| 2009-01-21 00:56:36 |
gjarboni |
description |
Description:
When the user is doing "ping -f myhostname.tld", ping does a ipaddr->hostname request at EACH packet. Which is quite a lot when used with a -f option.
Moreover it is quite useless as when used with -f, ping doesnt display the result of the ipaddr->hostname, but only a single dot per packet.
- I discovered this when implementing a nss plugin (/etc/nsswitch.conf kindof stuff).
- I dunno the actual impact of this, just seems like very inefficient.
- But if the nss plugin doesn't have an request cache, this will become quite a
denial of service for this service |
Description:
When the user is doing "ping -f myhostname.tld", ping does a ipaddr->hostname request at EACH packet. Which is quite a lot when used with a -f option.
Moreover it is quite useless as when used with -f, ping doesnt display the result of the ipaddr->hostname, but only a single dot per packet.
- I discovered this when implementing a nss plugin (/etc/nsswitch.conf kindof stuff).
- I dunno the actual impact of this, just seems like very inefficient.
- But if the nss plugin doesn't have an request cache, this will become quite a
denial of service for this service
-gjarboni's addition--
Actually, this can be a lot worse in certain cases. For example, try pinging dnstest.bigjar.com. You can't reproduce this in text but what happens is:
Pinging machine sends out ICMP echo request
Pinging machine sends out in-addr.arpa DNS query (ip address -> DNS name)
Pinging machine receives NXDOMAIN (no such record) from DNS server
------ 5 to 10 seconds pass ------
Pinging machine prints:
64 bytes from 12.173.97.1: icmp_seq=1 ttl=252 time=20.9 ms
This happens for every packet. If you interrupt ping during the 5 to 10 second period it will print the "64 bytes from ..." bit before returning to the shell prompt.
I shudder to imagine someone trying to walk a user through testing connectivity with this bug. It also occurs in Debian 4.0.
I have packet traces and a much more detailed write up if anyone is interested. This bug doesn't happen with all IP addresses that don't have a hostname associated with them, just certain ones, but it appears to specific to certain name servers. |
|
