Thought I would also chime in. Seeing the same as well, also setup a caching Bind server to see if that would speed things up, and it didn't. Just my two cents.
Cheers, Eric On Mon, Oct 10, 2011 at 11:05 AM, Gary Gatten <[email protected]> wrote: > Lol! I have dns issues, but different than your. If I rul more than a > sinle resolution thread ntop will die a horrible death. > > There's no dnscache.db for some time now. If u want caching try a caching > resolver. I used bind. > > What do you want to start from scratch? There's no caching or other > history related to resolution. > > After reviewing your problem it seems to be something with your dns and/or > local resolver conf. What exactly is the issue? > > ----- Original Message ----- > From: Charles Gagnon [mailto:[email protected]] > Sent: Monday, October 10, 2011 12:57 PM > To: [email protected] <[email protected]> > Subject: Re: [Ntop] DNS Resolution half working > > Nobody has DNS resolition issues? > > Did something replace dnsCache.db? Which of the DB files would I need > to restart from scratch? > > On Wed, Sep 28, 2011 at 7:32 AM, Charles Gagnon <[email protected]> > wrote: > > These are all private servers. We use private addresses inside and NAT > > out to the internet. All my servers use internal DNS servers. I have > > /etc/resolv.conf setup as it should and nsswitch.conf says: > > > > hosts: files nis dns > > > > So I'm thinking gethostbyaddr() should work fine. I feel like > > resolution was attempted at some point and results were cached and now > > it's not retrying. But I can't find "dnsCache.db" yet the man page > > still refers to it. > > > > I started with: > > > > # ntop -P /usr/local/var/ntop -u ntop -d > > > > And this is what I have: > > > > [root@sys1 ~]# ls -l /usr/local/var/ntop/ > > total 2072 > > -rw-r----- 1 ntop ntop 225280 Sep 27 09:20 fingerprint.db > > -rw-r----- 1 ntop ntop 1986634 Sep 26 12:55 macPrefix.db > > -rw-r----- 1 ntop ntop 12546 Oct 21 2010 ntop_pw.db > > -rw-r----- 1 ntop ntop 14094 Sep 27 09:20 prefsCache.db > > drwxrwxrwx 5 ntop ntop 4096 Oct 21 2010 rrd > > > > > > On Tue, Sep 27, 2011 at 10:24 PM, Burton Strauss III > > <[email protected]> wrote: > >> 192.168.x.x/16 is the private space (RFC 1913). So no public facing DNS > >> server would resolve those. It would only be resolved if you were > pointing > >> to your internal DNS server AND it was setup to manage the specific > zone. > >> So the question is where is nslookup getting names from? > >> > >> > >> > >> -----Burton > >> > >> %QUOTE% > >> > >> -----Original Message----- > >> From: [email protected] > >> [mailto:[email protected]] On Behalf Of Charles Gagnon > >> Sent: Tuesday, September 27, 2011 1:12 PM > >> To: [email protected] > >> Subject: [Ntop] DNS Resolution half working > >> > >> I searched for references and I can't find what this error could be. > >> When listing hosts (specially in the throughput list I use a lot), some > >> hosts get resolved and others don't and I can't figure out why. > >> I've setup DNS resolution to 'All' (though I tried "local" and "Local > >> + Remote"). > >> > >> When I look at the list, a number of items have names, others should the > IP > >> with "[IP]" after. Seems very consistent, the same hosts are resolved > and > >> the same show IPs between restarts. > >> > >> I was thinking of flushing out dnsCache.db but I don't that exists in > >> 4.1.0 (gone since 3.x maybe?). > >> > >> When I dump the hosts, I see some with names and others without: > >> > >> 192.168.206.11|0|'192.168.206.11'|'192.168.206.11'|[...] > >> 192.168.206.10|0|'192.168.206.10'|'hhnas01'|[...] > >> 192.168.206.13|0|'192.168.206.13'|'192.168.206.13'|[...] > >> 192.168.206.12|0|'192.168.206.12'|'192.168.206.12'|[...] > >> 192.168.206.15|0|'192.168.206.15'|'hhutil01'|[...] > >> 192.168.206.14|0|'192.168.206.14'|'192.168.206.14'|[...] > >> > >> Any ideas? Any other "cache" I can get rid of. Testing with nslookup > yields > >> a name for all those IPs. > >> > >> -- > >> Charles Gagnon > >> charlesg at unixrealm.com > >> _______________________________________________ > >> Ntop mailing list > >> [email protected] > >> http://listgateway.unipi.it/mailman/listinfo/ntop > >> > >> _______________________________________________ > >> Ntop mailing list > >> [email protected] > >> http://listgateway.unipi.it/mailman/listinfo/ntop > >> > > > > > > > > -- > > Charles Gagnon > > charlesg at unixrealm.com > > > > > > -- > Charles Gagnon > charlesg at unixrealm.com > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > > > > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in > 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop >
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
