I was wondering why in the iptables command, reverse lookup on my local
network was taking so long. It works fast with nslookup. My DNS server
is the dnsmasq running on the Linksys WRT54GL (Tomato firmware). Of course
it knows the 192.168 network!

I ran an strace and discovered that iptables is talking to some Unix
domain socket to some avahi daemon, which turns out to be some
non-invention related to some idiotic idea from Apple.

I promptly ran "apt remove avahi-daemon".

Problem went away; iptables listing now instant.

WTF is this good for, why is it installed by default, and why does it choke
on things that your regular DNS doesn't?

The root cause of the problem is effed up '/etc/nsswitch.conf'
after installation of package 'libnss-mdns'.  See

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412714

I agree that
the entire avahi thing is retarded, but it keeps coming back
on upgrades like the undead.  I used this workaround to
restore performance of iptables -L to an acceptable level:

In '/etc/nsswitch.conf':

#hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
hosts:          files mdns4_minimal [NOTFOUND=return] dns

Could probably delete references to mdns(4) altogether and
just go with 'files dns' for best performance but YMMV
depending on whether avahi actually works at all with
a particular network setup.