TCP/IP Name Resolution Order

I found this gem in Addison Wesley’s Inside WIndows Server 2003:

A simple way to remember the order in which TCP/IP uses these tools is the phrase “Can We Buy Large Hard Drives?” The first letters are keys for cache, WINS, Broadcast, Lmhosts, Hosts, and DNS.

Update: I just found the DNS query resolver behavior in the O’reilly book “DNS on Windows Server 2003”:

1.The resolver first checks its local cache, which is systemwide (and therefore shared by all applications calling the resolver). If the desired record is not in the cache, the resolver has to send at least one query to a name server.
2. The resolver queries the first name server of the preferred network adapter and waits just one second.
3. If no answer is received, the resolver resends the query simultaneously to the first name server configured for each network adapter and waits two seconds. If the host has only one network adapter, this step is skipped.
4. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits two seconds.
5. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits four seconds.
6. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits eight seconds.
7. If after all this time no name server has returned an answer, the resolver gives up and an error is returned to the application.

Chrissy is a Cloud and Datacenter Management & Data Platform MVP who has worked in IT for over 20 years. She is the creator of the popular SQL PowerShell module dbatools, holds a master's degree in Systems Engineering and is coauthor of Learn dbatools in a Month of Lunches. Chrissy is certified in SQL Server, Linux, SharePoint and network security. You can follow her on Twitter at @cl.

Posted in Networking
13 comments on “TCP/IP Name Resolution Order
  1. Alexander says:

    I thought i depends on node type, typically assigned by DHCP or H [Hybrid] by default.

  2. Chrissy says:

    Hmm, I’ll look into that. I’m not very knowledgeable on TCP/IP — this was something I read in the book “Inside Windows Server 2003.” Do you know of any flowcharts that describe, in detail, name resolution? Something that would even include references to Secondary DNS/WINS servers?

  3. This is the phrase I remember!!! Works for me!!”

    “No Way Baby – Lets Have Dinner”

    “NetBIOS name cache, WINS, Broadcast, Lmhosts, Hosts, and DNS”

  4. Chrissy says:

    Alexander, thanks so much!!

  5. Leigh says:

    Mark Minasi’s book for Windows NT 4 has flow diagrams and explanations in the rather large 200 page chapter. This was all I read for the NT4 TCP/IP exam many moons ago.

    Check out Mark’s other books at…only joking:-)

  6. Brian says:

    I’ve been told another on a microsoft course:

    C owboys
    W ith
    B ig
    L egs
    H ate
    D rainpipes

  7. Glen Victor says:

    There are 2 types of name resolution: NetBIOS and HOSTS/FQDN and they resolve differently

    Local Host Name
    Cache (seen by ipconfig /displaydns and flushed by ipconfig /flushdns)
    Hosts file (c:\windows\system32\driver\etc\hosts)
    WINS (if DNS is configured)
    LMHOSTS file (see HOSTS file location)


    The Node type determines the order of 2,3 & 4 of NetBIOS. I believe it goes like this
    Hybrid – as above
    Mixed – no broadcast
    another i don’t remember – WINS first then LMHOSTS

  8. Dave says:

    Just stumbled across this and needed to make a quick correction.

    The provided name resolution order….
    “Cache, WINS, Broadcast, Lmhosts, Hosts, and DNS”
    … is only correct when referring to NetBIOS name resolution.

    Actual Hostname resolution is slightly different.
    “Cache (DNS), Hosts, DNS server, NetBIOS cache, WINS, Broadcast and Lmhosts”

    And by the way.. the local HOSTS file actually pre-populates the local DNS cache. So even if you clear the local dns cache (ipconfig /flushdns) it’ll still repopulate it unless you check the local HOSTS file.

    Now… can anyone come up with an easy to remember phrase for

    C-H-D-N-W-B-L ??


    • Paul says:

      To remember CHDNWBL, just remember, if you get pulled over and you’re slightly intoxicated, You shouldn’t wobble while a police officer is asking for your name (or attempting name resolution).

      Shouldn’t Wobble.
      CHDN WBL

      Always works for me

  9. jbohm says:

    Just stumbled across this too, and so far this is the only page that even approaches a description of my problem: NT 5.02 (Windows Server 2003/XP x64) frequently tries broadcast to non-IP networks before realizing a name is in DNS on the IP protocol, causing annoying slowdowns on any machine supporting multiple protocols.

  10. I am preparing for MCITP on Windows 2008 R2. Can anyone post how to coonfigure NetBIOS name resolution order in Windows registry?

    Thanks in advance.

1 Pings/Trackbacks for "TCP/IP Name Resolution Order"

Leave a Reply