Systemd-resolved plus LLMNR can create delays in name non-resolution

February 25, 2023

I recently switched my work and home desktops over to systemd-resolved from my previous tangle of an Unbound configuration. Some time later, on my home desktop I accidentally typo'd the name of a host I was trying to SSH to and discovered that there was an appreciable pause and delay before SSH gave up with 'no such host'. Some testing showed that I could reproduce this in other programs for any non-existent name with no dots in it, and helpfully it even reproduced with 'resolvectl query nosuchhost'.

Resolvectl itself doesn't have any sort of 'trace' or 'debug' option that will explain what it's doing during name resolution, but you can gingerly turn on debug logging for resolved with 'resolvectl log-level debug' (and then hastily turn it off afterward), and if you're lucky not too many other name resolutions will be going on at the same time. Eventually I was able to get lucky and track down what was going on, which was that systemd-resolved was trying to resolve these names by doing Link-Local Multicast Name Resolution (LLMNR) over my home machine's DSL PPPoE link. Naturally there was nothing responding to them, so resolved had to wait for a several-second timeout before it could declare that there was no such name out there. Turning LLMNR off on my PPPoE link made the delays go away, so now nonexistent names fail more or less immediately.

It's possible that if you set up a DSL PPPoE link with NetworkManager, NM will automatically tell resolved to not try LLMNR over the link. I don't use NM here (although I may need to switch someday), so my PPPoE link still had LLMNR enabled in resolved, although I'd turned off LLMNR for everything else. On my work desktop I explicitly configured LLMNR off globally in systemd-resolved, but I hadn't done that at home because it seemed possible that maybe I'd want it someday (that's now changed).

(As a system administrator, the idea that something on the network can just decide to start resolving names and get systems to listen to its views is not exactly a good thought. But things designed for home networks don't necessarily care about my opinions. On the other hand, Wikipedia tells me that the big user of LLMNR is Microsoft, and Microsoft is in process of phasing it out in favour of mDNS, which I already had off.)

I'll probably want to keep my eyes open for this happening on any machines I run systemd-resolved on. Although it doesn't seem to happen on another machine that does have LLMNR resolution enabled on its Ethernet link, so who knows; there may be other resolvectl things I have set that affect this. Whatever it is, I'm just happy that now my typos fail immediately.

Written on 25 February 2023.
« Thinking about what a 'VPN' solution is authenticating
Universities are often environments with distributed accounts and identities »

Page tools: View Source, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Sat Feb 25 22:15:40 2023
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.