Solved

IIS 5.1 localhost very slowly responses when connected to Network

Posted on 2008-10-06
13
1,749 Views
Last Modified: 2008-10-25
I've got a new Thinkpad laptop downgraded to XP pro SP2 that I do development work on.  It's running IIS 5.1 and SQL Server 2005.  Whenever it's connected to any network (either via ethernet, wireless, etc) IIS chugs and responses are VERY slow (20-40 secs for the localhost).  However, when I'm not connected to a network, the webserver is extremely fast.  There are a couple computers on this network, all with similar setups, and they all work fine.  I've checked my IP info with the router's DNS settings and the other computers, and it all matches.  If I do an ipconfig /release and /renew then things work great for a few seconds but then the server starts the slow responses once Windows acquires the network info.  A /flushdns only helps momentarily, but then the problem kicks in again once the network info is acquired.  Other computers get the same info from our router (DHCP) minus the IP address, and they work fine.  When it is connected to any network (I've tried multiple different networks),  it's as if the localhost is waiting for something before sending back any data.  I've tried with and without firewalls.  When unconnected, it works like a charm.   Any ideas?

Thanks!
0
Comment
Question by:wrguy
  • 7
  • 6
13 Comments
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
I would install a packet capture program (I use Wireshark, http://www.wireshark.org) and run a capture to see what is going over the wire.

0
 

Author Comment

by:wrguy
Comment Utility
Thanks for the suggestion.  I installed wireshark (which is pretty cool btw) and found that when connected, NetBIOS Name Service is sending packets to 192.168.0.255 from my IP.  When disconnected, these "requests" aren't being sent, which I'm guessing is the reason why things are responding so slowly.  We don't have any device on our network as 192.168.0.255, so I'm not sure why these requests are being sent there.  The Info section of Wireshark says "Name query NB ?<00>" or "Name query NB WPAD<00>"...for each click there's roughly between 12-18 of those packets.

So, if anyone knows a way to stop NBNS from sending those requests, it would be greatly appreciated!
0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
When you do ipconfig /all, what do you see (if anything) for your WINS servers?

Either 192.168.0.255 is defined as a WINS server, or this happens to be the IP subnet broadcast address for your IP subnet.  

My guess is that is your IP broadcast address.  Your computer has attempted to look-up a host name using DNS and got back a "not found/no such host" and now your computer is sending a NBNS broadcast to try and find the IP address of some host.  It is waiting until it either gets a response or times out waiting for a response.

Your computer is attempting to find the Windows computer named ?, WPAD, and any other name that appears in the NBNS query.


If you  are in a Windows AD enviroment, then you may not need to have NETBIOS, so you could disable it.  However if you are not in a AD enviroment, you will need NETBIOS to do print and file sharing.  Please note, you could have other products/functions that depened on NETBIOS, so disabling it could lead to other problems.
0
 

Author Comment

by:wrguy
Comment Utility
Interesting.  There's nothing in ipconfig /all for WINS (WINS Proxy Enabled....No).  I checked these settings with another computer that's almost the exact same hardware setup, and the only difference (other than IP address) is the Node Type.  Mine is set to Unknown, while the working one is set to Hybrid.  I'm guessing this means there's something amuck with the DNS we're using since it's not seeing my localhost as my computer right away?  If I replace locahost with 127.0.0.1 in the browser, the same problem persists.  I just took a look at Wireshark again, and it seems to be sending a DNS response to our ISP which bounces back the host not found reply, THEN it sends out the NBNS requests.       It almost looks like it might be sending DNS's directly to our ISP instead of handling it at the router...or is that what it always does?   Our router is a Dlink DIR655 EXtremeN:

Here's my ipconfig /all:

Windows IP Configuration
        Host Name . . . . . . . . . . . . : Jordan-3C6C62CE
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : **ISP**

Ethernet adapter Local Area Connection:
        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Intel(R) 82566MM Gigabit Network Connection
        Physical Address. . . . . . . . . : 00-1F-E2-16-68-85

Ethernet adapter Wireless Network Connection:
        Connection-specific DNS Suffix  . : **ISP**
        Description . . . . . . . . . . . : Intel(R) Wireless WiFi Link 4965AGN
        Physical Address. . . . . . . . . : **-**-**-**-**-**
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.0.172
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . . . . : 192.168.0.1
        DNS Servers . . . . . . . . . . . : 192.168.0.1
        Lease Obtained. . . . . . . . . . : Tuesday, October 07, 2008 9:59:10 AM
        Lease Expires . . . . . . . . . . : Wednesday, October 08, 2008 9:59:10 AM

0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
O.K. 192.168.0.255 is your IP subnet broadcast address  This is gotten from the fact your IP address is 192.168.0.172 and your network mask is 255.255.255.0.  You IP subnet is 192.168.0.0 and the broadcast is 192.168.0.255.

Your only DNS server is 192.168.0.1, so all DNS requests should be going to that for name resolution requests.

The unknown type could be a know issue/proplem with Windows.  See:

     http://support.microsoft.com/kb/310570

You may want to verify that you have a valid hosts files on your computer.  Normally it is located at:

   c:\windows\system32\drivers\etc

and the file name is hosts.  It should have at least one entry:

127.0.0.1     localhost

0
 

Author Comment

by:wrguy
Comment Utility
The host file only has one entry, which is 127.0.0.1   localhost.  It doesn't matter if I use localhost or 127.0.0.1...it still sends out the NBNS packets and takes a long time to respond.   I tried that KB article you sent, but it's a little misleading, as it just enables or disables the WINS proxy.  I took that key out and added a NodeType DWORD, with a value of 8 which set the NodeType to Hybrid...but it didn't solve the problem.    Do you know if there's anyway to edit the NetBIOS table settings or anything?

Thanks
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 57

Expert Comment

by:giltjr
Comment Utility
After thinking about it a bit longer, changing the type really won't solve the problem, as you have found.  The issue is that your computer is attempting to find a host (or hosts) that do not have DNS entries anyplace.  So Windows uses NBNS as the last resort to find it.

Ah.  WPAD is short for Windows Proxy Auto Discovery, something that MS put there to try and automatically discover any proxy server.

In IE select Tools, Options, Connections, LAN settings and hopefully you will see "Automatically detected settings" checked.  If it is, uncheck it.

If it is not, then someplace you have a firewall client that is attempting to find a WPAD proxy or something else, like a DHCP server, is providing information to tell your computer to look for a WPAD.

0
 

Author Comment

by:wrguy
Comment Utility
I checked my LAN settings, and the "Automatically detect settings" was unchecked.  For kicks I checked it, and not much has changed.  Through Wireshark, NBNS checks for NB ?<00> or NB ?<20> and occasionally NB WORKGROUP<00>.  So, we've narrowed it down to trying to find something on my computer that's looking for a WPAD or the ?<00>...whatever that is?    Is there a setting somewhere in Windows, other than the host file, that allows it to "Know" that a localhost request is part of the local machine, and shouldn't need to use DNS to find out where to find the requested files?
0
 

Author Comment

by:wrguy
Comment Utility
Another update:  the URL I'm using is something like this "http://localhost/directory/application.exe".  If I allow directory browsing in IIS and try to hit "http://localhost/directory", the directory shows and there are no NBNS packets showing in Wireshark.  It appears as if the computer can identify the localhost, but when I try to run call the exe, it doesn't recognize it and starts sending out NBNS's.  does that make any sense?
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 300 total points
Comment Utility
It should find localhost quickly and this is shown when you only do a directory browse.

My guess is something in "application.exe" is attempting to find a network resource that is trigging something that causes the look for other hosts.

Do you see DNS requests for "?"

I'll thinkg about it some more, but you may want to see what happens if you just execute that pgm from a command prompt and not via the web server, if that is possible.
0
 

Author Comment

by:wrguy
Comment Utility
Sorry the delay in responses.  I've been playing around with this setup and still haven't found an answer for what's triggering the host lookup.  Wireshark does report a number of NBNS requests for NB ?<00> or ?<20>, but no DNS requests for just "?".  After the first NBNS request, there is a DNS request for ?.isp.net....is that similar?  After that there are a couple more NBNS requests, a DNS for wpad.isp.net, some more NBNS requests, and then the app loads without any indication in Wireshark.

Unfortunately I can't run this app from the command line, so i can't test that.

If you have any more ideas, let me know, I'll try to respond quicker.

Thanks!
0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
I just did a test and I could not get any DNS queries for a host name with a ? in it.   I only saw NBNS queries.

Something is definitely attempting to do a host look-up for a host with the name ? someplace.  The problem is trying to find out what is doing it.

If the ? queries only show up when running your application, then all I can suggest is that review you code to see where you may be doing some type of host look-up and make sure that it is getting a valid host name.  If you have debugging tools for your program, you may be able to step through the code and see where this might be happening.
0
 

Accepted Solution

by:
wrguy earned 0 total points
Comment Utility
I haven't figured out what is causing the NBNS queries,  but there is a .dll of this app that runs quick on my system.  I've been using that for the past week or so and haven't had any problems.  Thanks for your suggestions, I'm going to close this question as we've at least narrowed down the exe sending out NetBios queries and I'm hitting a dead end....plus I've found a solution that works for me with the dll version.  Thanks again!
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now