Windows Server Troubleshooting - Name Resolution

Click here to start saving with ING DIRECT!

Home | Up | Methodology | Architecture | Tools | Memory | Processor | Registry | File System | Active Directory | Contents

Get the Book

Major Topics
File System
Active Directory
Other Topics
Network Monitor
Name Resolution
More Detail

eXpert Genealogy

Memory from

2003-2006 Team Approach Limited
All rights reserved

Network interfaces have a number of different names or addresses that are used for different purposes.

Type Format Description Example
MAC address 48 bits Unique hardware address built into each network card 00-10-5A-A7-33-03
IP address 32 bits Numeric address defined by an administrator
DNS name Alphanumeric Internet name
Computer name Alphanumeric Microsoft NetBIOS name JohnSmith

The process of determining an address given a name is called name resolution. When someone types a name like into a web browser address line, the system will need to translate this into an IP address and finally determine a MAC address to put in the Ethernet frame. The process looks link this;

    Domain name        IP address        MAC address 00-10-5A-A7-33-03

By default, Windows will simply send out broadcasts to resolve computer names. This is the least efficient way to do name resolution because a broadcast interrupts every computer on the subnet. It is the default because it needs no configuration and no server is required.


WINS name query request = What is the address for Joe'sComputer
WINS name query response = Joe'sComputer address is

To reduce broadcast interrupts, Microsoft computer names can be resolved with a WINS Windows Internet Name Service Server. Internet domain names can be resolved by DNS servers. WINS provides compatibility for older versions of Windows. WINS and NetBIOS computer names are no longer necessary in Active Directory environments. Active Directory replaces WINS with DNS.

DNS name query request = What is the address for
DNS name query response ='s address is

Windows clients can be configured to use different kinds of resolution techniques to resolve Microsoft computer names. The registry configuration is NodeType REG_DWORD at HKLM\SYSTEM\CurrentControlSet\Services\Netbt\Parameters.

Type NodeType Description Comment
B-node 1 Always broadcast default without WINS
P-node 2 Use WINS, never broadcast least traffic
M-node 4 Broadcast first, then query WINS if most traffic is local
H-node 8 Query WINS, then broadcast if necessary default with WINs

ARP Address Resolution Protocol

ARP request broadcast - Which machine has this IP address?  
Here is my MAC address! - Now both machines have both addresses

The IP address to MAC address resolution is done with ARP Address Resolution Protocol. When a machine wants to communicate with an IP address, it must determine the hardware MAC address (e.g. Ethernet). This is done by sending out an ARP request broadcast which contains the destination IP address. This interrupts every machine in the subnet, but only the machine with the IP address will respond.

The address information is cached temporarily. The cache can be viewed with the command ARP -a. The following is example output of the ARP -a command.

Interface: --- 0xffffffff
Internet Address Physical Address Type 00-03-47-12-9d-49 dynamic 00-10-5a-a7-33-03 dynamic

The longer entries stay valid in the ARP cache, the fewer broadcasts are required to rediscover the addresses. For better performance, increase the ARP cache life time by using the Registry Editor. The entries to consider are

  • HKLM\System\CurrentControlSet\Services\TCPIP\ArpCacheLife
    • Default for used addresses is 600 seconds
    • Default for unused addresses is 120 seconds
  • HKLM\System\CurrentControlSet\Services\TCPIP\ArpCacheSize
    • Increase the default of 62 entries as needed

DHCP Dynamic Host Configuration Protocol

IP addresses can be assigned to network interfaces by using the Control Panel. This can be rather tedious if you manage many computers.  Windows Servers have a DHCP service that can automatically assign IP addresses and configuration to each computer. DHCP clients must initially send out a broadcast to find a DHCP server.

Are there any DHCP servers that can assign IP configuration?
DHCP client            
Here is your IP configuration                   DHCP server

DHCP assigns the address for a period of time known as a lease life. Half way through the lease life, the client requests a renewal of the lease. By default, the lease life is

  • 3 days for NT servers
  • 8 days for Windows 2000 servers