Like This Blog 1

Added by Mike Danseglio June 18, 2014

I’ve published a number of articles on following a simple and straightforward troubleshooting methodology. I advocate a simple and focused approach shown in Figure 1. You can see that symptom identification is the first step, followed by root cause analysis and problem resolution.

Figure 1. MikeDan’s Quick and Dirty Troubleshooting Methodology.

There’s lots of great tools built right in to Windows that will actually help when narrowing down network communications problems. In this case, there’s a Windows feature that can cause DNS to be ignored. And it can occur on any current version of Windows including Windows 7, Windows XP, Windows Server 2008, Windows 8, and Windows Server 2012.

Windows Name Resolution

Windows has several ways to turn a friendly name into an IP address. In almost all modern networks, the primary method is via the Domain Name System (DNS). But other, less common, methods are built into Windows. They include, in no particular order:

• HOSTS file
• LMHOSTS file
• Windows Internet Name Service (WINS)
• Link Local Multicast Name Resolution (LLMNR)
• NetBIOS over TCP/IP (NetBT)

Only one of these can be used at a time, and Windows stops searching when it successfully resolves a name to an IP address.

Name Resolution Methods and Order

The methods that Windows uses for name resolution, and the order those methods are invoked in, are controlled by the Windows Node Type. Node Type is easily displayed with the all-too-common ipconfig/all command.

Part of a TCP/IP configuration from ipconfig/all is shown here with Node Type highlighted:

With this configuration, the Peer-Peer Node Type is the problem.

Why Is The Peer-Peer Node Type The Problem?

Basically, the Peer-Peer Node Type uses WINS for name resolution. And it only uses WINS. If you have a DNS server configured, Peer-Peer effectively ignores it. Peer-Peer also ignores HOSTS files and all other forms of name resolution.

This behavior makes it difficult to pinpoint as a root cause. For example, you can use NSLookup to resolve a hostname on a Peer-Peer node and it will resolve correctly. However, attempting to reach the host via UNC path will result in an error.

How Do You Fix Peer-Peer Node Type?

Fixing this problem is fairly easy. Here’s how you do it:
1. Run the Registry Editor (Regedit.exe)

2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT \Parameters

3. Delete the two values (if only one is there, delete that one):

• DhcpNodeType
• NodeType

4. Reboot the computer

Deleting the node type and rebooting the computer forces Windows to reevaluate name resolution. If your DHCP server is providing a DNS entry, it should switch the node type to one that supports DNS resolution

Enjoy!
Mike Danseglio -CISSP / CEH
Interface Technical Training – Technical Director and Instructor