Long delay when pinging Windows 7 machine by name vs by ip

Question

This question regards machines accessing/pinging one another on my local network by name vs ip and delays associated with doing it by name. All machines are Windows 7 Ultimate 64bit.

Below is output from three scenarios:

1. Ping machine2 by name. The key issue is there is close to a 6 second delay from hitting enter on the command line before results start being returned.

C:\Users\machine1>ping machine2

Pinging machine2 [fe80::95f5:38e3:fc8a:4a70%11] with 32 bytes of data:
Reply from fe80::95f5:38e3:fc8a:4a70%11: time=1ms
Reply from fe80::95f5:38e3:fc8a:4a70%11: time=1ms
Reply from fe80::95f5:38e3:fc8a:4a70%11: time=1ms
Reply from fe80::95f5:38e3:fc8a:4a70%11: time=1ms

Ping statistics for fe80::95f5:38e3:fc8a:4a70%11:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms

2. Ping machine2 by ip. There is no delay from hitting enter to recieving results

C:\Users\machine1>ping 192.168.1.101

Pinging 192.168.1.101 with 32 bytes of data:
Reply from 192.168.1.101: bytes=32 time=1ms TTL=128
Reply from 192.168.1.101: bytes=32 time=1ms TTL=128
Reply from 192.168.1.101: bytes=32 time=1ms TTL=128
Reply from 192.168.1.101: bytes=32 time=1ms TTL=128

Ping statistics for 192.168.1.101:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms

3. Force ping to use IPv4 and ping by machine name. Still same delay occurs.

C:\Users\machine1>ping machine2 -4

Pinging machine2 [192.168.1.101] with 32 bytes of data:
Reply from 192.168.1.101: bytes=32 time=58ms TTL=128
Reply from 192.168.1.101: bytes=32 time=86ms TTL=128
Reply from 192.168.1.101: bytes=32 time=1ms TTL=128
Reply from 192.168.1.101: bytes=32 time=19ms TTL=128

Ping statistics for 192.168.1.101:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 86ms, Average = 41ms

The main time this becomes an issue is using programs where I just wanted to quickly type a machine name on the network to connect to, e.g. Remote Desktop, and having to wait 6 seconds each time, or alternatively look up its IP first, which isn't great when the IP changes. I'm not interested in static IP's either.

At this point I think this has to do more with machine name resolution than anything else, but don't know where to go from here. Any help would be appreciated.

Answer 1

The timeout will be in the DNS resolution. It may be because you have more than one DNS server specified and one of them is not responding.

In a command prompt window type:

C:\> ipconfig /all | find "DNS Servers"

and note down the IP addresses of the DNS servers.

Then use the nslookup tool to probe them:

C:\> nslookup
Default Server: Blah
Address: 192.168.1.1

>

Then select each DNS server in turn:

> server 192.168.1.1
Default Server: [192.168.1.1]
Address: 192.168.1.1

and do a lookup using it:

> machine2
Server: [192.168.1.1]
Address: 192.168.1.1

Name: machine2.mydomain.com
Address: 192.168.1.101

Repeat that server and machine2 commands for each IP address in your list. One of them should fail with:

Request to [192.168.1.1] timed-out

Then it's just a case of finding out a) why that DNS server is not working, and b) if you should even be using it at all.

Answer 2

Windows uses several different methods to resolve machine names:

• DNS
• NBNS, NetBIOS name service (used by all Windows version)
• LLMNR (introduced in Windows 7; only IPv6)
• mDNS (if Bonjour is installed; comes with iTunes and probably Safari)

It could be that your DNS server is not responding to the queries, or that the other machines have NBNS and/or LLMNR disabled or firewalled. (I don't know the exact order, but DNS always seems to be tried first.)

Install Wireshark and watch all packets related to name resolution. Set the display filter to dns or nbns or udp.port=5355.

Answer 3

I actually ran into this problem recently on a linux system.

The cause turned out to be that once return packets start coming, certain versions of ping by default attempt to do a reverse DNS lookup of the IP address the response is coming from:

shadur@caleburn: ~/ > ping google.com
PING google.com (74.125.136.113) 56(84) bytes of data.
64 bytes from ea-in-f113.1e100.net (74.125.136.113): icmp_seq=1 ttl=49 time=12.7 ms
64 bytes from ea-in-f113.1e100.net (74.125.136.113): icmp_seq=2 ttl=49 time=7.75 ms
64 bytes from ea-in-f113.1e100.net (74.125.136.113): icmp_seq=3 ttl=49 time=7.85 ms

If your setup doesn't have reverse DNS configured for the 1.168.192.in-addr.arpa (or at least an entry for 192.168.1.1 in your hosts file, it's going to time out trying to reach a DNS server to complete the lookup, and it can't start printing the response packets until the lookup gets resolved (either by a correct DNS response in which case it prints the returned name, or by a timeout in which case it just prints the IP address).

Adding the name/IP address combo to your hosts file should fix the issue.

(EDIT: In windows the file you're looking for is at C:\Windows\System32\drivers\etc\hosts by default.)