Can I profile a DNS lookup in OSX?

I have a latency issue on certain requests to an address on localhost. I suspect there's something going on with the DNS lookup.

Is there a way that I can profile DNS lookup on OSX? For example, is there a log I can watch as it tries to do the lookups?

Nathan Long

Posted 2013-02-05T18:14:14.760

Reputation: 20 371

Answers

You could just run tcpdump to dump DNS packets and look at how DNS traffic is behaving. Something like the following, entered in Terminal, should do the trick:

sudo tcpdump -i en0 -n udp port 53

The -i en0 should reference your active interface. On Macs, this is usually en0, but if you have both an ethernet jack and a wireless adapter, you might need to use en1. This will produce output like (I've wrapped long lines for clarity):

22:19:46.160992 IP 192.168.1.143.61150 > 192.168.1.1.53:
  60237+ A? www-google-analytics.l.google.com. (51)
22:19:46.184272 IP 192.168.1.1.53 > 192.168.1.143.61150:
  60237 11/0/0 A 74.125.225.233, A 74.125.225.238, A 74.125.225.224,
  A 74.125.225.225, A 74.125.225.226, A 74.125.225.227, A 74.125.225.228,
  A 74.125.225.229, A 74.125.225.230, A 74.125.225.231, A 74.125.225.232 (227)

This dump shows a request from my machine to my router (192.168.1.143 > 192.168.1.1) at 22:19:46.160992. My router replied back at 22:19:46.184272 with the response. So this DNS request took about 23ms.

If you suspect a DNS performance problem, run the tcpdump command and look for the DNS requests for the server which interests you. If you see a long delay or several tries, then you know you have a problem.

hrunting

Posted 2013-02-05T18:14:14.760

Reputation: 371

I think its -i eth0 for regular linux. :+1: – ThorSummoner – 2015-06-16T17:36:02.117

I have a latency issue on certain requests to an address on localhost.

When you say "localhost" do you really mean localhost? as in 127.0.0.1 or ::1?

You can use tcpdump to look for resolver traffic as the previous poster has suggested but if you literally mean localhost there's a quite good chance the name isn't even being resolved using DNS.

Michael McNally

Posted 2013-02-05T18:14:14.760

Reputation: 303

I do mean localhost as you said. However, because I have several apps running locally, I access it via something like fooapp.local, which should be resolved to localhost. Our in-office DNS resolves that address to 127.0.0.1 and I also have an entry in /etc/hosts. Actually, two entries: one for IPv4 and one for IPv6. – Nathan Long – 2013-02-07T13:13:45.530

If it's in your hosts file, then the stub resolver is probably not using DNS. However, I am not positive about the resolution order used by MacOS 10.8's stub resolver so it would be best to check (using the tcpdump method suggested by hrunting.) – Michael McNally – 2013-02-07T17:42:37.753