On 2014-01-01 16:57, jdd wrote:

Le 01/01/2014 14:35, Carlos E. R. a écrit :

...

Dnsmasq is now installed by default, just use it.

In "/etc/dnsmasq.conf" tell dnsmasq to ask the router or isp or whatever.

server=192.168.1.1

seems to be not even necessary

It is. because...

as a result yast wrote in resolv.conf *two* IP as dns, 127.0.0.1, but also my routers one (192.68.0.254, the one returned by dhcp). See below the systemctl status.

you are really using the 192.68.0.254 server. You have to tell your system to _only_ use the dnsmasq service, and you also have to tell your dnsmasq service to make queries up to the router, and not query the entire internet on its own, which can be slower (there may be exceptions). In theory, asking your ISP server should be faster, as Anton pointed out. And this is what the router typically does. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-03 01:35, Felix Miata wrote:

On 2014-01-01 14:35 (GMT+0100) Carlos E. R. composed:

...

You can set a DNS local server, working as cache. It is now even easier than it was.

...

Dnsmasq is now installed by default, just use it.

My 24/7 box is still on 11.4. Dnsmasq was not installed.

Ah, right. You can use plain bind, which by default acts as DNS cache. It is just a bit trickier to setup. Or wait till you upgrade that 11.4 to 13.1, which I'm also about to do (both are Evergreen versions).

...

In "/etc/dnsmasq.conf" tell dnsmasq to ask the router or isp or whatever.

...

server=192.168.1.1

Seems simple enough, until I look at the default /etc/dnsmasq.conf file, where I see only this example that seems like the closest equivalent to your suggestion:

#server=/localnet/192.168.0.1

What are the "/" and "localnet" about? Searching through the man page, search string localnet was not found. There is no separate man page for dnsmasq.conf. Maybe localnet would have been better expressed as <localnet> or <domain>?

Forget all that. You only need to add the new line I suggested.

If I wanted to use two Google servers instead of router IP, bypassing resolv.conf, would I put both IPs on one line, or two, and if on one, separated how?

Two lines: server=X.y.z.v server=X.y.z.w It is a very simple syntax. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-03 03:06, Felix Miata wrote:

On 2014-01-03 01:51 (GMT+0100) Carlos E. R. composed:

...

Two lines:

...

server=X.y.z.v server=X.y.z.w

...

It is a very simple syntax.

Made unclear by example integral to dnsmasq.conf. :-p

True...

I now have dnsmasq running, with 127.0.0.1 the only nameserver line in resolv.conf. For now, I have one server= and one server= in dnsmasq.conf, which I can tweak when the mood strikes.

Good.

Now I have a mental block how to redirect adservers to the bit bucket. Is hosts still being used with dnsmasq running?

Yes. And dnsmasq reads it and serves the contents via dns queries, too, no conflict.

My router is now no more than gateway and firewall, right?

Right.

Do ad server domains need to be added to dnsmasq.conf to be most efficient?

I have no experience there, I don't block them. Yet. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 1/2/2014 4:56 PM, James Knott wrote:

Felix Miata wrote:

...

My 24/7 box is still on 11.4. Dnsmasq was not installed.

My firewall is also 11.4. I had to manually add Dnsmasq.

Mines 10.2 with bind and a split horizon. I didn't find it particularly difficult to set up, and didn't need no stinkin Dnsmasq. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Hans Witvliet wrote:

...

Dns is a pretty lightweight service, so the recommendation even 20 years ago was to dedicate a low performance PC to dns. The reason for that is uptime for your local dns server is very important. Having a local dns server means 99% of dns lookups will be handled at local lan speeds. It also means the cache of names/ips is shared by all your machines.

...

Sounds like a good job for a couple of raspberry pi's (primary & secondary dns). Each of them fed from its own recharchable and PSU.

Actually, it's a good job for any computer that's running all the time. My firewall/router is an old i586 computer running openSUSE 11.4. That's where ai run Dnscache, along with some other services. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Hans Witvliet wrote:

I used to have my dns on my firewall/imap/dhcp/... machine. But i found out that if something goes wrong with dns, everything else tumbled down. Hence i going to migrate my dns-functionality to two machines doing nothing else.

As I mentioned earlier, the main purpose of running Dnsmasq is for name resolution of my local devices. I have a 2nd external DNS configured on any computer with a static address. I also use a DNS service for when I'm away from home. It provides an alias to the long host name for my IPv4 address, but also AAAA records for my IPv6 addresses. I suppose I could add the local RFC 1918 addresses for my local devices to that external DNS, so that I could fall back to it if my local DNS failed, though it of course woudn't work for elsewhere. I currently have configured an old consumer grade firewall/router that I could drop in as a replacement, should my Linux box firewall/router fail. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-04 22:51, David C. Rankin wrote:

Any old box is plenty fast to serve as a firewall/router/dhcpd/bind server.

I use an old laptop with new hard disk for some 24*7 tasks. Saves on energy costs. I have the bottom open, set on top of a tray with fan, one of those sold for cooling laptops, connected to an usb port. Only that I connect the fan to a power converter from the mains, not from an USB socket. The lappy has no battery at all, so it is connected to the same UPS as the router. But I don't serve dnsmasq to my network because I don't have it absolutely always running. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 1/2/2014 2:04 PM, Hans Witvliet wrote:

Sounds like a good job for a couple of raspberry pi's (primary & secondary dns). Each of them fed from its own recharchable and PSU.

Who needs more than one when its in-house? Redundancy behind your single point of failure (modem and isp connection) seems misguided. As long as it had two different forwarders, you would be good. There are a number of small services for in-house use, that could be pushed to Rasberrys, such a time, dhcpd, dns, etc. Maybe even cups. A lot fewer services would need to be running on the big box. I wish they would come out with a raspberry with dual cat5 ports. The current models seem sort of limited in useability. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-02 23:04 (GMT+0100) Hans Witvliet composed:

On Wed, 2014-01-01 at 09:37 -0500, Greg Freemyer wrote:

...

Do you run your own local dns server? Since you have numerous machines you should. Set it up to forward non-cached lookups to a good dns server. No need for that good dns server to be your isp's.

While I do have a lot of machines, only two run 24/7, and one runs eComStation 1.14 (most recent variant of OS/2; latest release 2.1; 2.2 now in beta), which has a 500kb hosts file initially created using more than a decade ago.

...

Dns is a pretty lightweight service, so the recommendation even 20 years ago was to dedicate a low performance PC to dns. The reason for that is uptime for your local dns server is very important. Having a local dns server means 99% of dns lookups will be handled at local lan speeds. It also means the cache of names/ips is shared by all your machines.

