IIS 5.1 localhost very slowly responses when connected to Network

I've got a new Thinkpad laptop downgraded to XP pro SP2 that I do development work on.  It's running IIS 5.1 and SQL Server 2005.  Whenever it's connected to any network (either via ethernet, wireless, etc) IIS chugs and responses are VERY slow (20-40 secs for the localhost).  However, when I'm not connected to a network, the webserver is extremely fast.  There are a couple computers on this network, all with similar setups, and they all work fine.  I've checked my IP info with the router's DNS settings and the other computers, and it all matches.  If I do an ipconfig /release and /renew then things work great for a few seconds but then the server starts the slow responses once Windows acquires the network info.  A /flushdns only helps momentarily, but then the problem kicks in again once the network info is acquired.  Other computers get the same info from our router (DHCP) minus the IP address, and they work fine.  When it is connected to any network (I've tried multiple different networks),  it's as if the localhost is waiting for something before sending back any data.  I've tried with and without firewalls.  When unconnected, it works like a charm.   Any ideas?

Who is Participating?
wrguyConnect With a Mentor Author Commented:
I haven't figured out what is causing the NBNS queries,  but there is a .dll of this app that runs quick on my system.  I've been using that for the past week or so and haven't had any problems.  Thanks for your suggestions, I'm going to close this question as we've at least narrowed down the exe sending out NetBios queries and I'm hitting a dead end....plus I've found a solution that works for me with the dll version.  Thanks again!
I would install a packet capture program (I use Wireshark, http://www.wireshark.org) and run a capture to see what is going over the wire.

wrguyAuthor Commented:
Thanks for the suggestion.  I installed wireshark (which is pretty cool btw) and found that when connected, NetBIOS Name Service is sending packets to from my IP.  When disconnected, these "requests" aren't being sent, which I'm guessing is the reason why things are responding so slowly.  We don't have any device on our network as, so I'm not sure why these requests are being sent there.  The Info section of Wireshark says "Name query NB ?<00>" or "Name query NB WPAD<00>"...for each click there's roughly between 12-18 of those packets.

So, if anyone knows a way to stop NBNS from sending those requests, it would be greatly appreciated!
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

When you do ipconfig /all, what do you see (if anything) for your WINS servers?

Either is defined as a WINS server, or this happens to be the IP subnet broadcast address for your IP subnet.  

My guess is that is your IP broadcast address.  Your computer has attempted to look-up a host name using DNS and got back a "not found/no such host" and now your computer is sending a NBNS broadcast to try and find the IP address of some host.  It is waiting until it either gets a response or times out waiting for a response.

Your computer is attempting to find the Windows computer named ?, WPAD, and any other name that appears in the NBNS query.

If you  are in a Windows AD enviroment, then you may not need to have NETBIOS, so you could disable it.  However if you are not in a AD enviroment, you will need NETBIOS to do print and file sharing.  Please note, you could have other products/functions that depened on NETBIOS, so disabling it could lead to other problems.
wrguyAuthor Commented:
Interesting.  There's nothing in ipconfig /all for WINS (WINS Proxy Enabled....No).  I checked these settings with another computer that's almost the exact same hardware setup, and the only difference (other than IP address) is the Node Type.  Mine is set to Unknown, while the working one is set to Hybrid.  I'm guessing this means there's something amuck with the DNS we're using since it's not seeing my localhost as my computer right away?  If I replace locahost with in the browser, the same problem persists.  I just took a look at Wireshark again, and it seems to be sending a DNS response to our ISP which bounces back the host not found reply, THEN it sends out the NBNS requests.       It almost looks like it might be sending DNS's directly to our ISP instead of handling it at the router...or is that what it always does?   Our router is a Dlink DIR655 EXtremeN:

Here's my ipconfig /all:

Windows IP Configuration
        Host Name . . . . . . . . . . . . : Jordan-3C6C62CE
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : **ISP**

Ethernet adapter Local Area Connection:
        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Intel(R) 82566MM Gigabit Network Connection
        Physical Address. . . . . . . . . : 00-1F-E2-16-68-85

