Why is 'ping' unable to resolve a name when 'nslookup' works fine?

Question

On my Windows XP workstation, I can find the machine I want to connect to in DNS with nslookup:

nslookup wolfman
Server: dns.company.com
Address: 192.168.1.38

Name: wolfman.company.com
Address: 192.168.1.178

But, when I try to connect to that machine, I get an error telling me that the machine can't be found (i.e., can't be looked up in DNS):

C:\> ping wolfman
Ping request could not find host wolfman. Please check the name and try again.

I am able to connect if I use the IP address directly:

C:\> ping 192.168.1.178

Pinging 192.168.1.178 with 32 bytes of data:

Reply from 192.168.1.178: bytes=32 time=41ms TTL=126
Reply from 192.168.1.178: bytes=32 time=41ms TTL=126
Reply from 192.168.1.178: bytes=32 time=44ms TTL=126
Reply from 192.168.1.178: bytes=32 time=38ms TTL=126

I could work around this by adding an entry to my hosts file, but I would rather find out why this is happening. The problem is transient, most of the day I can connect to the machine just fine.

How is this possible?

ETA: I left this out for brevity, but it was asked for:

C:\> ping wolfman.company.com
Ping request could not find host wolfman.company.com. Please check the name and try again.

ETA: Other applications get the same results. I only tried ping to simplify. telnet can't connect, Cygwin apps print a "unknown host wolfman" message.

Update: Using wireshark, I found that my workstation is not attempting a DNS lookup. It's just reporting the "could not find host" error message.

Answer 1

I believe that nslookup opens a winsock connection on the DNS port and issues a query, whereas ping uses the DNS Client service. You could try and stop this service and see whether this makes a difference.

Some commands that will reinitialize various network states :

Reset WINSOCK entries to installation defaults : netsh winsock reset catalog
Reset TCP/IP stack to installation defaults : netsh int ip reset reset.log
Flush DNS resolver cache : ipconfig /flushdns
Renew DNS client registration and refresh DHCP leases : ipconfig /registerdns
Flush routing table : route /f (reboot required)

Answer 2

Try ping with hostname followed by a dot. So instead of ping wolfman use ping wolfman.

That should get you resolving without having to do workarounds with hosts file, etc.

Answer 3

Try ipconfig /displaydns and look for wolfman. If it's cached as "name does not exist" (possibly because of a previous intermittent failed lookup), you can flush the cache with ipconfig /flushdns.

nslookup doesn't use the cache, but rather queries the DNS server directly.

Answer 4

Try adding . to the DNS suffixes for that connection. I.e, go to:

1. Ethernet Status
2. Click Properties
3. Internet Protocol Version 4
4. Click Properties
5. Click Advanced
6. Append these DNS suffices (in order)
7. Add . as a suffix.

The same steps are illustrated in the following screenshot:

This should make ping wolfman work.

Explanation

nslookup wolfman (name server lookup: wolfman) sends the hostname (wolfman) to the DNS (domain name system) to obtain the corresponding IP address. This is the sole purpose of the nslookup command. This works already, so we have verified that the DNS works and that wolfman indeed corresponds to an IP address.

In contrast, ping wolfman needs to do two things:

1. Get the IP that the hostname (wolfman) corresponds to.
2. Send packets to the IP and listen for the response

On Windows (even recent versions such as Windows 10), the first step can easily fail. For the sake of backwards compatibility, Windows supports various methods of hostname resolution (hosts file, DNS, NetBIOS/WINS, LMHOST file).

Unfortunately, it seems that Windows' ping command doesn't always attempt a DNS lookup. I don't know the specific conditions that triggers this behaviour.

Fortunately, we can force Windows to do a DNS lookup by using a FQDN (fully qualified domain name). In practice, we do this by suffixing a . dot to the hostname: wolfman.. Try ping wolfman. and verify that it works.