Sounds like a good job for a couple of raspberry pi's (primary & secondary dns). Each of them fed from its own recharchable and PSU.

Is there good reason for 2 additional machines and switch port consumption to do what one already running 24/7 for both desktop, LAN server, and Apache can do? If read this whole thread that I started, though not all at once. A lot of good info, with multiple philosophical variances. It seems the preferred starting point for me will be using OpenDNS server IPs, as my own ISP's redirect to its own junk page instead of allowing my browser to show its standard 404 message, and the OpenDNS tests with traceroute -n -w 2 -q 2 were overall best of all I tried, e.g. 199.166.31.3 (199.166.31.3) 23.240 ms 22.991 ms. As to a caching server I'm not sure what to think. If I saw an explanation how one like dnsmasq on a PC might be better than the server in my internet router, I either missed it, or have forgotten. It seems like most convenient would be to use the one in the router, set to use OpenDNS IPs, and also use it to block ad servers. As to blocking ad servers, is blocking via the firewall materially different in effectiveness from redirecting to 0.0.0.0 or 127.0.0.1 via hosts entries? I use a lot of different browsers on different machines, so have never tried the adblock extension. I do have an adblock.css file preventing display of various standard ad image sizes in some browser profiles. -- "The wise are known for their understanding, and pleasant words are persuasive." Proverbs 16:21 (New Living Translation) Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-03 01:58, James Knott wrote:

On a small network, the caching function wouldn't provide much advantage. However, it can act as a local DNS for your network devices, instead of using host files on all computers.

It does, even on a single computer. The slowest the internet pipe, the better the advantage. You can save seconds on every query, and a single page may trigger dozens. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

James Knott said the following on 01/02/2014 09:56 PM:

Carlos E. R. wrote:

...

It does, even on a single computer. The slowest the internet pipe, the better the advantage. You can save seconds on every query, and a single page may trigger dozens.

A DNS cache works only if that address has been requested recently. With few users, that will be less likely.

I disagree. Any one web page is also going to request .css and possibly .js files and these days its so close to a certainty as makes no difference that it is going to request some graphics. Those are likely to be from the same server or at the very least a server in the same domain. If you google for something all that applies and its likely you will read the next page as well. Depending on your reading habits you are likely when visiting a site to 'follow on' to subsequent pages. All of the above applies. Perhaps a really smart browser will not request the same .css and .js and perhaps not the header image, the next pages will have unique content. More and more the web is become graphics intense. So even with one user three is going to be a need for DNS cache. As Carlos says, a single page may trigger dozens of requests. Oh and there's always google analytics. Unless you are unsociable and include that in your adblock list. -- /"\ \ / ASCII Ribbon Campaign X Against HTML Mail / \ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Jan 2, 2014 at 7:58 PM, James Knott wrote:

On a small network, the caching function wouldn't provide much advantage.

I disagree, but I haven't really used wireshark to verify it in a couple years. To the best of my knowledge, if a website has 20 images on it referenced by hostname, then the browser will do a DNS lookup for each of those 20. If you're not running a caching DNS server either on that box itself or on your lan somewhere, then those 20 queries have to go out to the DNS server you're using. At normal ISP speeds, that can add up. As to using the DNS server in the router, I've always assumed all it did was forward your requests to the ISP for you. Do low end home routers actually cache DNS queries? Greg -- Greg Freemyer -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 1/2/2014 5:19 PM, Carlos E. R. wrote:

On 2014-01-03 02:08, Greg Freemyer wrote:

...

As to using the DNS server in the router, I've always assumed all it did was forward your requests to the ISP for you. Do low end home routers actually cache DNS queries?

Yes, they do. How many entries and for how long depends on how good they are, ie, how much memory they have.

Verifying this would require doing queries and timing them. Maybe someone has a test suite out there.

Naw, just put an old ethernet hub between the router and your provider, then ethereal scanning for dns hits. I did this a couple years ago when testing my in-house bind vs the dns cache in a router. Even the lamest old router I had did some amount of caching, but it was dramatically better running bind than the best router. It would literately cash for days and days, where as the hardware router would exceed its tables often within 10 minutes, sometimes on the same page, when pre-fetch is turned on in browsers, and you pull up a page like google news. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 1/4/2014 3:33 PM, David C. Rankin wrote:

OpenDNS:

forwarders { 208.67.220.220; 208.67.222.222; 208.180.42.100; }; ;; Query time: 60.0 msec

forwarders { 208.67.222.222; 208.67.220.220; 208.180.42.100; }; ;; Query time: 74.4 msec

Interesting, this shows that there is often an advantage of swapping the order of the DNS servers and using the secondary, simply because its usually less busy. Surprised Google was that slow. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 01/04/2014 06:41 PM, Carlos E. R. wrote:

you see, for me a local cache on my machine does a big, big, advantage, because any external DNS query takes about a second with my ISP.

Carlos, All, For grins, I decided to see if I could get any further advantage running dnsmasq on my laptop: WAN LAN ----[router]---------[hub]---[rest of local subnet] | | \ All but desired | bind/dhcpd/server Ports Blocked | authoritive/caching laptop dnsmasq The results were pretty much as I expected. Again requesting resolution of trinitydesktop.org: Setup: nameserver: 127.0.0.1 added as 1st nameserver in resolv.con No entries in /etc/dnsmasq.conf # dnsmasq -d Results: 1st attempt nothing in laptop cache: 01:23 alchemy:~> dig @127.0.0.1 trinitydesktop.org <snip> ;; Query time: 3 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) 2nd attempt: ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) Without dnsmasq, I saw an average 2 msec Query time when answer was in my local server cache (1 msec at times) across my wireless link. With dsnmasq, the average Query time was 1 msec when information was cached on my laptop. However, reading a follow-up from Felix, it was noted that dsnmasq does provide additional flexibility to tailor ad-blocking on a per-machine basis using http://pgl.yoyo.org/adservers/ blocking lists. (though you can also use a hosts file formatted list from the same site to accomplish almost the same thing with no dnsmasq running -- and -- it gives an alternative to deploying the block subnet wide with their bind formatted file in my case. Excellent thread - enjoyable and informative. Thanks to all. -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 01/05/2014 05:53 AM, Carlos E. R. wrote:

I'm considering replacing bind with dnsmasq in my main system, it seems far easier to maintain. No need to keep direct and reverse zone files, for different zones. Just an /etc/hosts file...

