Re: Systems-resolved: Calling gethostbyaddr on non-local/non-private causes connection attempt

I tried this on a fresh installation of Fedora Workstation 39. I installed wireshark and set the filter to `tcp.port == 5355` then ran the python script again with an ip of `123.123.123.123` and I see an outbound connection attempt to IP 123.123.123.123 on port 5355.

Hope that helps,

Anthony

From: Anthony Fuller (TR-NA) <Anthony_Fuller@xxxxxxxxxxxxxx>
Date: Friday, February 23, 2024 at 10:22 AM
To: Cristian Rodríguez <crrodriguez@xxxxxxxxxxxx>
Cc: systemd-devel@xxxxxxxxxxxxxxxxxxxxx <systemd-devel@xxxxxxxxxxxxxxxxxxxxx>
Subject: Re: [systemd-devel] Systems-resolved: Calling gethostbyaddr on non-local/non-private causes connection attempt

Hi Cristian,

Below is my complete /etc/nsswitch.conf file.

Have you tried any other IP addresses by chance? I noticed that some IPs do not exhibit this behavior such as 1.1.1.1 and 8.8.8.8.

I’m also willing to see if this behavior exists outside Debian, maybe it’s a default Debian configuration causing this.

Thanks,

Anthony

```

user@debian12:~$ cat /etc/nsswitch.conf

# /etc/nsswitch.conf

# Example configuration of GNU Name Service Switch functionality.

# If you have the `glibc-doc-reference' and `info' packages installed, try:

# `info libc "Name Service Switch"' for information about this file.

passwd: files systemd

group: files systemd

shadow: files systemd

gshadow: files systemd

hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname

networks: files

protocols: db files

services: db files

ethers: db files

rpc: db files

netgroup: nis

```

From: Cristian Rodríguez <crrodriguez@xxxxxxxxxxxx>
Date: Friday, February 23, 2024 at 10:07 AM
To: Anthony Fuller (TR-NA) <Anthony_Fuller@xxxxxxxxxxxxxx>
Cc: systemd-devel@xxxxxxxxxxxxxxxxxxxxx <systemd-devel@xxxxxxxxxxxxxxxxxxxxx>
Subject: Re: [systemd-devel] Systems-resolved: Calling gethostbyaddr on non-local/non-private causes connection attempt

This message was sent from outside of Trend Micro. Please do not click links or open attachments unless you recognise the source of this email and know the content is safe.

On Thu, Feb 22, 2024 at 8:13 PM Anthony_Fuller@xxxxxxxxxxxxxx
<Anthony_Fuller@xxxxxxxxxxxxxx> wrote:

I tried again now with packet capture software and no such behaviour
was found. ..what you have in the hosts line of nsswitch.conf ?

The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

For details about what personal information we collect and why, please see our Privacy Notice on our website at: Read privacy policy