Understanding why hostname -i returns strange IP address

Question

I am referencing the following question because it's similar but not the same:

• hostname -i returns strange result in linux

On my CentOS 7 system, I get a strange IP address from "hostname -i" after I change my hostname, and I am trying to figure out why this is the case.

I change the hostname with following command:

# hostnamectl set-hostname saturn
# systemctl restart systemd-hostnamed

My /etc/hosts file shows:

 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

The following is in my /etc/nsswistch.conf file:

hosts:      files dns myhostname

My server IP address is 192.168.1.13, but "hostname -i" returns strange a IP address:

# hostname -i
92.242.140.21

However, "hostname -I" is fine:

# hostname -I
192.168.1.13

Why does hostname -i return 92.242.140.21. Is it a random dynamic IP assigned to my system by the DNS? Can someone explain? Thanks!

Solution

Unlike the hostname -I command, which just lists all configured IP addresses on all network interfaces, the hostname -i command performs name resolution (see the hostname man page).

Since your newly assigned hostname cannot be resolved using the /etc/hosts file, running hostname -i will cause your system's name resolver to generate a DNS query to an external DNS server. At this server (which I presume belongs to your ISP), this query comes up empty (NXDOMAIN result: i.e. non-existent domain). Because your ISP has partnered up with Barefruit, rather than receiving the NXDOMAIN result, you receive a Barefruit IP address in response to your query:

$ dig +short -x 92.242.140.21
unallocated.barefruit.co.uk.

I imagine that adding your new hostname to your /etc/hosts file will make the weird Barefruit IP address disappear when you run the hostname -i command. If not, you may disregard this answer : )

---

Just for the fun of it: using the dig command, you can interrogate different name servers. To see the difference in response, you could run the following two commands:

$ dig saturn
$ dig @8.8.8.8 saturn

The first causes name resolution via your system's preconfigured DNS server, and likely results in a Barefruit IP address being returned. The second command asks Google Public DNS to resolve the name, and returns with an NXDOMAIN status. Or not?

If so, your ISP may be involved in the dubious practice of DNS hijacking, and you may want to figure out if there is an opt-out possibility, or change your DNS service provider.

Comments

[s2000coder]

@Christopher It's the default configuration on CentOS 7, I just left it there. Does it affect the hostname command? According to this, it's only used as fallback: unix.com/man-page/centos/8/nss-myhostname. Also, hostname -f returns "saturn".

[ctrl-alt-delor]

Related: askubuntu.com/q/587895/10473

[Rui F Ribeiro]

what happens with ping saturn?

[s2000coder]

thanks for the explanation. I tried everything you suggested and and the results are as you said. I accepted your answer. One quick question. How do edit the /etc/hosts file so that the barefruit IP address disappears? How should I add "saturn" into the /etc/hosts? Should it be on a new line, different from the localhost? What's the rule of thumb for editing the /etc/hosts file?

[ozzy]

@s2000coder Indeed, that is what you could do. E.g. enter a new line reading something like 192.168.1.13 saturn (assuming you have a static local IP address). Otherwise, you could just add 'saturn' to the lines already listed in your hosts file starting with 127.0.0.1 and ::1. See man hosts for the rules of thumb.