Mac OS X Tiger lookupd bug & hosts block fix

Original Report

There appears to be a serious bug in Mac OS X's lookupd which can pull the rug right out from under Mac OS X Tiger. While this bug could possibly be triggered in a number of different ways, there has been a recent rash of reports that have been tracked to some mainstream websites such as FoxNews.com and ABCNews.com using links to an adware site js.adsonar.com. This document describes a quick way out of the hang and a simple way to block links to js.adsonar.com (or other similar addresses) from taking down Tiger again. While this doesn't fix the underlying lookupd bug itself, it prevents Mac OS X from hanging, while allowing you to continue using affected websites like FoxNews.com and ABCNews.com with full Java and JavaScript access enabled.

Update: 10/06/05

Apparently this hang has to do with how lookupd uses its cache. To over-simplify it a bit, certain domain names apparently get pointed to, or stored in the same location as other addresses in lookupd's cache. This can lead to lookupd crashing. The domain js.adsonar.com was one such very common domain since it was used on some mainstream websites. There are indeed other such domains that can cause the same hang. Until the actual bug in lookupd itself can be fixed, you can simply add additional lines to the following fix for any problem domains that you come across, and block them as well.

One way to find such problem domains is to open the Activity window in Safari and surf to a site that may trigger the hang for you. Then look in the Activity window to see if there is a common domain that seems to hang Safari. If you find such a domain, simply add an additional line to your hosts file to block that domain as well, as outlined below.

Quigo, the owners of Adsonar, have stated that they have changed their DNS information for js.adsonar.com to help avoid this hang. I have not personally confirmed their fix, since I really have no interest in unblocking their ads. I have added them to the ad blocking hosts file that I use anyway. You can also use this same technique to block any additional advertising-only domains that you wish.

Update: 10/21/08

I have not experienced any of these hangs since implementing the ad blocking hosts file and I continue to use the same hosts file in Leopard 10.5.5. I've kept this page in the archives in case others run into the same or similar problems and also for those who simply wish to use an ad blocking hosts file on Mac OS X.

If you find any of this information helpful in any way, please consider supporting our 3D CGI animated short filmmaking efforts by purchasing our BlastOff! Special Edition DVD.

Please Support Our Continuing Independent Film Making Efforts! Order your Award-winning BlastOff! Special Edition DVD today!

Hope it helps,

-MikeS

Symptoms

The symptoms of this problem are as follows:

1. You're surfing the web and the page you are on fails to completely load.
2. No further pages will load in your browser.
3. You can switch to other applications that may already be running and save open files.
4. You can no longer launch any additional applications, their icons will bounce in the dock for a while and then they will just stop bouncing.
5. You can no longer use any other Finder functions.
6. You can no longer use command-option-escape to force quit.
7. You can not log out, restart or shut down.

Apparently these symptoms indicate that a low-level component of Mac OS X, lookupd, has hung. Since lookupd is used by many other parts of Mac OS X, it effectively hangs Mac OS X itself.

The Quick Fix

If you find yourself in this situation, the quick fix that has worked for me has been to disconnect the ethernet cable from the system for about five to ten seconds and then plug it back in. You may also have luck turning off the hub, router or access point for five to ten seconds and then turning it back on. This forces the system to kill and restart lookupd, thereby freeing up Mac OS X, until the next time it hangs...

The Hosts Blocking Fix

One of the recent triggers of a rash of these hangs appears to be performing an Internet lookup for the js.adsonar.com domain from mainstream websites like FoxNews.com and ABCNews.com. So one way to prevent many of these hangs is to simply block access to this js.adsonar.com domain. You may also block any other problem domains or even other ad-only domains that you wish to block in this way.

An easy way to do this is to simply assign the Internet address 0.0.0.0 to js.adsonar.com (or any other problem or undesired domain). This way if your browser comes across a link to js.adsonar.com it won't try to look it up online (which is what triggers lookupd to crash) and instead will just use the address 0.0.0.0 which is nothing more than an alias for your own local Mac. You could use the address 127.0.0.1 instead if you wish, since that also is like an alias to your own local Mac. This fix doesn't really change how your Mac is running, all it does is ignore links to any domains you wish to block.

