Using Tcpdump to See Background DNS Requests

This post explains how to use tcpdump on Linux to detect and investigate DNS requests. One of our Red Hat client systems was making requests to an old DNS server, even though it had been adjusted, through a change to/etc/resolv.conf, to point to a new one.

Requests to the old server were identified as follows.

[root@pluto root]# tcpdump -i eth0 -l -vvv dst host and dst port 53
(...waited 15 mins or so...)
tcpdump: listening on eth0
16:38:18.019703 > [bad udp cksum 48f5!]  21331+ A? (42) (DF) (ttl 64, id 48623, len 70)
16:38:18.033461 > [bad udp cksum 5919!]  12099+ A? (42) (DF) (ttl 64, id 48625, len 70) is the ip address of the old DNS server. Tcpdump shows network packets sent to the standard DNS port (53) at that IP address. Requests were few so I had to wait 15 or 20 minutes to capture the above.

The client was last rebooted a year ago, many months before /etc/resolv.conf was last edited. Tcpdump shows that some application is still querying the old server. The fix was to reboot the client, restarting the erroneous application and stopping the outdated requests.

Profiling and Tracing Processes in Linux

This article shows how a Linux process can be traced and profiled. Using the “last” command as an example, profiling is used to explain why a process was very slow, and why another, very similar, process (dump-utmp) was much faster. “Tracing” here means seeing what a process is doing at any moment. “Profiling” means showing (afterwards) how long it spent doing different things.

Last” is a Linux command that reads and summarizes the utmp file, where login records are stored. I had a “last” command taking hours to complete because the utmp file had grown large (1.9 Gb). Used strace to see what it was doing. Continue reading

RPM Spec Files

Information on RPM spec files is hard to come by. Here’s what I have. It isn’t much but might help somebody trying to build an RPM package for the first time. See also

What the Spec File Does Overall

The spec file is used by the “rpmbuild” command to create a distributable RPM file for a piece of software. The “software” can be a large application including source code, or it might just be the application binary files, or even just a script or two.

The RPM file is a single file containing the software and scripts needed to install/uninstall it on a target system. Continue reading