Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!news.musoftware.de!wum.musoftware.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: MJ Newsgroups: comp.os.linux.networking Subject: Re: "Timeout" DNS IP to name resolution Date: 27 Jun 2012 07:44:42 GMT Lines: 41 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Trace: individual.net aFDb1eWlUB02Ft6tkAsSdgYVQf2aKFD3gPaOXnFtliBTyjhQ6XIJ97qgGxIM+WpgAV Cancel-Lock: sha1:zmsTRCVN3ten6MdRy/3oAKE3HOI= User-Agent: Pan/0.133 (House of Butterflies) Xref: csiph.com comp.os.linux.networking:1495 On Sat, 23 Jun 2012 17:56:22 +0000, buck wrote in js5006016b1@news1.newsguy.com : > I run a rather busy Apache web server with HostnameLookups On because > management wants it so. > > The problem is IP addresses that don't resolve. ... Management would be well-advised to allow you to use the Perl script named "jdresolve" to resolve IP addresses whenever any logfile analyses are needed, or subsets thereof. It can quickly recurse through any addresses to resolve domains for which A or PTR records don't exist (such as your point of failure), e.g.: $ echo 192.168.1.254 | jdresolve -n -a -r - 192.168.1.254.starband.com $ echo 123.45.67.89 | jdresolve -n -a -r - 123.45.67.89.dns.kr or entire files: # jdresolve -r -n -a /var/log/apache.log > /tmp/resolved.apache.log Your management will be highly pleased with your creative shell-scripted uses of the program, I promise. An example "probe_report" script output of dropped, logged, unsolicited packets from iptables: # /usr/local/bin/probe_report Resolved_Address Packets Bytes Protocol(s) Dest.Port(s) 195.161.40.7.rt-comm.ru 1 28 ICMP 211.147.3.19.datadragon.net 1 44 TCP 22 acyv254.neoplus.adsl.tpnet.pl 1 44 TCP 110 192.168.1.99.starband.com 210 82600 UDP 631 59.108.123.83.in-addr.cn 1 44 TCP 8080 _____________________________________________________________ Totals 214 80.8KB for search pattern "UNSOLICITED"