NSLOOKUP confusion: Where is it getting its information locally?

Question

I perform nslookup on a non-local address, say Google. On my machine (running Ubuntu 12.10), I get this as a result:

Server:     127.0.0.1
Address:    127.0.0.1#53

Non-authoritative answer:
Name:   www.google.com
Address: 173.194.37.52
Name:   www.google.com
Address: 173.194.37.48
Name:   www.google.com
Address: 173.194.37.49
Name:   www.google.com
Address: 173.194.37.50
Name:   www.google.com
Address: 173.194.37.51

I'm trying to understand this. I assume the list of addresses under "Non-authoritative answer" are all of the possible addresses that google.com is using, but why is it listing my local host information at the top? Also, is nslookup querying a local machine, or only the DNS server?

I was looking at this link to explain nslookup, but it's for Windows and I'm not sure that I understand what they're doing there.

I've also consulted the man pages, but those just tell me how to use nslookup, not any of the "theory" behind it. Would somebody mind explaining exactly where nslookup queries, preferably using an example, in order?

I'd appreciate it.

Answer 1

It queries wherever the appropriate values in /etc/resolv.conf tell it to. In this case it is pointing to the local machine, which is most likely acting as a caching or proxy DNS server. Use netstat to find out which program is listening on port 53.