I found this gem in Addison Wesley’s Inside WIndows Server 2003:
A simple way to remember the order in which TCP/IP uses these tools is the phrase “Can We Buy Large Hard Drives?” The first letters are keys for cache, WINS, Broadcast, Lmhosts, Hosts, and DNS.
Update: I just found the DNS query resolver behavior in the O’reilly book “DNS on Windows Server 2003”:
1.The resolver first checks its local cache, which is systemwide (and therefore shared by all applications calling the resolver). If the desired record is not in the cache, the resolver has to send at least one query to a name server.
2. The resolver queries the first name server of the preferred network adapter and waits just one second.
3. If no answer is received, the resolver resends the query simultaneously to the first name server configured for each network adapter and waits two seconds. If the host has only one network adapter, this step is skipped.
4. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits two seconds.
5. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits four seconds.
6. If no answer is received, the resolver resends the query simultaneously to all name servers configured for all adapters and waits eight seconds.
7. If after all this time no name server has returned an answer, the resolver gives up and an error is returned to the application.
Chrissy is a PowerShell MVP who has worked in IT for nearly 20 years, and currently serves as a Sr. Database Engineer in Belgium. Always an avid scripter, she attended the Monad session at Microsoft’s Professional Developers Conference in Los Angeles back in 2005 and has worked and played with PowerShell ever since. Chrissy is currently pursuing an MS in Systems Engineering at Regis University and helps maintain RealCajunRecipes.com in her spare time. She holds a number of certifications, including those relating to SQL Server, SuSE Linux, SharePoint and network security. She recently became co-lead of the SQL PASS PowerShell Virtual Chapter. You can follow her on Twitter at @cl.
I thought i depends on node type, typically assigned by DHCP or H [Hybrid] by default.
Hmm, I’ll look into that. I’m not very knowledgeable on TCP/IP — this was something I read in the book “Inside Windows Server 2003.” Do you know of any flowcharts that describe, in detail, name resolution? Something that would even include references to Secondary DNS/WINS servers?
Luckily found one at http://www.extralan.co.uk/Infolinks/on-site-links/Netbios-flow-chart.htm
I guess it self-explanatory :-)
This is the phrase I remember!!! Works for me!!”
“No Way Baby – Lets Have Dinner”
“NetBIOS name cache, WINS, Broadcast, Lmhosts, Hosts, and DNS”
Alexander, thanks so much!!
Mark Minasi’s book for Windows NT 4 has flow diagrams and explanations in the rather large 200 page chapter. This was all I read for the NT4 TCP/IP exam many moons ago.
Check out Mark’s other books at…only joking:-)
I’ve been told another on a microsoft course:
C owboys
W ith
B ig
L egs
H ate
D rainpipes
There are 2 types of name resolution: NetBIOS and HOSTS/FQDN and they resolve differently
Hosts/FQDN
—————————————————————
Local Host Name
Cache (seen by ipconfig /displaydns and flushed by ipconfig /flushdns)
Hosts file (c:\windows\system32\driver\etc\hosts)
DNS
WINS (if DNS is configured)
LMHOSTS file (see HOSTS file location)
Broadcast
NETBIOS
——-
Cache
LMHOSTS
WINS
Broadcast
HOSTS
DNS
The Node type determines the order of 2,3 & 4 of NetBIOS. I believe it goes like this
Hybrid – as above
Mixed – no broadcast
another i don’t remember – WINS first then LMHOSTS
Just stumbled across this and needed to make a quick correction.
The provided name resolution order….
“Cache, WINS, Broadcast, Lmhosts, Hosts, and DNS”
… is only correct when referring to NetBIOS name resolution.
Actual Hostname resolution is slightly different.
“Cache (DNS), Hosts, DNS server, NetBIOS cache, WINS, Broadcast and Lmhosts”
And by the way.. the local HOSTS file actually pre-populates the local DNS cache. So even if you clear the local dns cache (ipconfig /flushdns) it’ll still repopulate it unless you check the local HOSTS file.
Now… can anyone come up with an easy to remember phrase for
C-H-D-N-W-B-L ??
thnx
To remember CHDNWBL, just remember, if you get pulled over and you’re slightly intoxicated, You shouldn’t wobble while a police officer is asking for your name (or attempting name resolution).
Shouldn’t Wobble.
CHDN WBL
Always works for me
LOL!
Just stumbled across this too, and so far this is the only page that even approaches a description of my problem: NT 5.02 (Windows Server 2003/XP x64) frequently tries broadcast to non-IP networks before realizing a name is in DNS on the IP protocol, causing annoying slowdowns on any machine supporting multiple protocols.
I am preparing for MCITP on Windows 2008 R2. Can anyone post how to coonfigure NetBIOS name resolution order in Windows registry?
Thanks in advance.