Carlos, I've looked around a bit, but always stick with isc-bind & isc-dhcpd. While setup takes a bit of reading and making friends with TSIG keys, zone signing, etc.. -- for the most part it is automated such that once configured - it will run for years without any additional intervention. Also, suse generates the needed TSIG keys for you on install and provides the genDDNSkey script to automate generating any additional keys needed. I was completely impressed with dnsmasq and easily see it being able to replace my bind/dhcp (with dynamic dns update) setup. Even providing equivalent to the isc-dhcpd host statement allowing hostname rewriting and address allocation based on mac address. Maybe I'll play with it when I get a chance and see what the memory requirements are for each. isc bind/dhcpd configuration has gotten so dead-bang easy on new server installs for my little network, it really is just a 'dance with the one than brought you case'. -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

On 2014-01-07 07:48, David C. Rankin wrote:

...

Maybe I'll play with it when I get a chance and see what the memory requirements are for each. isc bind/dhcpd configuration has gotten so dead-bang easy on new server installs for my little network, it really is just a 'dance with the one than brought you case'.

I have bind running on this 12.3 setup. I have had it for ages. But I know I have errors on it, which I'm too lazy to correct. Each time I add a machine I have to edit two files (direct and reverse). Be careful with the timestamps. And then I see little inconsistencies which I try to correct, and there is always some little new mistake.

I have a virtual machine where I installed bind afresh, using the YaST module. But something went wrong and it doesn't work at all. The instructions on the openSUSE book, plus the YaST module online help are not clear enough. They assume you really know about zones and DNS and what each particular type of entry is for. And I don't, not really.

So it is a pending task.

And here comes DNSmasq. It is so easy! Just write an /etc/host file and off you go. No more zones, no direct, no reverse, no mismatches. No MX registers. No pointers. Nothing to do to it.

So... is the effort to insist on using bind worth it?

It's fairly easily answered - if using bind is more effort and less or equal functionality, clearly not. -- Per Jessen, Zürich (10.4°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

On 2014-01-07 15:34, Per Jessen wrote:

...

Carlos E. R. wrote:

...

...

So... is the effort to insist on using bind worth it?

It's fairly easily answered - if using bind is more effort and less or equal functionality, clearly not.

I know. But does bind have features that are important enough to keep using it?

I think only you yourself can answer that. You need to know your requirements and whether they are best satisfied by dnsmasq or bind. Personally speaking, I have had a working bind setup for years, it is hardly any effort maintaining it, I have no plans to switch to something else. I don't know dnsmasq at all, but to start with, if it doesn't serve zones, it's no good to me. /Per -- Per Jessen, Zürich (7.8°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/07/2014 06:28 AM, Carlos E. R. wrote:

I have bind running on this 12.3 setup. I have had it for ages. But I know I have errors on it, which I'm too lazy to correct. Each time I add a machine I have to edit two files (direct and reverse). Be careful with the timestamps. And then I see little inconsistencies which I try to correct, and there is always some little new mistake.

No problem. The have these neat little tools that ship like named-checkzone, named-checkconfig, etc.. The slickest part about the setup is using dynamic update from dhcpd to keep your zones updated automagically when new devices plug in or connect wirelessly. Take for example all the wireless stuff that wants an address everyday, even at home it is a blessing. Example from the forward zone: <snip> $TTL 3600 ; 1 hour davids-iPhone A 192.168.6.110 TXT "31de32cd4c301bc6e6e8526f436b2118f6" dcrgx A 192.168.6.111 TXT "315bafb7bcb07998abd2a40f11eb09219c" Deborahs-iPhone A 192.168.6.122 TXT "31a5bf958f65a6efa478be2842c3f9b936" iPhone A 192.168.6.137 TXT "31de32cd4c301bc6e6e8526f436b2118f6" Jordan-Rankin-1 A 192.168.6.144 TXT "31d202900ab3d104fe54191d6673301af1" ripper A 192.168.6.149 TXT "313f41f262462bc25dedb4fa3bb99bc318" Sydney-Rankin A 192.168.6.131 TXT "3112768425732e649608601ac373cfca0e" Sydneys-iPad A 192.168.6.147 TXT "313c6b00df734206b614790a9a4806fec8" Sydneys-IPod A 192.168.6.136 TXT "311da689704c4fb2be7d4edcaabc67107f" each of those are wired/wireless examples that requested an IP via dhcp. My server said OK, your MAC is in my allow filter, so here is your address, updated both forward and reverse zones and then signed the zone. Never had to touch a thing. An for those time when you add a host on a static IP, or assign it a non-changing IP via dhcpd, then simple issue "rndc freeze" to suspend dynamic updates (this conveniently forces the journal cache to be written to the zones), use vi to make needed changes in the zones (increment serial by 1 also), then simply "rndc thaw" and you are done. Literally makes adding new dhcp devices to your network plug-n-play, your zones are automatically and securely updated :-)

I have a virtual machine where I installed bind afresh, using the YaST module. But something went wrong and it doesn't work at all. The instructions on the openSUSE book, plus the YaST module online help are not clear enough. They assume you really know about zones and DNS and what each particular type of entry is for. And I don't, not really.

So it is a pending task.

Piece of cake, 99.9% of the diagnosis is # named-checkzone zonename filename real-world: [03:23 nemesis:/home/david] # named-checkzone rlfpllc.com /var/lib/named/dyn/rlfpllc.com zone rlfpllc.com/IN: loaded serial 2013113017 OK If there is an issue with the zone file, it will flag it and you can fix it long before you issue rcnamed start or systemctl start named.service

And here comes DNSmasq. It is so easy! Just write an /etc/host file and off you go. No more zones, no direct, no reverse, no mismatches. No MX registers. No pointers. Nothing to do to it.

So... is the effort to insist on using bind worth it?

I see the allure... I would still need to do a bit more digging to see if dnsmasq can facilitate backup dnshandling handling like named does, but so far it looks pretty good. - -- David C. Rankin, J.D.,P.E. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlLNGv0ACgkQZMpuZ8Cyrci7OgCfe2kVRLlBcFl84MwT7gnQu38K g40Anjk4EQYZpNZmwo40Hyi8ixs+9hzu =HucH -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

James Knott wrote:

Isn't a DNS cache included in the browser or operating system already?

Check nscd. It's used in openSUSE for name server caching. man nscd for details. Firefox also has a DNS cache. So, using a caching DNS server won't provide much improvement for a single computer. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Jan 2, 2014 at 10:20 PM, James Knott wrote:

James Knott wrote:

...

Isn't a DNS cache included in the browser or operating system already?

