nslookup vs ping dns lookup on Windows

Forums › Desktop computing › nslookup vs ping dns lookup on Windows - avoid this gotcha

timmmay

20574 posts

Uber Geek

Trusted

Lifetime subscriber

#312113 18-Mar-2024 20:22

I've just run into and solved a problem based on this difference. Basically I had an old line in my hosts file that meant I couldn't resolve two domains, so when I changed hosting for PiHole / Home Assistant from a server on one IP to a server on another IP it took me two days to work out what was going wrong.

I had my server on 192.168.1.42, but I turned that server off and moved it to 192.168.1.12. For some reason I had this entry in my hosts file

192.168.1.42 homeassistant.local

When I issued an nslookup it returned what I expected to see

nslookup homeassistant.local

> 192.168.1.12

Whereas when I issued a ping command I saw the truth

ping homeassistant.local

> 192.168.1.42

Ping returns the actual IP that Windows is going to send the request to, whereas nslookup looks up the domain from your DNS server. Therefore if you have defined anything in your hosts file nslookup can't see it, but ping can.

Two days it took me to work this out. Well, about 3 hours over two days, but still frustrating!

muppet

2566 posts

Uber Geek

Trusted

#3207717 18-Mar-2024 21:07

Seems like a bug with ping - why doesn't it follow the same name resolution path?

And yea - static host entries always come back to bite you on the arse.

snj

185 posts

Master Geek

#3207785 18-Mar-2024 23:16

muppet:

Seems like a bug with ping - why doesn't it follow the same name resolution path?

Not a bug actually, just a confusing thing with Windows, especially due to people that say nslookup is the equivalent of *nix 'host'.

nslookup is specifically a tool to query a DNS server, (basically the Windows equivalent to bind's dig and so on), so doesn't rely on the host's resolution configuration, except to retrieve the default DNS server addresses.

ping refers to the OS's resolution functions which includes the hosts file and so forth.

From what I can tell there isn't a Windows equivalent of the *nix host command.

ANglEAUT

2320 posts

Uber Geek

Trusted

Lifetime subscriber

#3207790 19-Mar-2024 00:28

timmmay: ... Ping returns the actual IP that Windows is going to send the request to, whereas nslookup looks up the domain from your DNS server. Therefore if you have defined anything in your hosts file nslookup can't see it, but ping can. ...

Accurate &annoyingly non-obvious behaviour.

snj: Not a bug actually, just a confusing thing with Windows, ...

nslookup is specifically a tool to query a DNS server, (basically the Windows equivalent to bind's dig and so on), so doesn't rely on the host's resolution configuration, except to retrieve the default DNS server addresses.

ping refers to the OS's resolution functions which includes the hosts file and so forth.

Not a bug & documented somewhere on microsoft.com. Ping will use any & all methods available to resolve a hostname & Windows generally starts with the hosts file. Nslookup ignores the hosts file completely.

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

SirHumphreyAppleby

2844 posts

Uber Geek

#3207812 19-Mar-2024 07:48

snj:

Not a bug actually, just a confusing thing with Windows, especially due to people that say nslookup is the equivalent of *nix 'host'.

The Windows nslookup is the equivalent of BIND's nslookup. BIND is a DNS resolver, so obviously being their tool and the ns* name gives away its purpose - to resolve via DNS.

BIND used to be a core part of *nix distributions, so it's the behaviour of Linux (and *BSD) moving from 'nslookup' to 'host' that is confusing, rather than the Windows behaviour which hasn't changed in decades.

evnafets

537 posts

Ultimate Geek

Lifetime subscriber

#3207865 19-Mar-2024 10:46

Actually I would argue that including the hosts file was a step towards making it less confusing.

The reason you are generally using these tools is that you are troubleshooting a network connection.

Having nslookup return a 'different' IP than the client would actually use for the connection is the 'confusing' bit.

Having it behave consistent to a wget or a curl to me is 'less confusing' behaviour even if it isn't technically 'correct'

timmmay

20574 posts

Uber Geek

Trusted

Lifetime subscriber

#3208125 19-Mar-2024 18:19

I was just pointing this out so others didn't miss it. I kinda knew this already, I just forgot to check the hosts file. I probably hard coded the domains when I had multiple servers running the same services.

nslookup is an explicit name server lookup directly to a name server, so it makes sense it's not picking up hosts files. ping just uses the underlying OS name resolution so it does pick up hosts files.

muppet

2566 posts

Uber Geek

Trusted

#3208155 19-Mar-2024 19:58

snj:

muppet:

Seems like a bug with ping - why doesn't it follow the same name resolution path?

Not a bug actually, just a confusing thing with Windows, especially due to people that say nslookup is the equivalent of *nix 'host'.

nslookup is specifically a tool to query a DNS server, (basically the Windows equivalent to bind's dig and so on), so doesn't rely on the host's resolution configuration, except to retrieve the default DNS server addresses.

ping refers to the OS's resolution functions which includes the hosts file and so forth.

From what I can tell there isn't a Windows equivalent of the *nix host command.

Yea makes perfect sense of course, I'd read it (wrongly) that ping wasn't looking in hosts and nslookup was. But it was the other way around.