n resolve

5-layer name cache debugger & ghost IP detection

Usage — n resolve

═══════════════════════════════════════════════════════════════════════════════
  Netscrew ("n") — resolve (r, res, resolv) — 5-layer name-resolution audit & stale 'ghost IP' detection
═══════════════════════════════════════════════════════════════════════════════

USAGE:
  n r <host>                           DNS, mDNS, NetBIOS, hosts file & Samba cache, side by side
  n r .                                audit how THIS machine resolves its own name

Target: . = this machine · <host> = remote
Deeper: n r -h = the concept/theory behind this command

The concept behind it — n resolve -h

═══════════════════════════════════════════════════════════════════════════════
  NETSCREW GUIDE: NetBIOS, WINS & Exorcising Stale Ghost IPs ("n -h wins")
═══════════════════════════════════════════════════════════════════════════════

HOW PEER-TO-PEER RESOLUTION WORKS (WITHOUT DNS!):
  In the 1990s, Microsoft created NetBIOS over TCP/IP (RFC 1001/1002) so PCs
  could discover each other on a LAN without needing a dedicated DNS server:
  1. Linux broadcasts: "Who has the name 'YOR'?" on UDP port 137.
  2. The target Windows machine responds directly on UDP 137: "I am YOR at 192.168.1.29!"
  3. No central DNS required—zero-config, dynamic, and works across mixed OSes.

THE 5 LAYERS OF THE STALE GHOST IP BUG:
  Why does Linux cling to an old DHCP IP (e.g. .246 instead of .29)?
  1. systemd-resolved cache: Stub resolver caches NSS and DNS results in memory.
  2. Samba gencache.tdb: Internal NetBIOS name cache stored in /var/lib/samba/*.tdb.
     CRITICAL: This cache database PERSISTS ACROSS REBOOTS!
  3. nscd (Name Service Cache): Caches getaddrinfo / NSS lookups on disk.
  4. Kernel ARP Table: Holds stale IP → MAC address mappings in kernel memory.
  5. Windows Multi-Registration: Windows may announce multiple IPs across adapters.

NETSCREW DIAGNOSTICS & REMEDIATION:
  • n resolve <HOST>       Query all 6 layers side-by-side in <150ms to spot desyncs:
                         - Static hosts file (/etc/hosts)
                         - NetBIOS / WINS (UDP 137 on-the-wire broadcast)
                         - mDNS / Bonjour (UDP 5353)
                         - Unicast DNS (Router / Nameserver)
                         - System Runtime (getent / NSS)
                         - Kernel ARP cache table
  • sudo n flush           Deep cache flush: stops daemons, unlinks all .tdb
                         database files, clears nscd, flushes ARP, and restarts services.
  • n flush (Windows)      Flushes DNS, re-registers NetBIOS (nbtstat -RR), and clears ARP.