Check nscd. It's used in openSUSE for name server caching. man nscd for details. Firefox also has a DNS cache. So, using a caching DNS server won't provide much improvement for a single computer.

slightly OT: I just used wireshark to watch chrome page refresh with Windows 7. I happened to have susestudio open on a page with no advertising and few graphics. the result was 4 outbound DNS queries for susestudio.com to my DNS server in 3 seconds. So chrome v31 does not cache DNS even during a single page refresh. And neither does Windows 7. I repeated the test with firefox, and I got no DNS queries for susestudio.com, so it does seem to cache internally. Thus anyone with Windows 7 / Chrome as part of their local LAN should realize they are pounding their DNS server heavily. If that DNS server is 10 or 20 milliseconds away, a heavily graphic'ed webpage could be slowed down a second or two just making the DNS queries. I'm using my ISPs DNS server on that windows laptop and it is taking about 20 millisecs to respond to a DNS query. Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Per Jessen said the following on 01/03/2014 11:43 AM:

An application really should not be caching, it should leave that to nscd or a caching dns.

Let me tout the "Context is Everything" point once again. Yes you are right, in certain contexts. Such as folks like us doing general computing using a variety of applications that make demands on network services. But in other contexts you are wrong, dead wrong. The most obvious of these is the netbook/chromebook where the browser is the system, there is no other application to share the DNS results. And lets face it, a lot of users are not like us, they live in the browser even when they are suing some variety of Windows. They like on Facebook or one friend I have you lives in eBay, using only the eBay internal mail. That's his 'context'. No point sending him e-mail as smtp or gmail, he doesn't have an account and wouldn't know how to read it. Such people live in the browser. For them Windows and Linux are irrelevant. Swap out their PC for a Chromebook that boots 'instantly' from the SSD and they will see it as an improvement. Even some people here live on gmail and I wonder if they use a non-web-browser mail user interface. -- " Excellent!" I cried. "Elementary," said he. -- Watson and Sherlock Holmes, in "The Adventure of the Crooked Man" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-03 17:43 (GMT+0100) Per Jessen composed:

An application really should not be caching, it should leave that to nscd or a caching dns.

Or? I have dnsmasq running. Should I turn off nscd? -- "The wise are known for their understanding, and pleasant words are persuasive." Proverbs 16:21 (New Living Translation) Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 1/3/2014 10:25 AM, James Knott wrote:

Felix Miata wrote:

...

Or? I have dnsmasq running. Should I turn off nscd?

I don't know that having multiple caches will hurt, unless one is caching longer than the TTL.to the point it has stale data.

Even a "stale" cache is probably good enough in the case of monster big sites using round-robin dns schemes and very short TTLs. Those sites are still likely to have all those servers running. In a sense such sites pervert the whole concept of DNS by using it to load balance by round-robin. I'm NOT convinced it should be the remote client's job to query dns for every page part simply because the site want's to balance load. Any caching by your own browser or your in-house nscd, or your ISP's DNS server is going to undo the web site's round robin via DNS anyway. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

David T-G said the following on 01/03/2014 03:32 PM:

I am QUITE convinced that it should not be the client's job; that's why there are load balancers that present multiple instances behind one IP.

That would require one and only one pipe into the service. For many high volume services that is unacceptable. In addition, many services separate out different types of content.

I*might* be open to the concept of regional addressing, but only if the case is made very eloquently.

Regional addressing as in "if the requester is in Europe have them served from a server that is electrically situated near them rather than making every transaction go all the way across the Atlantic to the USA." Actually if I query google for google.com I end up getting served by google.ca :-) And I'm not even French! Its no 'eloquence' we've been discussion so much as speed of response. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

...

...

James Knott 01/03/14 3:50 PM >>> John Andersen wrote: Any caching by your own browser or your in-house nscd, or your ISP's DNS server is going to undo the web site's round robin via DNS anyway.

Perhaps for your own access, but what about the next guy who winds up on a different server, as intended?

Or, if one of the address is inaccessible, the client *should* pick one of the other addresses automatically. Before we were able to purchase a Barracuda on campus, we just used DNS round-robin to let the client randomly pick one of the three nodes in our Tomcat cluster; if the node it chose was down for some reason, the client would automatically hop over to one of the other addresses. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

...

...

John Andersen 01/03/14 4:38 PM >>> On 1/3/2014 1:53 PM, Christopher Myers wrote:

But DNS serves up exactly one IP address (to the best of my knowledge).

Hmm, when we set up the round-robin entries wacluster IN A 216.125.123.66 wacluster IN A 216.125.123.67 it would return multiple values: mucolo:/ # nslookup wacluster.millikin.edu Server: 208.34.148.12 Address: 208.34.148.12#53 Non-authoritative answer: Name: wacluster.millikin.edu Address: 216.125.123.67 Name: wacluster.millikin.edu Address: 216.125.123.66 (We just have two nodes in the cluster visible currently, the third one isn't included in the round-robin.) -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

...

...

James Knott 01/03/14 5:01 PM >>> Christopher Myers wrote: Hmm, when we set up the round-robin entries

wacluster IN A 216.125.123.66 wacluster IN A 216.125.123.67

it would return multiple values:

But woudn't that just be different addresses handed out to separate requests? So, one person would get .66 and the next .67.

Actually, everyone gets both; the device picks which one to use, which is what allows it to randomly balance or fail over to the other address if the one it picks isn't responding. (Mind you, it's not perfect, since a 404 or 500 error is still "responding," which is why a real load balancer is better.) If you want to give it a shot, do an nslookup for that host address (wacluster.millikin.edu) and it should give you both addresses. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 1/3/2014 3:05 PM, Christopher Myers wrote:

Actually, everyone gets both; the device picks which one to use, which is what allows it to randomly balance or fail over to the other address if the one it picks isn't responding. (Mind you, it's not perfect, since a 404 or 500 error is still "responding," which is why a real load balancer is better.)

Are you sure? For instance, a PING wacluster.millikin.edu alternated between 67 and 66 upon each startup. (They all fail). So it appears your system is handing out one address only, and switches between the two. I havent figured out the nslookup arguments that make exact same request as a simple DNS request. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

John Andersen said the following on 01/03/2014 05:38 PM:

But DNS serves up exactly one IP address (to the best of my knowledge).

