Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sniffing (using Wireshark), for didactical purpose, my loopback interface on Ubuntu 12.04, I noticed that a lot of DNS queries (maybe ALL of them) have as source and destination address.


P.S. I can find the same DNS queries, obviously, on the interface connected to the Internet.

share|improve this question
Do you have dnsmasq installed? – page4096 Nov 6 '12 at 14:24
I have dnsmasq, but I don't know if it's active. – JustTrying Nov 6 '12 at 14:29
type in 'sudo /etc/init.d/dnsmasq status', if it's active, all DNS requests are forwarded to dnsmasq first, if the request is cached you'll get 0 ms query time, otherwise it gets forwarded to DNS servers, which will get cached. – page4096 Nov 6 '12 at 17:20
up vote 1 down vote accepted

Applications are querying a local resolver cache, which is then querying a remote resolver. Most likely, the local resolver is implementing a cross-application cache. That way, if two programs both resolve, there won't be two remote requests.

share|improve this answer
Is it mandatory to query a local cache? Is it possible to query directly a DNS server on the web? I'm asking because I tried to DROP (using iptables) all the traffic but that outgoing from the interface connected to the Internet, and doing this I can't use a web browser because it makes DNS queries on local cache. – JustTrying Nov 6 '12 at 14:56
Turn off nscd. Just stop the service. – David Schwartz Nov 6 '12 at 15:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.