Why do changes to /etc/hosts take effect immediately?
The magic is opening the /etc/hosts
file and reading it:
strace -e trace=file wget -O /dev/null http://www.google.com http://www.facebook.com http://unix.stackexchange.com 2>&1 | grep hosts
open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 4
open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 5
open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 4
The getaddrinfo(3)
function, which is the only standard name resolving interface, will just open and read /etc/hosts
each time it is called to resolve a hostname.
More sophisticated applications which are not using the standard getaddrinfo(3)
, but are still somehow adding /etc/hosts
to the mix (e.g. the dnsmasq
DNS server) may be using inotify(7)
to monitor changes to the /etc/hosts
files and re-read it only if needed.
Browsers and other such applications will not do that. They will open and read /etc/hosts
each time they need to resolve a host name, even if they're not using libc's resolver directly, but are replicating its workings by other means.
Name resolution, amongst other things, is managed by /etc/nsswitch.conf
. Here is an excerpt:
passwd: files sss
shadow: files sss
group: files sss
hosts: files dns myhostname
(...)
Note the hosts
line. It says: "When resolving a hostname, first read /etc/hosts
file to lookup the hostname, if not found then run a DNS query, if not found then try the locally configured system hostname".
So here's why it is so fast. Note that it does not depend on the network services on the machine, so there's no service to restart or reload.