0

Via a long chain up of OS upgrades I'm running macOS Sierra 10.12.5.

Setting entries in my /etc/hosts file is working only occasionally, mostly not.

For example on a freshly rebooted machine. With the only networking set to Wifi.

Everything is unmodified and fine:

bash-3.2$ grep facebook.com /etc/hosts
# 127.0.0.1 facebook.com
bash-3.2$ sudo killall -HUP mDNSResponder
bash-3.2$ dscacheutil -q host -a name facebook.com
name: facebook.com
ipv6_address: 2a03:2880:f127:283:face:b00c::25de

name: facebook.com
ip_address: 157.240.18.35

bash-3.2$ host facebook.com
facebook.com has address 157.240.18.35
facebook.com has IPv6 address 2a03:2880:f127:283:face:b00c::25de
facebook.com mail is handled by 10 msgin.vvv.facebook.com.

But then I uncomment that line for facebook, and I get this:

bash-3.2$ grep facebook /etc/hosts
127.0.0.1   facebook.com
bash-3.2$ sudo killall -HUP mDNSResponder
bash-3.2$ dscacheutil -q host -a name facebook.com
name: facebook.com
ipv6_address: 2a03:2880:f127:283:face:b00c::25de

name: facebook.com
ip_address: 127.0.0.1

bash-3.2$ host facebook.com
facebook.com has address 157.240.18.35
facebook.com has IPv6 address 2a03:2880:f127:283:face:b00c::25de
facebook.com mail is handled by 10 msgin.vvv.facebook.com.

I don't observe anything suspicious in the output of scutil --dns. The dig command and chrome both seem immune to the /etc/hosts change.

help?

  • host, dig and Google Chrome don't proceed along the common macOS DNS resolution path - so there is nothing wrong with your result... – klanomath Jun 14 '17 at 20:59
1

This command will tell you which process is making the changes to your hosts file:

sudo dtrace -qn 'syscall::open*:entry /arg1&3/ { printf("%d %s %s\n", pid, execname, copyinstr(arg0)); }' | grep hosts
  • Very cool trick. But, I have no reason to suspect anybody is modifying my /etc/host files, except me. The problem is that my edits are not propagating to all the actors who query dns. – Ben Hyde Jun 14 '17 at 20:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .