Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sniffing (using Wireshark), for didactical purpose, my loopback interface on Ubuntu 12.04, I noticed that a lot of DNS queries (maybe ALL of them) have 127.0.0.1 as source and destination address.

Why?

P.S. I can find the same DNS queries, obviously, on the interface connected to the Internet.

share|improve this question
1  
Do you have dnsmasq installed? – page4096 Nov 6 '12 at 14:24
    
I have dnsmasq, but I don't know if it's active. – JustTrying Nov 6 '12 at 14:29
    
type in 'sudo /etc/init.d/dnsmasq status', if it's active, all DNS requests are forwarded to dnsmasq first, if the request is cached you'll get 0 ms query time, otherwise it gets forwarded to DNS servers, which will get cached. – page4096 Nov 6 '12 at 17:20
up vote 1 down vote accepted

Applications are querying a local resolver cache, which is then querying a remote resolver. Most likely, the local resolver is implementing a cross-application cache. That way, if two programs both resolve google.com, there won't be two remote requests.

share|improve this answer
    
Is it mandatory to query a local cache? Is it possible to query directly a DNS server on the web? I'm asking because I tried to DROP (using iptables) all the traffic but that outgoing from the interface connected to the Internet, and doing this I can't use a web browser because it makes DNS queries on local cache. – JustTrying Nov 6 '12 at 14:56
1  
Turn off nscd. Just stop the service. – David Schwartz Nov 6 '12 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .