How does machine name resolution work when not on a domain?

Question

I've got 4 Windows machines (3 x Win7, 1 x WinXP) and various other devices on my home network, using a Linksys WRT54 wireless router. I don't have a domain server, and I have had issues with some of the machines not being able to resolve the hostname of other machines.

How does that work when one doesn't have a DNS server? I've set them all up with the same workgroup name but a ping fails with "Ping request could not find host...".

How might I find the cause for this issue? Are there specific things on Windows Firewall that would prevent it from working?

Answer 1

Windows machines use their own techniques for resolving the IP of other hosts, most commonly broadcasts or multicasts to advertise it is available on the network.

For example, Windows XP uses NetBIOS Name Service to advertise and resolve, using broadcast packets. Starting with Vista, multicast-based LLMNR is also available, while Mac OS X and Linux use a very similar mDNS, although NetBIOS remains the most widely supported.

If you want to be sure to be able to contact the other hosts, you could always edit the hosts file for resolution. That way is only an option if you have static IPs.

• Verify what is happening on the network with Wireshark, though it might be a bit to advanced for you. With Wireshark you can see the network traffic flowing over your NIC.
• Try shutting down your firewall temporarily, then try to ping the other hosts.
• Verify that NetBIOS is working.

Answer 2

Microsoft TCP/IP Host Name Resolution Order outlines the order as of the time of its writing (NT4/9x). It didn't change much since that time. It mentions two methods: "host resolution" and "winsock resolution".

The majority of programs (even web) use the winsock method, implemented in ws2_32!gethostbyname. Its order can be observed with a sniffer (such as Wireshark).

As of Win7, the order I observe is the following:

• If FQDN: DNS only

• If unqualified name:

  1. If there is a connection with a domain prefix: DNS with that prefix appended
  2. LLMNR (udp/5355 multicast) (doesn't exist in XP)
  3. NetBIOS according to the "node type" configured. Virtually always, it's Hybrid aka H-node which means - WINS server if configured, then NBNS (udp/137 broadcast)

Note that hosts file always overrides a DNS lookup and lmhosts overrides a NetBIOS lookup.

"Host resolution" is specified to only use DNS and only be used "by some programs" like IE and a few utilities - it appears, by the apps that use wininet.

Answer 3

Remember to make sure that you are logged in as administrator, and that the file is not set to read-only before you try to edit the hosts file, or else it won't allow you to save it afterwards. You might also need to edit the permissions on the file itself. On 7, the easiest way to edit the hosts file is to take ownership of it under administrator. That will allow you to edit and save the file.