No it doesn't. Look at the example James Knott and I have give. The output of HOST: $ host google.com google.com has address 74.125.226.132 google.com has address 74.125.226.135 google.com has address 74.125.226.142 google.com has address 74.125.226.131 google.com has address 74.125.226.129 google.com has address 74.125.226.128 google.com has address 74.125.226.133 google.com has address 74.125.226.130 google.com has address 74.125.226.137 google.com has address 74.125.226.134 google.com has address 74.125.226.136 google.com has IPv6 address 2607:f8b0:400b:80b::100e google.com mail is handled by 40 alt3.aspmx.l.google.com. google.com mail is handled by 30 alt2.aspmx.l.google.com. google.com mail is handled by 10 aspmx.l.google.com. google.com mail is handled by 20 alt1.aspmx.l.google.com. google.com mail is handled by 50 alt4.aspmx.l.google.com. or the output of DIG $ dig google.com ; <<>> DiG 9.9.3-P2 <<>> google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27199 ;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 4, ADDITIONAL: 5 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;google.com. IN A ;; ANSWER SECTION: google.com. 218 IN A 74.125.226.131 google.com. 218 IN A 74.125.226.133 google.com. 218 IN A 74.125.226.142 google.com. 218 IN A 74.125.226.128 google.com. 218 IN A 74.125.226.134 google.com. 218 IN A 74.125.226.135 google.com. 218 IN A 74.125.226.137 google.com. 218 IN A 74.125.226.132 google.com. 218 IN A 74.125.226.129 google.com. 218 IN A 74.125.226.130 google.com. 218 IN A 74.125.226.136 ;; AUTHORITY SECTION: google.com. 49972 IN NS ns1.google.com. google.com. 49972 IN NS ns3.google.com. google.com. 49972 IN NS ns4.google.com. google.com. 49972 IN NS ns2.google.com. ;; ADDITIONAL SECTION: ns1.google.com. 222772 IN A 216.239.32.10 ns2.google.com. 222772 IN A 216.239.34.10 ns3.google.com. 222772 IN A 216.239.36.10 ns4.google.com. 222772 IN A 216.239.38.10 illustrates this. If you look at the man page for GETHOSTBYNAME(3) you'll see that it returns a LIST of addresses. The structure is: struct hostent { char *h_name; /* official name of host */ char **h_aliases; /* alias list */ int h_addrtype; /* host address type */ int h_length; /* length of address */ char **h_addr_list; /* list of addresses */ } and the man page says h_addr_list An array of pointers to network addresses for the host (in network byte order), terminated by a NULL pointer. Given that list, the application can pick and choose. At any point in time the server's DNS can return a subset of the possible addresses - as shown by the differences between my earlier post and James' earlier post. How the application picks and chooses is entirely up to the application. What happens BEHIND these interfaces that google, yahoo and others present is another matter, and they have published a number of papers on this and how they have tried out different approaches, But essentially there is another 'crossbar switch' and another layer of load balancing. How it works ... probably changes as new technology comes along and new ideas are formulated. I'll grant you that some sites, like my own little site, does have just one address. $ host www.antonaylward.com www.antonaylward.com has address 66.33.210.248 Yes, that's it. But its not as if I get a lot of traffic :-) -- "You may have to fight a battle more than once to win it." -- Margaret Thatcher -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

John Andersen said the following on 01/03/2014 03:21 PM:

Even a "stale" cache is probably good enough in the case of monster big sites using round-robin dns schemes and very short TTLs. Those sites are still likely to have all those servers running.

Indeed. Look back and you'll see that the set of sites I fund using DIG and the set of sites James Knott found were slightly different, just a few minutes apart and even though he's just a few miles down the rad from e. That round robin for you :-( But I could equally well ignore the TTL on the sites I found and use those same records half and hour, half a day later. The site will still be there. From my POV it doesn't matter. From the POV of Yahoo, Google or Amazon it DOES matter. They need to balance the load across not only their servers but also across the incoming pipes.

In a sense such sites pervert the whole concept of DNS by using it to load balance by round-robin.

In just the same way RFC1918 addresses pervert the whole concept of peer-to-peer addressing that is the basis of the Internet. But sometimes accommodations are needed to get acceptable performance. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 01/03/2014 12:12 PM, Felix Miata wrote:

On 2014-01-03 17:43 (GMT+0100) Per Jessen composed:

...

An application really should not be caching, it should leave that to nscd or a caching dns.

Or? I have dnsmasq running. Should I turn off nscd?

It is really de minimis. Even over slow wireless your ping time to a caching server is on the order of 2/3 millisecond. The cache query time itself is 2-3 milliseconds. Whether you run a nscd or a browsercache, you are only saving at most a millisecond. If you have a caching nameserver - there is no need for another cache; If you don't have a local caching nameserver - then, of course cache on your local machine. Now there is a HUGE question about how much latency develops in a "browser cache" as the number of files or cache size grows. That could cause a "browser cache" to be interjecting additional delay just to read its own cache. I have not tested, but I doubt the sqlite3 type cache structure of FF compares to the speed of bind. I suspect a nscd type cache is more efficient than a FF cache, so you may be better off disabling your browser cache if you have another local caching service, so long as you can tell your browser to use the external cache. (that in itself may/may not be possible) As pointed out, a browser cache does absolutely nothing for all of the remaining apps that need address resolution. That is where a standard caching setup such as bind, etc.. can eliminate a lot of "gee, I wonder" questions regarding this topic. As long as you never see a "looking up host" message from any of your applications, how you do it is largely irrelevant. If I'm going to invest the time to setup a caching solution, I want to insure it is spent on a long term reliable solution. -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

No, it doesn't. It caches the hosts file.

Nscd provides caching for accesses of the passwd(5), group(5), and hosts(5) databases through standard libc interfaces, such as getpwnam(3), getpwuid(3), getgrnam(3), getgrgid(3), gethostbyname(3), and others.

Read http://prefetch.net/blog/index.php/2011/03/27/configuring-nscd-to-cache-dns-... and then take a look at /etc/nscd.conf. On my system, the positive-time-to-live is 3600. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-04 12:27, Per Jessen wrote:

Carlos E. R. wrote:

...

...

Check nscd. It's used in openSUSE for name server caching. man nscd for details.

No, it doesn't. It caches the hosts file.

Yes it does. See your own quote:

...

Nscd provides caching for accesses of the passwd(5), group(5), and hosts(5) databases through standard libc interfaces, such as getpwnam(3), getpwuid(3), getgrnam(3), getgrgid(3), gethostbyname(3), and others.

^^^^^^^^^^^^^^^

I understand it means that it uses that function, yes, but only the hosts database is cached. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Greg Freemyer wrote:

Browsing with firefox I see the "hosts cache" growing, but there are no cache hits. I guess that confirms that firefox is caching internally.

I wonder if firefox does asynchronous DNS lookups, it would make a lot of sense. If so, firefox almost certainly doesn't use the libc calls. -- Per Jessen, Zürich (5.7°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Sat, Jan 4, 2014 at 10:43 AM, Per Jessen wrote:

Greg Freemyer wrote:

...

I just installed nscd for the first time (seems like it should be part of the default install since it is useful in web browsing).

I think it _is_ part of the default install. I don't remember having to explicitly select nscd.

My install is not "default" so I am probably wrong. In my case I had to zypper in / rcnscd start; Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Greg Freemyer wrote:

I just installed nscd for the first time (seems like it should be part of the default install since it is useful in web browsing).

