First, pardon my ignorance, as I'm still getting acclimated to working with DNS. I'm a networking newbie.
The basic question: How do I determine the source of a DNS record? Or, it may be more accurate to ask: how do I determine where on my network a hostname is being translated into an IP?
- Actiontek MI424WR-GEN3I (provided as part of FiOS service)
- MacBookPro running OS X Yosemite
- VMWare Fusion
- Ubuntu 14 Server running on VMWare virtual machine
Scenario: I am on a Mac running OS X Yosemite with Ubuntu 14 running in a VMWare virtual machine. I am learning the ropes on setting up a Drupal site (not specifically relevant to the problem), and I've set up virtual hosts on the Ubuntu server. Taking it as a baby-steps process, I first created an entry in my hosts file: 192.168.1.22 cwb1.local
This worked fine, so I got a little more ambitious and removed this hosts file entry and created a DNS entry on my router, pointing the hostname cwb1.local to the IP 192.168.1.22. This seemed to have worked just fine as well. The mystery is that I have since removed this DNS entry and now, as far as I can tell, have no record associating this hostname and IP with each other, yet two strange things happen:
- I can ping the hostname and successfully return the IP
- I can navigate to http://cwb1.local in my browser and access my Drupal site.
I've cleared my browser's cache and run dscacheutil -flushcache on my mac, even reset my server, and still I can't determine how/why my mac knows to associate this host name and IP together.
Diagnostics: * note, the VM running this server is listed in my router's DHCP connections as 'ubuntu'
MAC:~ me$ nslookup 192.168.1.22 Server: 192.168.1.1 Address: 192.168.1.1#53 126.96.36.199.in-addr.arpa name = ubuntu.home. MAC:~ me$ nslookup cwb1.local Server: 192.168.1.1 Address: 192.168.1.1#53 ** server can't find cwb1.local: NXDOMAIN MAC:~ me$ dig cwb1.local ; <<>> DiG 9.8.3-P1 <<>> cwb1.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 53342 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;cwb1.local. IN A ;; Query time: 49 msec ;; SERVER: 192.168.1.1#53(192.168.1.1) ;; WHEN: Sat Jan 17 20:53:36 2015 ;; MSG SIZE rcvd: 28 MAC:~ me$ dig 192.168.1.22 ; <<>> DiG 9.8.3-P1 <<>> 192.168.1.22 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 60811 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;192.168.1.22. IN A ;; AUTHORITY SECTION: . 10800 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2015011701 1800 900 604800 86400 ;; Query time: 50 msec ;; SERVER: 192.168.1.1#53(192.168.1.1) ;; WHEN: Sat Jan 17 21:01:59 2015 ;; MSG SIZE rcvd: 105
Contents of /etc/apache2/sites-available/html.conf
<VirtualHost *:80> DocumentRoot /var/www/html ServerName drupal7 </VirtualHost> <VirtualHost *:80> DocumentRoot /var/www/html ServerName cwb1.local ServerAlias cwb1.local *.cwb1.local </VirtualHost>
Can anyone lend me some guidance here?
Edit After Romeo's comment, I revisited my /etc/hosts file and tried something out: I added a new entry for cwb1.local to an IP that is not present on my network (192.168.1.23). Upon pinging cwb1.local, it resolves to 192.168.1.23 (as expected), and each req times out (also as expected). The interesting part is that I removed this entry from my /etc/hosts file, then ran:
- dscacheutil -flushcache
- sudo discoveryutil mdnsflushcache
- sudo discoveryutil udnsflushcaches
and still get the same results: the host name resolves, but packets time out.
So, is my Mac propagating/mirroring this information elsewhere as well? Or is there some sort of buffer that isn't purged with the cache clearing commands above?
Edit 2 So, upon reboot, the host name record seems to have finally disappeared. This indicates pretty strongly that the phantom record is being stored on my Mac. But where/how does this phantom DNS record get stored prior to reboot? How can I ensure in the future that I'm getting accurate DNS information without requiring a reboot?
Again, my thanks to all who can lend some insight!