In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the corresponding hostname.
There are some rows in the results that netstat seems to hiccup on and take longer than usual. As far as I can tell, these are all addresses where there is no IP to hostname mapping in our local DNS servers. No big deal. nslookup and nblookup both fail to find hostnames for the IPs in question as well, agreeing that this would be part of the slowness related to these records.
However, in the netstat results, these records show the correct hostname. How is that possible? How is netstat able to discern the hostname for the connections with no reverse DNS or reverse WINS (is there such a thing) entries?
I have tried flushing the local DNS cache and still get the same results. Edit: There are forward DNS entries for the hostnames in question. Is it possible the underlying connection is somehow able to "hold on" to the original name used to create the connections?