The final step is to force Windows to append this dot itself. I've already shown how to do this in the beginning of this answer.

Answer 5

nslookup works different to other commands when resolving names/ip addresses on Windows.

The normal resolution method on Windows is as follows:

1. The client checks to see if the name queried is its own.
2. The client then searches a local Hosts file, a list of IP address and names stored on the local computer.
3. Domain Name System (DNS) servers are queried.
4. If the name is still not resolved, NetBIOS name resolution sequence is used as a backup. This order can be changed by configuring the NetBIOS node type of the client.

nslookup on the other hand is used for testing Domain Name Servers.

Answer 6

I've struggled with a similar issue and have tried the solution suggested by @harrymc. I found what eventually seems to (at least somewhat) work at the microsoft technet forum (nslookup works but nothing else has DNS on standalone Win7 PC)

Here's the quote:

... try to use the command below to flush and reset a client resolver cache for test.

ipconfig /flushdns

ipconfig /registerdns

Please refer to the link below for more details. http://jefferyland.wordpress.com/2011/07/28/quick-review-of-flushdns-registerdns-and-dns-queries/

So basically what was missing for me was ipconfig /registerdns

Answer 7

Just today we had the same issue, but the solution was different. So I thought, I'd add it for reference as this was the top most search result.

• Problem: ping will not resolve a host name, but nslookup can. (Observed on 2 different Windows Server 2012 R2 hosts.)
• Cause: (For each host) The host has more than one NIC connected and there are multiple default gateways configured.
• Solution: (For each host) Remove default gateway from configuration of all NICs but one, so there reamains only one default gateway.

Answer 8

Maybe wolfman.company.com is listed in C:\Windows\system32\drivers\etc\hosts ?

nslookup bypasses that file and always asks DNS, while ping and other tools first of all look up in "hosts" file, then in DNS.

Answer 9

I had the same problem on a Windows 2012R2 (=8.1) system, and tried all the above suggestions, but none of them would fix it:
- Pinging the fully qualified name worked.
- Pinging the unqualified name did not.
- Both worked on several other systems, that had the same OS and apparently the same configuration.
- All the necessary suffix search strings were there.
(Note that some of the proposed fixes, like the workaround for the multi-label queries, are obviously irrelevant, as the unqualified name has only one part.)

Then I noticed that the target system I was trying to ping did NOT have an IPv6 address. So I tried "ping -4 unqualified_name", and bingo! this worked.
So for some reason, on this system only, ping only tried to resolve unqualified name->IPv6 address, and not unqualified name->IPv4.
For me the fix was to disable IPv6 completely as I don't need it at all. But I'd be really interested to find a more gentle way to tell ping (or presumably the DNS client service) to try resolving both IPv4 and IPv6 addresses.

Answer 10

I was trying to figure out why on one win 7 computer I can use ping server which works, and the other it can't resolve server. However both could ping server.lan which I didn't quite understand.

Turns out I had messed with some settings (DNS suffixes) to not have to use FQDNs while using the work VPN. I had to go add my local .lan to those suffixes in order to get both computers acting the same.

Go to Control Panel > Network and Internet > Network Connections and right click on your network connection and hit Properties. Click Internet Protocol Version 4 and hit the Properties button. Then the Advanced... button in this new window. Go to the DNS tab, this is where I had added a DNS suffix for my work but also needed one for my normal home connections.

Answer 11

I came across this issue as well. The "easiest" way to fix it for me was to simply add a . to the end of the hostname. However this is rather annoying. Most networks don't require this. I'd rather not have to tell everyone else on the network to do this when they need to access the same resource.

I was looking at the suggestion from Frederik Aalund as a possible solution and noticed that they suggested switching from the default "Append primary and connection specific DNS suffixes" option. This made me think maybe my network was simply slightly missconfigured.

