Why nslookup doesn’t use mdns while ping do

dnsmasqdomain-name-systemnetworkingpingresolv.conf

In dnsmasq.conf:

address=/local/127.0.0.1

In resolv.conf:

# Generated by NetworkManager
domain example.com
search example.com
nameserver 127.0.0.1
nameserver 10.66.127.17
nameserver 10.68.5.26

I can use nslookup:

# nslookup www.local
Server:     127.0.0.1
Address:    127.0.0.1#53

Name:   www.local
Address: 127.0.0.1

But I can't use ping:

# ping www.local
ping: unknown host www.local

I use tcpdump to capture lo while pinging www.local, no packets, while packets like

# tcpdump -i em1 -n | grep local

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 65535 bytes
20:14:38.189335 IP 10.66.65.188.mdns > 224.0.0.251.mdns: 0 A (QM)? www.local. (27)
20:14:39.190700 IP 10.66.65.188.mdns > 224.0.0.251.mdns: 0 A (QM)? www.local. (27)
20:14:41.192979 IP 10.66.65.188.mdns > 224.0.0.251.mdns: 0 A (QM)? www.local. (27)

appeared from physical interface.

Which means ping is using mdns, but why nslookup doesn't use mdns?
Why ping won't use normal dns when mdns doesn't return useful falue?

Thanks.

Best Answer

ping use glibc's name resolution system, called Name Service Switch. This uses the /etc/nsswitch.conf file to know where to look for in order to resolve a name to an IP. The hosts: line in this file represents an order of preference for each service. For exemple, files represent the local /etc/hosts file, dns uses the /etc/resolv.conf file to contact a DNS server, and mdns uses mdns.

However, nslookup doesn't use it. It talks directly to the DNS server specified in /etc/resolv.conf and so can't use mdns.

But I can't answer your last question. If you have both mdns and dns in /etc/nsswitch.conf, even with mdns first, it should firstly try to resolve the name with mdns, then if no answer use dns.

Related Topic