Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm running Ubuntu 12.04. On my work network, there's a single-word address (let's call it foobar) that is responding to pings and HTTP requests, only from my machine. The address is not a TLD, just a generic, project-related acronym.

Said address shouldn't be responding: There's no foobar entry in my /etc/hosts file. There's no reference to foobar in apache's httpd.conf, sites-available or sites-enabled, neither on my resolv.conf file, as follows:

nameserver 127.0.0.1
search redacted.mycompany.com

Initially I thought it was redirecting to localhost, but if I open it on my browser it shows the nginx welcome page, and I'm running apache on my machine.

Sniffing lo and eth0 shows the traffic is indeed coming from the network. Restarting the resolvconf service doesn't fix the issue. If I run:

service resolvconf stop
resolvconf --wipe-runtime-directories
service resolvconf start

then foobar stops resolving, but if I restart my machine it resolves again

Pinging foobar gets a reply from foobar.redacted.mycompany.com, a real address that works fine for other machines besides my own. Tracerouting or mtr'ing foobar shows a 5 hops until the destination, the same as tracerouting or mtr'ing foobar.redacted.mycompany.com.

Here's the output of the dig foobar command:

; <<>> DiG 9.8.1-P1 <<>> foobar
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 52484
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;foobar.                IN  A

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Mar  8 14:32:02 2013
;; MSG SIZE  rcvd: 22

The issue happens both on Firefox (19.0) or Chrome (24.0.1312.56-0ubuntu0.12.04.1). Pressing CTRL+F5 doesn't change anything. It doesn't happen on other two coworker's machines I've tested on the same subnetwork.

share|improve this question

closed as too localized by That Brazilian Guy, Thomas W., green7, AgentCool, psusi Apr 17 '13 at 18:29

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

3  
Are you behind a proxy? Have you bought a coffee for your network admin recently or have you been totally neglecting him for a long time now? –  catalesia Mar 1 '13 at 16:37
    
Is foobar really the URL you are accessing? –  guntbert Mar 1 '13 at 18:23
    
@guntbert no, it's a single word that's not a TLD. –  That Brazilian Guy Mar 1 '13 at 18:38
    
it could match a hostname of another system on the network, and thereby being resolved that way. –  Thomas W. Apr 16 '13 at 23:11
add comment

1 Answer 1

up vote 3 down vote accepted

Just so you know, the entire client-side of the domain name system is entirely arbitrary; by convention programs are supposed to go through the system's C library to resolve hostnames, but technically they could entirely bypass that mechanism if they wanted to, either by shipping their own C library (statically compiled or otherwise), or using a completely custom DNS lookup system that does or does not use the DNS protocol.

Assuming a standard Ubuntu install, running programs that are linked to the system C library, you've got eglibc (which is a minor fork of GNU libc), and the default path of the file that tells gethostbyname() and other C library DNS resolution functions what DNS server to hit is /etc/resolv.conf.

nameserver 127.0.0.1 means "use the DNS protocol to ask 127.0.0.1 about DNS queries" -- I assume you have a local caching DNS server that forwards to an upstream DNS server, such as dnsmasq or bind, for performance reasons (when doing a DNS query, it's a heck of a lot faster to query a server on your own computer than to go hit the network!)

search redacted.mycompany.com means "when trying to resolve foo, if it doesn't resolve directly then add the string .redacted.mycompany.com on the end and try again; if that works, return that result".

I think this is working "by design", but I don't know why it wouldn't work on coworkers' machines, unless they don't have the search line.

share|improve this answer
    
Turns out the two coworkers' machines I tested on had foobar on /etc/hosts, tested on a 3rd coworker's machine now and worked exactly as on my machine. –  That Brazilian Guy Mar 8 '13 at 18:10
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.