Looking at my DD-WRT settings, the "LAN Domain" was left unset. Setting that to an arbitrary string seems to have fixed this issue for all clients on my network without having special configuration on each machine, the solution I wanted! :)

Answer 12

I might be wrong on this because its based on my long-forgotten NT4 ressource-kit days.

As fare I can recall PING uses Netbios/WINS and DNS (in that order, at least if you don't specify a FQDN).

WINS is gone many year ago but you might still have Netbios enabled on your interface and PING therefore might use netbios that might not give you any result. Especially if traffic is passing a router somewhere.

Just disable Netbios and Ping will use DNS as first priority and append the registered DNS Surffic on the interface to your hostname.

Answer 13

Adding an entry in the file c:/windows/system32/drivers/etc/hosts might fix it.

Answer 14

i have encountered this when we migrated to windows 7 from windows XP, the issue was related to a Windows 7 Multi Label DNS Query issue.

Allow DNS Suffix Appending to Unqualified Multi-Label Name Queries - see:

http://computerstepbystep.com/allow_dns_suffix_appending_to_unqualified_multi_label_name_queries.html

Hope this helps

Answer 15

If on mac os x it might be an DNS Cache problem:

Dump the cache

sudo killall -HUP mDNSResponder
sudo dscacheutil -flushcache

Answer 16

I'm picking this up because it bothered me the last year and maybe I found a workaround.

For me it seemed some dns-caching-system within the windows client is faulty. Windows 7 and 8.1 are affected by this... cannot say much about Windows XP anymore. ping doesn't resolve the name. it's not the icmp-part which is important but the name resolving part). nslookup is designed to query the nameserver and does exactly that and no windows name-hierarchy-resolving.

Restarting the dnscache service helped everytime. But since I disabled IPv6 on all client-interfaces the problem didn't occured anymore.

Cheers!

Answer 17

In my case what solved this problem was to add the domain of the host I was trying to ping to a group policy option named "DNS Suffix Search List".

The procedure in short is this: Open gpedit.msc and navigate to Computer Configuration -> Administrative Templates -> Network -> DNS Client > DNS Suffix Search List, set it to "Enabled" and add the domain name to the list (the list is empty by default).

A more detailed description of these steps can be found here

Answer 18

None of the solutions here worked for me. What did work for me was reconnecting to my work's vpn using OpenVPN. Then after disconnecting everything continued to work.

I believe the issue was related to the power going out while my computer was connected with openVPN. The only way I figured this out was by using WireShark. I noticed that the destination IPs for all the queries were going to IPs on my work's internal network.

Answer 19

Just had this issue on a Windows 7 client joined to a domain it turned out to be incorrect DirectAccess settings in the registry.

Try clearing the contents of the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DnsClient\DnsPolicyConfig

and then restarting the 'DNS Cache' service.

If that helps, look under Group Policy Management Console for two policies called 'DirectAccess Client Settings' and 'DirectAccess Server Settings'. Check if they are configured correctly or even needed in your scenario. They are sometimes created automatically with certain settings for the Routing and Remote Access role on a server and this was the cause of the issue on our part.

http://virot.eu/manually-remove-direct-access-from-a-client/

Answer 20

I have just had this problem, and found something quite peculiar, and managed to fix it Lol

Basically, if you have any entries in your hosts file, that are the same as the IP your ping is trying to resolve to, it will fail.

For example, if in your DNS, you have a record for www.example.com - 10.0.0.20, but then you have an entry in your client's hosts file, 10.0.0.20 somethingelse.com, you will not be able to ping www.example.com

Strange huh

Answer 21

I had the same problem and turns out another machine had the same IP address, and that was causing it.

Changed IP back to DHCP and everything was working fine.

Answer 22

ping uses the ICMP protocol, specifically the 'Echo Request' and 'Echo Reply'.

many networks disable ICMP utilities in order to prevent attacks or basic network scanning. I've found many routers you purchase come with a setting to disable ping and like utilities enabled by default.

you can find more about ICMP here:

http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol