Reverse lookups in a Windows domain

Forums › IT Pro and developers › Reverse lookups in a Windows domain

tigercorp

620 posts

Ultimate Geek
+1 received by user: 54

Subscriber

Topic # 87331 26-Jul-2011 09:45

Howdy,

So my problem is that the application I support is suddenly taking 12s to return a hostname for a given IP. Prior to D day, it was taking a more acceptable 1-5s. I've got the task of convincing IT its their network thats changed as opposed to our application.

I imagine its a fairly typical Win2003 domain (don't have sys admin rights so can't nose about) with Windows running the DNS and DHCP.
Using nslookup tells me that there are no Reverse Lookup zones configured (i.e 2s timeout when querying by IP)
On the server NICs there's no defined WINS server, LMHosts lookup is not enabled and NetBIOS is set to "Default-Use NetBIOS settings from the DHCP server".
There are no Host file entries on any of the servers.
Server dns and arp caches have been flushed.

The connecting clients have a mixture of both static and dynamic IPs

My questions is, how does reverse lookup even happen in this type of environment anyway?

Ragnor

8027 posts

Uber Geek
+1 received by user: 387

Trusted

Subscriber

Reply # 497926 26-Jul-2011 11:02

Does nbstat -c or nbstat -r (start > run > cmd > nbstat ?) give you any useful info?

tigercorp

620 posts

Ultimate Geek
+1 received by user: 54

Subscriber

Reply # 498023 26-Jul-2011 13:54

Ragnor: Does nbstat -c or nbstat -r (start > run > cmd > nbstat ?) give you any useful info?

Brilliant, thanks for that.

Running nbtstat -c regularly is showing the netbios cache is being updated, which seems to be the only source of reverse lookups.
-r is shows that the vast majority of resolutions are being done by Broadcast which'll explain the increased times in the app logs.

So I wonder what could change on a network to go from an average of 3s resolution to over 12s??