It's installed on all my systems here (2 x 13.1 & 1 x 11.4). I have never had to install it. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-04 16:24, Per Jessen wrote:

Carlos E. R. wrote:

Now notice no outgoing DNS traffic.

If you want to be certain 'nscd' is doing the caching, stop it, then repeat the exercise and notice outgoing DNS traffic on every ping command.

It would not work in any of my system, I have always set a DNS cache server. Previously I used bind, now I use dnsmasq. I would have to disable that and reconfigure my network. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 1/4/2014 9:22 AM, Per Jessen wrote:

Carlos E. R. wrote:

...

On 2014-01-04 16:24, Per Jessen wrote:

...

Carlos E. R. wrote:

...

Now notice no outgoing DNS traffic.

If you want to be certain 'nscd' is doing the caching, stop it, then repeat the exercise and notice outgoing DNS traffic on every ping command.

It would not work in any of my system, I have always set a DNS cache server. Previously I used bind, now I use dnsmasq.

I would have to disable that and reconfigure my network.

Hmm, without knowing your config, you still ought to be able to see/tcpdump the DNS traffic somewhere. If dnsmasq is accessed via 127.0.0.1, just run tcpdump on 'lo'.

If dnsmasq doesn't run locally, run tcpdump on whichever interface is used to access it.

Carlos's point is that nscd might not be doing the cacheing on his network because he is explicitly running some other services to handle this, and therefore his results would prove nothing about nscd. I don't think he meant that the actual commands wouldn't work. Your tests work for me, but I too have no idea who is doing this caching, as nscd -g shows no difference comparing before or after, and cache hit rate remains 0. I run bind as well, on my gateway box, so it might be in there. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-04 20:11, John Andersen wrote:

Carlos's point is that nscd might not be doing the cacheing on his network because he is explicitly running some other services to handle this, and therefore his results would prove nothing about nscd. I don't think he meant that the actual commands wouldn't work.

Right. I would have to stop dnsmasq, and edit /etc/resolv.conf to point to my router, which is not that difficult, anyway.

Your tests work for me, but I too have no idea who is doing this caching, as nscd -g shows no difference comparing before or after, and cache hit rate remains 0. I run bind as well, on my gateway box, so it might be in there.

I'm running this on a terminal: watch "nscd -g | head -80 | tail -23" and what I see is: hosts cache: yes cache is enabled no cache is persistent yes cache is shared 211 suggested size 216064 total data pool size 112 used data pool size 600 seconds time to live for positive entries 0 seconds time to live for negative entries 0 cache hits on positive entries 0 cache hits on negative entries 1 cache misses on positive entries 0 cache misses on negative entries 0% cache hit rate 1 current number of cached values 1 maximum number of cached values 0 maximum chain length searched 0 number of delays on rdlock 0 number of delays on wrlock 0 memory allocations failed yes check /etc/hosts for changes and this does not change when I run "host google.es" or "host suse.de". Or local addresses. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-04 21:09, John Andersen wrote:

On 1/4/2014 11:58 AM, Carlos E. R. wrote:

...

and this does not change when I run "host google.es" or "host suse.de". Or local addresses.

Yes, I see the same thing, but if you are running tcpdump -n -i eth0 port 53 in another shell you will see that the host command totally ignores the nscd and does a hit each time.

Which makes sense, since you might want to use that command to diagnose cache problems. Ping, or lynx or ssh, or most other applications do hit the nscd.

Ok, right, using ping things changes: hosts cache: yes cache is enabled no cache is persistent yes cache is shared 211 suggested size 216064 total data pool size 720 used data pool size 600 seconds time to live for positive entries 0 seconds time to live for negative entries 1 cache hits on positive entries 0 cache hits on negative entries 6 cache misses on positive entries 0 cache misses on negative entries 14% cache hit rate 6 current number of cached values 6 maximum number of cached values 1 maximum chain length searched 0 number of delays on rdlock 0 number of delays on wrlock 0 memory allocations failed yes check /etc/hosts for changes But most are misses, not hits, even repeating the ping several times. If I try the tcpdump, and ping "suse.de" (which fails, by the way, this is new, it worked for many years) I see no new lines in the dump. With google I see some, but not always.

Have you tried turning off nscd ?

Let's try. [...] No difference, suse.de is cached. Or local names. If I put the tcpdump on "lo" and repeat, with nscd running I see only one hit. If I stop nscd I see one hit each time (but none on eth0). So it appears that both nscd and dnsmasq are caching DNS queries... Interesting! So, the point now is to decide which is best to use. I want dnsmasq, because I also use it for local machine names. So perhaps I should disable nscd (for hosts). :-? -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-04 22:05, John Andersen wrote:

On 1/4/2014 12:31 PM, Carlos E. R. wrote:

...

If I put the tcpdump on "lo" and repeat, with nscd running I see only one hit. If I stop nscd I see one hit each time (but none on eth0). So it appears that both nscd and dnsmasq are caching DNS queries...

Interesting!

So, the point now is to decide which is best to use. I want dnsmasq, because I also use it for local machine names. So perhaps I should disable nscd (for hosts). :-?

That is kind of what I was suspecting, you have dual caches. Since nscd caches things beyond DNS, it probably doesn't hurt you, other than taking up a bit more memory. Local machine names can be cached if they are in /etc/hosts I suppose.

/etc/nscd.conf enable-cache hosts no and restart it. I try to ping suse.de, with tcpdump on eth0 active, and I see no entries, so dnsmasq is still caching it. And dnsmasq as caches /etc/hosts :-) Very interesting thread! Thanks. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-04 22:43, John Andersen wrote:

On 1/4/2014 1:29 PM, Carlos E. R. wrote:

Here's more on this found on this site: http://alpacapowered.wordpress.com/2013/03/08/nscd-dns-caching-and-postfix/ Turns out if cache is shared (mine is) you get incomplete stats out of nscd -g because applications are raiding its cookie jar behind its back.

This is the intended way for it to operate, apparently.

And it also seems that postfix doesn't use nscd, although a simple config change solves that; other apps also do not use nscd and they can't be made to use it, apparently. Thus disabling nscd and using dnsmasq as I do means that all queries would go to dnsmasq and the global hit ratio should increase. Interesting. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-05 00:50, John Andersen wrote:

On 1/4/2014 3:31 PM, Carlos E. R. wrote:

...

And it also seems that postfix doesn't use nscd, although a simple config change solves that; other apps also do not use nscd and they can't be made to use it, apparently. Thus disabling nscd and using dnsmasq as I do means that all queries would go to dnsmasq and the global hit ratio should increase.

That assumes that dnsmasq does not also have some built in way to go around it. (I really don't know).

