Newsgroups: comp.security.ssh
> I installed openssh 2.1.1 a while ago, but recently I noticed an > unacceptable delay while connecting to other hosts:
Run the client under strace and see what it's doing during the delay. One possibility is a DNS timeout; is there any trouble reverse-mapping the server IP addresses in these cases?
Richard Silverman
> socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 sendto(3, > "t\32\1\0\0\1\0\0\0\0\0\0\nmyserver\7mydomain\2"..., 39, 0, > {sin_family=AF_INET, sin_port=htons(53), > sin_addr=inet_addr("131.1xx.xx.xx")}}, 16) = 39 time(NULL) = > 971578662 poll( <unfinished ...>
> It looped to do the 'poll' and waited there. Can somebody > interpret the above to me in English? What does it imply? What > next should I look into? Thanks!
This is the SSH client attempting to query the DNS about the name "myserver.mydomain", probably to look up an address. It's sending the DNS queries to a nameserver on "131.1xx.xx.xx", and apparently not getting a response. Check that this makes sense — are there nameservers on that/those address(es)? If not, check your /etc/resolv.conf file. If you intend to be using them, perhaps they're not running, or you have a firewall blocking the queries or responses.
You can use "tcpdump -s1024 port 53" (run as root) to capture the DNS traffic as you run the client, along with responses and a basic interpretation of their contents; this may help understand what's going on.
Richard Silverman