ping for one domain gets replies from an unrelated host — diagnose the cause
A user reports that pinging one company's domain returns replies that clearly come from a completely different organisation's server. From the output below, explain how this is possible and how you would confirm and fix it on the host.
$ ping shop.example.com
PING shop.example.com (203.0.113.99) 56(84) bytes of data.
64 bytes from 203.0.113.99: icmp_seq=1 ttl=58 time=11 ms
# but 203.0.113.99 is a server belonging to a DIFFERENT company
$ nslookup shop.example.com → Name: shop.example.com Address: 198.51.100.4 (the REAL IP)Diagnose the cause and the fix.
Name resolution is overridden locally. ping resolves the name through nsswitch.conf, which usually checks /etc/hosts before DNS — so a static entry there (mapping shop.example.com to the wrong IP) wins over the real DNS answer. The mismatch between ping's IP and nslookup's confirms it, since nslookup queries DNS directly. Fix: clean /etc/hosts and audit how the rogue entry appeared.
- ✗Forgetting
/etc/hostsis consulted before DNS viansswitch.conf - ✗Not noticing
nslookup(DNS-direct) disagreeing withpingpinpoints the cause - ✗Blaming the remote DNS server when the override is local
- →How does
nsswitch.confdecide the order offiles(hosts) versusdns? - →Why should an unexpected
/etc/hostsentry be treated as a security incident?
Solution
ping does not query DNS directly — it uses the system resolver per nsswitch.conf, typically hosts: files dns, meaning /etc/hosts is checked before DNS.
$ getent hosts shop.example.com # shows how the system resolves the name
$ grep shop.example.com /etc/hosts # finds the static override entrySince ping uses 203.0.113.99 but nslookup (which goes straight to DNS) returns 198.51.100.4, the name is being overridden locally by an /etc/hosts entry.
Fix: remove the rogue line from /etc/hosts. An unexpected entry warrants treating this as possible tampering (phishing/MITM): find out who added it and when.