Well, dnsmasq is a dns server. All DNS servers cache entries as long as they can. So dnsmasq should work just fine with any program that does DNS query. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 1/4/2014 6:13 PM, James Knott wrote:

John Andersen wrote:

...

That assumes that dnsmasq does not also have some built in way to go around it. (I really don't know).

Dnsmasq is the specified DNS server. How does any app get around that, other than going to the root servers etc.

I don't know that anything does get around that, but if anything wanted to I imagine it would be the same way Dig or postfix gets around nscd. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

On 2014-01-05 03:46, John Andersen wrote:

...

On 1/4/2014 6:13 PM, James Knott wrote:

...

John Andersen wrote:

...

That assumes that dnsmasq does not also have some built in way to go around it. (I really don't know).

Dnsmasq is the specified DNS server. How does any app get around that, other than going to the root servers etc.

I don't know that anything does get around that, but if anything wanted to I imagine it would be the same way Dig or postfix gets around nscd.

They simply use their own resolver instead of libc. getaddrinfo() et al are synchronous, if you need to do a lot of lookups and remain responsive, you do asynchronous lookups in parallel. For examples of alternative resolvers, have a look at "adns" and "udns" . I prefer the latter.

No way.

They get around nscd because nscd is not a DNS, it just replaces some (not all) system calls with new functionality. When they do a DNS call, whatever DNS is defined for the system, local, external or at the other end of the world, responds. No way around that.

Being slightly petty, well, yes there is, but doesn't make a lot of sense. Any application can talk to any nameserver it wants to, it doesn't _have_ to look at /etc/resolv.conf. -- Per Jessen, Zürich (5.1°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

John Andersen wrote:

On 1/4/2014 6:13 PM, James Knott wrote:

...

John Andersen wrote:

...

That assumes that dnsmasq does not also have some built in way to go around it. (I really don't know). Dnsmasq is the specified DNS server. How does any app get around that, other than going to the root servers etc.

I don't know that anything does get around that, but if anything wanted to I imagine it would be the same way Dig or postfix gets around nscd.

Nscd is only a cache, not a DNS server. Dnsmasq is a DNS server that any app shouldn't know how to get around. As far as an app is concerned, there's no difference between using Dnsmasq, Google DNS, the ISP's DNS etc. They're all DNS servers. The next thing beyond that would be to do an iterative DNS query, starting from the root DNS server in the manner the ISPs DNS would. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-05 10:13, Per Jessen wrote:

Somewhat OT, but spamassassin does not use the libc resolver, it does it's own asynchronous dns lookups.

Using the system configured DNS server for that, I understand. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

On 2014-01-04 22:43, John Andersen wrote:

...

On 1/4/2014 1:29 PM, Carlos E. R. wrote:

...

Here's more on this found on this site:

http://alpacapowered.wordpress.com/2013/03/08/nscd-dns-caching-and-postfix/

...

Turns out if cache is shared (mine is) you get incomplete stats out of nscd -g because applications are raiding its cookie jar behind its back.

This is the intended way for it to operate, apparently.

And it also seems that postfix doesn't use nscd, although a simple config change solves that; other apps also do not use nscd and they can't be made to use it, apparently.

It's not really the application that uses nscd, the application is unaware. nscd is used by the libc resolver. When an application does it's own resolving, it typically will not use nscd. -- Per Jessen, Zürich (4.9°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-03 01:38, Felix Miata wrote:

As to blocking ad servers, is blocking via the firewall materially different in effectiveness from redirecting to 0.0.0.0 or 127.0.0.1 via hosts entries?

Yes. The idea is that blocking on the firewall acts after you make the request to download the ad. The advert is effectively downloaded, just blocked on the doorstep. Similarly with browser extensions to block adds. With a dns redirect, when the page wants to download an advert, as it asks the wrong machine for it, the request is never sent to internet, and it is never downloaded, so that it does not use your internet pipe. However, I do not block adverts, as a general rule. Only obnoxious adverts. -- Cheers, Carlos E. R. (from 13.1 x86_64 "Bottle" (Elessar)) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Anton Aylward wrote:

Yes, lots! Visit http://pgl.yoyo.org/adservers/ and read up on a few other items.

I've just added that ad server list to the hosts file on my firewall, where I'm running Dnsmasq caching DNS server. This means every device on my home network will benefit. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Felix Miata said the following on 01/02/2014 11:57 PM:

...

...

Yes this too takes maintenance. How often is your habit?

Its not clock driven, its event drive. This discussion is an example event. New adverts getting though are another example. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Per Jessen said the following on 01/01/2014 01:28 PM:

...

...

Are there reasons why the servers provided by the ISP subscribed to shouldn't be preferred? Not AFAICS.

Given "preferred over what?" being answered as "Something that takes longer to respond such as 8.8.8.8" then yes. But compared to a LAN-local or machine-local caching DNS server, the very emphatically NO! -- /"\ \ / ASCII Ribbon Campaign X Against HTML Mail / \ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

auxsvr@gmail.com said the following on 01/03/2014 02:16 AM:

ISP's servers should be the fastest with regard to network latency and quite fast with regard to the number of queries cached. I checked the effect these two factors have on performance with namebench some days ago, and Google's and openDNS's name servers outperformed my ISP's servers by 70%, so the number of users apparently has much higher effect on DNS performance than network latency.

While I agree in broad brush terms there are a couple of other factors that matter * Cache size * Cache time-out/LRU flush algorithm You can get some of the more popular domains such as google searches and the major news providers are going to be retained from sheer popularity. Perhaps they get hard-wired in :-) But the point is that we as individuals are not going to be viewing our own use patterns as 'statistics' but as certainties. From my POV having an old or tiny box dedicated to DNS with a couple of gigs of memory[1] with a -ing cache and a -ing long timeout will 'outperform' all of the above after a couple of days, provided I don't turn it off at night. And if its a 'berry or one off the micro-ITX boards then its taking less power than than the compact fluorescent bulb over my desk. The point here is that with the local DNS server I have control over the cache and the cash is exactly matched to my use patterns, not that of some world wide statistical group. [1] I can pull a old desktop from the Closet of Anxieties and load it up with a couple of sticks of old DDR2 and its close to zero cost for me. -- The more laws and restrictions there are, The poorer people become. The sharper men's weapons, The more trouble in the land. The more ingenious and clever men are, The more strange things happen. The more rules and regulations, The more thieves and robbers. -- The Tao Te Ching -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Anton Aylward wrote:

From my POV having an old or tiny box dedicated to DNS with a couple of gigs of memory[1] with a -ing cache and a -ing long timeout will 'outperform' all of the above after a couple of days, provided I don't turn it off at night.