There are other more drastic fixes such as unlockupd, that will kill and restart lookupd at regular intervals, or you can adjust the timing of how lookupd uses its cache. I'd try this hosts blocking fix first though, since it doesn't affect how your system runs, and is all that many have needed to stop the hangs. (I've received many emails and phone calls from all over the country from other Mac users saying this stopped their hangs!) If however you still find you have some of the hangs (though it should be far fewer if you use an affected Web site) then you can try some of the more drastic fixes in addition to this one if necessary.

If you think you may have a different domain that's triggering the same hang. You may be able to isolate it by surfing to the problem site with Safari's Activity window open. Watch the Activity window as the page loads to see if you can identify any URL's that cause Safari to hang. If you find such a URL, you would simply add a new line using the domain portion of the URL, which is between the second and third forward slash, as follows.

For example. If you suspected a URL that looks like this:

http://some.site.com/somedir/somedir/somefile.ext

You would simply add an additional line in the following steps that looked like this:

0.0.0.0 some.site.com

To implement this simple fix you'll need administrator access
to follow these steps. Use at your own risk!

• Launch terminal, which can be found in Applications/Utilities.
• Check the current hosts file by typing:
  cat /etc/hosts
• Which should print out the following:
  ##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
• Backup the current hosts file to a file named hosts.original by typing:
  sudo cp /etc/hosts /etc/hosts.original
• Enter your administrator password when prompted.
• Copy the current hosts file to the Desktop by typing:
  cp /etc/hosts ~/Desktop/hosts.txt
• Double click the hosts.txt file that appears on the desktop to open it in TextEdit
• Add the following Internet address assignments to the end of the file:
  0.0.0.0 ads.adsonar.com
  0.0.0.0 js.adsonar.com
• Add similar lines for any additional domains you wish to block.
• Select File->Save
• Copy the edited file back into the /etc directory by typing the following:
  sudo cp ~/Desktop/hosts.txt /etc/hosts
  (Note: There is no ".txt" extension on /etc/hosts)
• Verify that the changes were made properly by again typing:
  cat /etc/hosts
• Which should print out the following which now includes the adsonar info:
  ##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
0.0.0.0 ads.adsonar.com
0.0.0.0 js.adsonar.com
• Restart lookupd by typing the following (or by just restarting the Mac if easier):
  sudo killall -HUP lookupd
• Now to test the fix, launch Safari and enter the following in the address bar:
  js.adsonar.com
  (NOTE: just type "js.adsonar.com", without quotes. Don't add a "www" or anything else.)
• You should receive the following error if the adware site is successfully blocked:
  Safari can’t open the page “http://js.adsonar.com/” because it could not connect to the server “js.adsonar.com”. If you have Personal Web Sharing enabled, you may see the Apache start page instead.
• Quit Terminal.

If anything goes wrong, or anytime you wish to revert back to the original hosts file simply follow these additional steps:

• Launch terminal, which can be found in Applications/Utilities.
• Move the backed up hosts file to its original location by typing this:
  sudo mv /etc/hosts.original /etc/hosts
• Enter your administrator password when prompted.
• Restart lookupd by typing the following (or by just restarting the Mac if easier):
  sudo killall -HUP lookupd
• Quit Terminal.

The above fix could really be done in 2 or 3 steps (or even all in one step if you really know what you're doing), but I've included other steps that have you check the file and back it up first, then check again, etc. I also included steps so you can revert back to the original at any time if you wish. I've presented each step by itself, so that it's easy to follow by a Mac user who may not be Unix savvy.

I could have just posted a new hosts file that you could download and install, but decided not to for safety and flexibility. I didn't want someone to start sending some other file around the Internet pretending to be this hosts file and thereby open anyone up to potential problems. By following these steps manually you can see exactly what you're doing and why. You can also use the same steps to block any other domains that my be problematic or undesirable. It may take a few more minutes, but it's safer. ;-)

Information

Here are some additional links for more information...

Apple Discussions: Safari: Here's a fix for Safari hanging and taking down the system..

Apple Discussions: Safari: Safari freezes Tiger

Apple Discussions: Tiger: Finder keeps locking up

Apple Discussions: Tiger: "Fixes" for lookupd Problems, some via Java Updates

Apple Discussions: Tiger: System unresponsive within the last week

MacFixit Discussions: Progressive Freeze and Network Access under Tiger

MacFixIt Special Report

MacFixit Follow-up: Another fix for system-wide freezes when Web browsing

MacinTouch.com

An ad blocking hosts file for Mac OS X