resolving onion domains partially fails

Question

Init:

1. For user anonymous configured transpared proxy.
2. Wireshark sniffing lo...
3. Trying to use console network-tools torified.

anonymous@kali:/tmp$ time strace -s6000 -t -f dig facebookcorewwwi.onion > dig.strace 2>&1

• pastebin.com/it1tk8jQ - visible in wireshark.

anonymous@kali:/tmp$ time strace -s6000 -t -f host facebookcorewwwi.onion > host.strace 2>&1

• pastebin.com/EgWWsM55 - not visible.

anonymous@kali:/tmp$ time strace -s6000 -t -f wget -O - facebookcorewwwi.onion > wget.strace 2>&1

• pastebin.com/cB1dSHDd - not visible. (Optional, just for being)

Means, only dig given valid IP-Address from VirtualAddrNetwork from torrc:

VirtualAddrNetwork 172.16.0.0/12 # private network 10.x.x.x is not available
AutomapHostsOnResolve 1

Other tools hanged. Retried to reconnect to DNS-servers couple of times, thereafter broke with connection timed out; no servers could be reached or something like that.

However, I did not seen anything in Wireshark. Only dig was highlighted with specified DNS request redirected by iptables to loop-back interface 53 port.

What is strange, both dig and host are using the same functions with the same flags:

dig:

[pid 10713] 06:41:58 sendmsg(20, {msg_name(16)={sa_family=AF_INET, 
sin_port=htons(53), sin_addr=inet_addr("10.99.248.2")}, msg_iov(1)=[{"<\331\1 
\0\1\0\0\0\0\0\1\20facebookcorewwwi\5onion\0\0\1\0\1\0\0)\20\0\0\0\0\0\0\0", 51}],
msg_controllen=0, msg_flags=0}, 0) = 51

host:

[pid 10394] 06:41:38 sendmsg(20, {msg_name(16)={sa_family=AF_INET, 
sin_port=htons(53), sin_addr=inet_addr("10.99.248.2")}, msg_iov(1)=[{"9\307\1
\0\0\1\0\0\0\0\0\0\20facebookcorewwwi\5onion\0\0\1\0\1", 40}],
msg_controllen=0, msg_flags=0}, 0 <unfinished ...>

Only payloads are little bit different.

My question is about this pastebined logs: Where is this place in log which is wrong for host and right for dig???? Because I'm not seeing anything. bind, sendmsg, socket, etc - everything seems are equivalent.

Why does dig working, resolving onion domain into ip address but host, wget, nslookup, chromium... and other doesn't? Most of mysterium with onion domains only. Every other domains are resolving successfully and highlighted on lo side in Wireshark successfully by any network-tool or even chromium...

Probably, it is because dig is most robust tool to resolve ip addr, then what is wrong with other? Why are they not so smart?

Answer 1

If you're using a standard setup with local DNS server located on your very PC - it caches the response locally inside the server, so no second request is made. If you have more questions - feel free to ask!