Actually, the time to live value in the returned DNS reply will limit any caching. I just did one test for Yahoo and it showed 34 seconds. Another one showed 3 min 2 sec, so upstream caches will return a varying TTL depending on when they obtained the record. Those times are nowhere near "overnight". -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Greg Freemyer wrote:

I had no idea TTLs were so short these days. When I was admin'ing DNS 15+ years ago, a week was a very common TTL (time-to-live). If the majority are down in the minutes area now, it is even more important to have a busy DNS server in your query forwarding logic somewhere. My ISP is huge, so I just use theirs.

The TTL is determined by the source DNS and can be set as desired. So, if you have an address that's not likely to change, then you can go with a long TTL. However, if you use DNS records for load balancing, as may be the case with Yahoo, then you probably want a short TTL. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Greg Freemyer said the following on 01/03/2014 10:20 AM:

On Fri, Jan 3, 2014 at 10:13 AM, James Knott wrote:

...

Anton Aylward wrote:

...

From my POV having an old or tiny box dedicated to DNS with a couple of gigs of memory[1] with a -ing cache and a -ing long timeout will 'outperform' all of the above after a couple of days, provided I don't turn it off at night.

Actually, the time to live value in the returned DNS reply will limit any caching. I just did one test for Yahoo and it showed 34 seconds. Another one showed 3 min 2 sec, so upstream caches will return a varying TTL depending on when they obtained the record. Those times are nowhere near "overnight".

I had no idea TTLs were so short these days. When I was admin'ing DNS 15+ years ago, a week was a very common TTL (time-to-live).

+1. My Albitz&Liu talks of a default of 85400 seconds, which is 24 hours which *IS* overnight! Why should a site have such short TTL? The only justification I can think of is that they are implementing Round Robin DNS that way. Think about it: how often are major sites such as yahoo, Google and the big news agencies, government departments and so forth going to change their network addresses for soemthing radically differnet? But organizations such as Yahoo will have huge server farms and DO want to do load balancing. Balancing by hardware internally still requires the single external address, and that's not what they want. A test for yahoo using DIG returns ;; QUESTION SECTION: ;yahoo.com. IN A ;; ANSWER SECTION: yahoo.com. 1800 IN A 206.190.36.45 yahoo.com. 1800 IN A 98.139.183.24 yahoo.com. 1800 IN A 98.138.253.109 ;; AUTHORITY SECTION: yahoo.com. 75033 IN NS ns6.yahoo.com. yahoo.com. 75033 IN NS ns5.yahoo.com. yahoo.com. 75033 IN NS ns2.yahoo.com. yahoo.com. 75033 IN NS ns4.yahoo.com. yahoo.com. 75033 IN NS ns1.yahoo.com. yahoo.com. 75033 IN NS ns3.yahoo.com. yahoo.com. 75033 IN NS ns8.yahoo.com. ;; ADDITIONAL SECTION: ns1.yahoo.com. 74847 IN A 68.180.131.16 ns2.yahoo.com. 74847 IN A 68.142.255.16 ns3.yahoo.com. 74847 IN A 203.84.221.53 ns4.yahoo.com. 74847 IN A 98.138.11.157 ns5.yahoo.com. 74847 IN A 119.160.247.124 ns6.yahoo.com. 75036 IN A 202.43.223.170 ns8.yahoo.com. 75037 IN A 202.165.104.22 1800 sec = 30 min 75033 sec = 20.8425 hours 74847 sec = 20.790833 hours So the name servers at least will stay in my cache overnight :-) Google.com is even more interesting and dramatic ;; ANSWER SECTION: google.com. 300 IN A 74.125.226.128 google.com. 300 IN A 74.125.226.132 google.com. 300 IN A 74.125.226.129 google.com. 300 IN A 74.125.226.134 google.com. 300 IN A 74.125.226.131 google.com. 300 IN A 74.125.226.136 google.com. 300 IN A 74.125.226.142 google.com. 300 IN A 74.125.226.130 google.com. 300 IN A 74.125.226.133 google.com. 300 IN A 74.125.226.135 google.com. 300 IN A 74.125.226.137 ;; AUTHORITY SECTION: google.com. 74246 IN NS ns1.google.com. google.com. 74246 IN NS ns4.google.com. google.com. 74246 IN NS ns2.google.com. google.com. 74246 IN NS ns3.google.com. ;; ADDITIONAL SECTION: ns1.google.com. 247046 IN A 216.239.32.10 ns2.google.com. 247046 IN A 216.239.34.10 ns3.google.com. 247046 IN A 216.239.36.10 ns4.google.com. 247046 IN A 216.239.38.10 300 sec = 5 min 74246 sec = 20.623889 hours 247046 sec = 68.623889 hours At this point I suggest a re-read of how the resolver works when presented with a number of "answers" such as the above. I have no doubt that google.com is returning a value that matches "geographically". My resolver sees all of "74.125.226.x" as being 'electrically' equidistant so it going to do a RR on them. The likelyhood that I'd hit google.com a second time in 5 minutes is about 50/50. The first time I hit a google page there are well over 100 additional references back to google for ... stuff. If there wasn't caching, be it DNS or be in in my browser, it would take ages for the page to load. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Anton Aylward wrote:

Greg Freemyer said the following on 01/03/2014 10:20 AM:

...

On Fri, Jan 3, 2014 at 10:13 AM, James Knott wrote:

...

Anton Aylward wrote:

...

From my POV having an old or tiny box dedicated to DNS with a couple of gigs of memory[1] with a -ing cache and a -ing long timeout will 'outperform' all of the above after a couple of days, provided I don't turn it off at night.

Actually, the time to live value in the returned DNS reply will limit any caching. I just did one test for Yahoo and it showed 34 seconds. Another one showed 3 min 2 sec, so upstream caches will return a varying TTL depending on when they obtained the record. Those times are nowhere near "overnight".

I had no idea TTLs were so short these days. When I was admin'ing DNS 15+ years ago, a week was a very common TTL (time-to-live).

+1. My Albitz&Liu talks of a default of 85400 seconds, which is 24 hours which *IS* overnight!

Why should a site have such short TTL? The only justification I can think of is that they are implementing Round Robin DNS that way.

And that's a poor justification. Maybe have a look at 'rrset' in the bind manual. -- Per Jessen, Zürich (7.2°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Greg Freemyer wrote:

I had no idea TTLs were so short these days. When I was admin'ing DNS 15+ years ago, a week was a very common TTL (time-to-live). If the majority are down in the minutes area now, it is even more important to have a busy DNS server in your query forwarding logic somewhere. My ISP is huge, so I just use theirs.

The TTL is determined by the source DNS and can be set as desired. So, if you have an address that's not likely to change, then you can go with a long TTL. However, if you use DNS records for load balancing, as may be the case with Yahoo, then you probably want a short TTL. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org