Re: skipping not 'usefull' ip addresses of a dns lookup

On 8/25/23 2:24=E2=80=AFAM, Marc wrote:
> Hi Grant!

Hi Marc,

Real quickly, not having re-read my previous response and had way too=20
much water under the bridge between then and now.

> I was just 'cleaning up' a bit an ubuntu server from unnecessary=20
> running processes. Now I have some external auth that is sometimes=20
> slow due to the fact that the external auth host has two ip addresses=20
> configured. One of those ip addresses is not reachable from my=20
> ubuntu server.

The first thing that comes to mind is the "auth" a.k.a. "ident" service=20
that runs on TCP port 113.  Though I'd be surprised if you actually had=20
an ident daemon running.

Is there a chance that you inadvertently changed incoming and / or=20
outgoing firewall config to filtered ident requests / replies and / or=20
TCP resets / ICMP unreachable messages therefor?

Lack of response to ident requets can cause a delay in services.  This=20
could happen by blocking any of the following:
  - outgoing locally generated requests
  - incoming remotely generated replies
  - incoming TCP reset
  - incoming ICMP unreachable message

  - incoming remotely generated requests
  - outgoing locally generated replies
  - outgoing TCP reset
  - outgoing ICMP unreachable message

> Do you know if there is currently something client side that actively=20
> addresses this issue of having applications assigned ip addresses on=20
> different networks?

I'm going to need more context.  --  Maybe it's in the part of the=20
thread that I've not read recently enough.

I'm trying to get a reply out to you quickly.

> I don't think I noticed this behaviour before my changes, could there=20
> be something smart in neworkmanager/systemd?

Any time that you question a network related change impacting services,=20
my go to solution is a network sniffer, tcpdump on CLI or Wireshark in=20
GUI.  (Sometimes both, capture on remote CLI and analyze locally in GUI.)



--=20
Grant. . . .