TCP/IP Name Resolution Order

I found this gem in Addison Wesley’s Inside WIndows Server 2003:

A simple way to remember the order in which TCP/IP uses these tools is the phrase “Can We Buy Large Hard Drives?” The first letters are keys for cache, WINS, Broadcast, Lmhosts, Hosts, and DNS.

Update: I just found the DNS query resolver behavior in the O’reilly book “DNS on Windows Server 2003”:

1.The resolver first checks its local cache, which is systemwide (and therefore shared by all applications calling the resolver). If the desired record is not in the cache, the resolver has to send at least one query to a name server.
2. The resolver queries the first name server of the preferred network adapter and waits just one second.
3. If no answer is received, the resolver resends the query simultaneously to the first name server configured for each network adapter and waits two seconds. If the host has only one network adapter, this step is skipped.
4. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits two seconds.
5. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits four seconds.
6. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits eight seconds.
7. If after all this time no name server has returned an answer, the resolver gives up and an error is returned to the application.

Chrissy is a PowerShell MVP who has worked in IT for nearly 20 years, and currently serves as a Sr. Database Engineer in Belgium. Always an avid scripter, she attended the Monad session at Microsoft’s Professional Developers Conference in Los Angeles back in 2005 and has worked and played with PowerShell ever since. Chrissy is currently pursuing an MS in Systems Engineering at Regis University and helps maintain RealCajunRecipes.com in her spare time. She holds a number of certifications, including those relating to SQL Server, SuSE Linux, SharePoint and network security. She recently became co-lead of the SQL PASS PowerShell Virtual Chapter. You can follow her on Twitter at @cl.

Posted in Networking
13 comments on “TCP/IP Name Resolution Order
  1. Alexander says:

    I thought i depends on node type, typically assigned by DHCP or H [Hybrid] by default.

  2. Chrissy says:

    Hmm, I’ll look into that. I’m not very knowledgeable on TCP/IP — this was something I read in the book “Inside Windows Server 2003.” Do you know of any flowcharts that describe, in detail, name resolution? Something that would even include references to Secondary DNS/WINS servers?

  3. This is the phrase I remember!!! Works for me!!”

    “No Way Baby – Lets Have Dinner”

    “NetBIOS name cache, WINS, Broadcast, Lmhosts, Hosts, and DNS”

  4. Chrissy says:

    Alexander, thanks so much!!

  5. Leigh says:

    Mark Minasi’s book for Windows NT 4 has flow diagrams and explanations in the rather large 200 page chapter. This was all I read for the NT4 TCP/IP exam many moons ago.

    Check out Mark’s other books at…only joking:-)

  6. Brian says:

    I’ve been told another on a microsoft course:

    C owboys
    W ith
    B ig
    L egs
    H ate
    D rainpipes

  7. Glen Victor says:

    There are 2 types of name resolution: NetBIOS and HOSTS/FQDN and they resolve differently

    Hosts/FQDN
    —————————————————————
    Local Host Name
    Cache (seen by ipconfig /displaydns and flushed by ipconfig /flushdns)
    Hosts file (c:\windows\system32\driver\etc\hosts)
    DNS
    WINS (if DNS is configured)
    LMHOSTS file (see HOSTS file location)
    Broadcast

    NETBIOS
    ——-
    Cache
    LMHOSTS
    WINS
    Broadcast
    HOSTS
    DNS

    The Node type determines the order of 2,3 & 4 of NetBIOS. I believe it goes like this
    Hybrid – as above
    Mixed – no broadcast
    another i don’t remember – WINS first then LMHOSTS

  8. Dave says:

    Just stumbled across this and needed to make a quick correction.

    The provided name resolution order….
    “Cache, WINS, Broadcast, Lmhosts, Hosts, and DNS”
    … is only correct when referring to NetBIOS name resolution.

    Actual Hostname resolution is slightly different.
    “Cache (DNS), Hosts, DNS server, NetBIOS cache, WINS, Broadcast and Lmhosts”

    And by the way.. the local HOSTS file actually pre-populates the local DNS cache. So even if you clear the local dns cache (ipconfig /flushdns) it’ll still repopulate it unless you check the local HOSTS file.

    Now… can anyone come up with an easy to remember phrase for

    C-H-D-N-W-B-L ??

    thnx

    • Paul says:

      To remember CHDNWBL, just remember, if you get pulled over and you’re slightly intoxicated, You shouldn’t wobble while a police officer is asking for your name (or attempting name resolution).

      Shouldn’t Wobble.
      CHDN WBL

      Always works for me

  9. jbohm says:

    Just stumbled across this too, and so far this is the only page that even approaches a description of my problem: NT 5.02 (Windows Server 2003/XP x64) frequently tries broadcast to non-IP networks before realizing a name is in DNS on the IP protocol, causing annoying slowdowns on any machine supporting multiple protocols.

  10. I am preparing for MCITP on Windows 2008 R2. Can anyone post how to coonfigure NetBIOS name resolution order in Windows registry?

    Thanks in advance.

1 Pings/Trackbacks for "TCP/IP Name Resolution Order"

Leave a Reply

Your email address will not be published. Required fields are marked *

*