Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

the difference between nslookup and ping?

0 views

Skip to first unread message

Deadgame

unread,

Feb 1, 2003, 10:26:12 AM2/1/03

Hello, I am having some trouble accessing www.winternals.com or
www.sysinternals.com. I have localized it to a single computer having a
name resolution issue with just these two domain names. I can get the
address using nslookup but when I ping, I get a loopback response. I have
two computers behind a BEFSR41. One machine is Windows 2000 Pro, the other
is Windows .Net Server 2003 running DNS. I have my DNS setup with
forwarders to my ISP's DNS server. here are the results of my queries. You
may find this interesting that I am not experiencing this problem on the
.Net server it'self. I have also attempted to change the DNS addresses on
my 2k pro box to my ISP's DNS and this did not produce the desired result.
Funny thing is, AFAIK, I pretty much get around fine everywhere else. At
this moment I am not sure what makes the winternals site so special. My
Hosts file is clean, my lmhosts file is clean. I have no WINS. Any ideas
as to what I could try to troubleshoot my name resolution problem?

C:\>nslookup
Default Server: w2ksrv1.net-domain1.com
Address: 192.168.1.101

> www.winternals.com
Server: w2ksrv1.net-domain1.com
Address: 192.168.1.101

Name: winternals.com
Address: 216.142.16.240
Aliases: www.winternals.com

>
C:\>ping www.winternals.com

Pinging www.winternals.com [127.0.0.1] with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

x y

unread,

Feb 1, 2003, 1:47:16 PM2/1/03

Well, if you haven't yet, try clearing out your DNS and WINS name caches.
AFAIK, NSLOOKUP doesn't bother to look at the cached information, whereas
ping does. With Windows 2000, that would be IPCONFIG /FLUSHDNS and
NBTSTAT -R Looking at the cache using IPCONFIG /DISPLAYDNS and
NBTSTAT -c might also be interesting.

If that doesn't work, you could try using a sniffer to see what is going on:

http://securityadmin.info/faq.htm#sniffer

"Deadgame" <el...@mindless.com> wrote in message
news:3b43835b.03020...@posting.google.com...

bob bobbson

unread,

Feb 2, 2003, 12:57:07 AM2/2/03

Sounds like you have a hosts file or something.
Nslookup would send the request to the DNS server but ping would
follow the normal path for name resolution and could use a hosts file
if it were on the machine.

bob bobbson

unread,

Feb 2, 2003, 1:00:02 AM2/2/03

Bah, forget it. I just re-read your post and you've checked the hosts
file. =)

Daniel Tan

unread,

Feb 2, 2003, 7:40:01 AM2/2/03

Hi, is nslookup stands for name server lookup ? whats the purpose of
having nslookup instead of using ping ? Thanks.

Regards,
Daniel

"x y" <levin...@despammed.com> wrote in message news:<uwDq4KiyCHA.2288@TK2MSFTNGP09>...

Deadgame

unread,

Feb 2, 2003, 12:25:11 PM2/2/03

Thanks for the responses. The first thing I did was a /flushdns. the
/displaydns was quite surprising. it appears that many domain names
have this 127.0.0.1. /Flushdns does not appear to be able to clear
these listings out though. Any clues as to how I can accomplish this?
Thanks again to both of you.

bob bobbson <b...@bob.com> wrote in message news:<iscp3vsk55n6v30ik...@4ax.com>...

Deadgame

unread,

Feb 2, 2003, 12:38:35 PM2/2/03

upon futher inspection, I found that my HOSTS file was indeed fludded
with entries I can only assume was caused by a trojan or virus or some
other mechanism I would not have any idea how this happened. the
entries are added just below where you would have to scroll down a bit
to get to them.
Thanks for the help!
example below:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host
name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost

el...@mindless.com (Deadgame) wrote in message news:<3b43835b.03020...@posting.google.com>...

William Stacey [MVP]

unread,

Feb 2, 2003, 3:02:58 PM2/2/03

That is weird. I was going to say it had to be hosts file too as those are
the only ones that do not get cleared from the cache. Glad you found it.
Did you figure out what virus this was?

--
William Stacey, MCSE
Windows MVP (DNS/DHCP/WINS)

"Deadgame" <el...@mindless.com> wrote in message
news:3b43835b.03020...@posting.google.com...

Ace Fekay [MVP]

unread,

Feb 2, 2003, 9:48:10 PM2/2/03

I have to say I'm intrigued on how the trojan/virus writers did this that I
have to save this as an example to show my students of one of the things
(besides many others) to look for in case one thinks that their machine is
infected.

--
Ace
Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
--

"William Stacey [MVP]" <sta...@mvps.org> wrote in message
news:eIbNdXvyCHA.2684@TK2MSFTNGP11...

William Stacey [MVP]

unread,

Feb 1, 2003, 12:21:35 PM2/1/03

ping will answer out of cached RR while nslookup will go right to the dns
server.
Clear your cache using ipconfig /flushdns and try the ping again. If same
issue, lets see an "ipconfig /all"

--
William Stacey
Windows MVP (DNS/DHCP/WINS)

"Deadgame" <el...@mindless.com> wrote in message
news:3b43835b.03020...@posting.google.com...

Benjamin Hudgens

unread,

Feb 5, 2003, 1:33:33 PM2/5/03

Based on your description, this points to a hosts file. Are you sure
you are checking:

%SystemRoot%\system32\drivers\etc\hosts

I realize you've stated this is clean. If completely clean, rename it
to something different, disable and re-enable your network adapter,
and try again.

Ping will not resolve using LMHOSTS or WINS. These are for NETBIOS
traffic only.

Also, run:

ipconfig /displaydns | find /i "216.140.16.252"

and

ipconfig /displaydns | find /i "216.140.17.252"

If neither of these are found, you are not reaching the DNS lookup
part of resolution.

What do you see when you type: 'Set | find /i "SystemRoot"'

~Benjamin

----------------------------------------
Benjamin Hudgens
Winternals Software
Network Administrator

0 new messages