 192.168.1.1 DNS Standard query response, No such name
|
|
Thx for the input.
I did verify with the following tests:
1. setting up valid DNS servers eliminates the delay;
2. removing "dns" in /etc/nsswitch.conf also eliminates the delay.
3. giving bogus DNS servers in /etc/resolv.conf (such as 1.1.1.1) re-produces the delay.
I will check your suggestion on dnsmasq. |
|
| Back to top |
|
|
ansel
n00b
Joined: 24 Oct 2005
Posts: 8
|
| Posted: Sat Apr 22, 2006 9:40 pm Post subject: Re: Disable reverse dns lookup (for generic Linux)? |
|
|
| sschlueter wrote: |
Given that this is the problem, I would recommend using dnsmasq. It can be configured to immediately return reverse queries for private IPs. The option is called "bogus-priv".
|
many many thanks to sschlueter 
I tried dnsmasq, it actually works very well.
I changed /etc/resolv.conf to
-------------------------
nameserver 127.0.0.1
-------------------------
and keep the real dns servers in /etc/myresolv.conf
-------------------------
nameserver 68.94.156.1
nameserver 68.94.157.1
-------------------------
(also make sure dhcp client updates /etc/myresolv.conf when it got dns servers from dhcpd!)
now start my own dns server with
dnsmasq -b -r /etc/myresolv.conf
now from the box dnsmasq can resolve any domain names, also dnsmasq quickly fake a result for reverse dns lookup for a local IP!
thanks again, it's really a good solution for my embedded device. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
