DNS cache in Ubuntu?

[Werner Schram]

Ryan Chan schreef:
> Hello,
>
> On Sat, Dec 5, 2009 at 1:48 AM, Tom H <tomh0665 at gmail.com> wrote:
>   
>>>> Is your question related to bind or djbdns? Or is it related to browsers?
>>>>         
>>> Ubuntu network feature, e.g. ping is using old DNS cache.
>>>       
>> Install nscd
>> aptitude install nscd
>>
>> To flush
>> invoke-rc.d nscd restart
>>
>>     
>
> I have not installed nscd, so just wonder why caching happen.
>
>   
The linux kernel does not cache dns queries, you need a userspace
application like nscd for that. If you do not have that installed, your
queries should not be cached. You can check whether you are using a
cache or not by running tcpdump (install via synaptec or apt-get) in one
terminal:

sudo tcpdump -s1024 port domain

and running your ping command in another terminal. If you ping
www.google.com and you get an output similar to this (in the tcpdump
terminal) your queries are not cached:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 1024 bytes
15:04:30.869872 IP 192.168.1.10.35930 > 192.168.1.1.53: 5192+ A?
www.google.com. (32)
15:04:30.895855 IP 192.168.1.1.53 > 192.168.1.10.35930: 5192 4/0/0 CNAME
www.l.google.com., A 74.125.77.147, A 74.125.77.99, A 74.125.77.104 (100)
15:04:30.925149 IP 192.168.1.10.34416 > 192.168.1.1.53: 33260+ PTR?
147.77.125.74.in-addr.arpa. (44)
15:04:30.959964 IP 192.168.1.1.53 > 192.168.1.10.34416: 33260 1/0/0 PTR
ew-in-f147.1e100.net. (78)
15:04:31.925302 IP 192.168.1.10.46079 > 192.168.1.1.53: 52166+ PTR?
147.77.125.74.in-addr.arpa. (44)
15:04:31.950329 IP 192.168.1.1.53 > 192.168.1.10.46079: 52166 1/0/0 PTR
ew-in-f147.1e100.net. (78)
...

Could you test that?

Werner