Ethernet adapter Wireless Network Connection:
        Connection-specific DNS Suffix  . : **ISP**
        Description . . . . . . . . . . . : Intel(R) Wireless WiFi Link 4965AGN
        Physical Address. . . . . . . . . : **-**-**-**-**-**
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . :
        Subnet Mask . . . . . . . . . . . :
        Default Gateway . . . . . . . . . :
        DHCP Server . . . . . . . . . . . :
        DNS Servers . . . . . . . . . . . :
        Lease Obtained. . . . . . . . . . : Tuesday, October 07, 2008 9:59:10 AM
        Lease Expires . . . . . . . . . . : Wednesday, October 08, 2008 9:59:10 AM

O.K. is your IP subnet broadcast address  This is gotten from the fact your IP address is and your network mask is  You IP subnet is and the broadcast is

Your only DNS server is, so all DNS requests should be going to that for name resolution requests.

The unknown type could be a know issue/proplem with Windows.  See:


You may want to verify that you have a valid hosts files on your computer.  Normally it is located at:


and the file name is hosts.  It should have at least one entry:     localhost

wrguyAuthor Commented:
The host file only has one entry, which is   localhost.  It doesn't matter if I use localhost or still sends out the NBNS packets and takes a long time to respond.   I tried that KB article you sent, but it's a little misleading, as it just enables or disables the WINS proxy.  I took that key out and added a NodeType DWORD, with a value of 8 which set the NodeType to Hybrid...but it didn't solve the problem.    Do you know if there's anyway to edit the NetBIOS table settings or anything?

After thinking about it a bit longer, changing the type really won't solve the problem, as you have found.  The issue is that your computer is attempting to find a host (or hosts) that do not have DNS entries anyplace.  So Windows uses NBNS as the last resort to find it.

Ah.  WPAD is short for Windows Proxy Auto Discovery, something that MS put there to try and automatically discover any proxy server.

In IE select Tools, Options, Connections, LAN settings and hopefully you will see "Automatically detected settings" checked.  If it is, uncheck it.

If it is not, then someplace you have a firewall client that is attempting to find a WPAD proxy or something else, like a DHCP server, is providing information to tell your computer to look for a WPAD.

wrguyAuthor Commented:
I checked my LAN settings, and the "Automatically detect settings" was unchecked.  For kicks I checked it, and not much has changed.  Through Wireshark, NBNS checks for NB ?<00> or NB ?<20> and occasionally NB WORKGROUP<00>.  So, we've narrowed it down to trying to find something on my computer that's looking for a WPAD or the ?<00>...whatever that is?    Is there a setting somewhere in Windows, other than the host file, that allows it to "Know" that a localhost request is part of the local machine, and shouldn't need to use DNS to find out where to find the requested files?
wrguyAuthor Commented:
Another update:  the URL I'm using is something like this "http://localhost/directory/application.exe".  If I allow directory browsing in IIS and try to hit "http://localhost/directory", the directory shows and there are no NBNS packets showing in Wireshark.  It appears as if the computer can identify the localhost, but when I try to run call the exe, it doesn't recognize it and starts sending out NBNS's.  does that make any sense?
giltjrConnect With a Mentor Commented:
It should find localhost quickly and this is shown when you only do a directory browse.

My guess is something in "application.exe" is attempting to find a network resource that is trigging something that causes the look for other hosts.

Do you see DNS requests for "?"

I'll thinkg about it some more, but you may want to see what happens if you just execute that pgm from a command prompt and not via the web server, if that is possible.
wrguyAuthor Commented:
Sorry the delay in responses.  I've been playing around with this setup and still haven't found an answer for what's triggering the host lookup.  Wireshark does report a number of NBNS requests for NB ?<00> or ?<20>, but no DNS requests for just "?".  After the first NBNS request, there is a DNS request for ?.isp.net....is that similar?  After that there are a couple more NBNS requests, a DNS for wpad.isp.net, some more NBNS requests, and then the app loads without any indication in Wireshark.

Unfortunately I can't run this app from the command line, so i can't test that.

If you have any more ideas, let me know, I'll try to respond quicker.

I just did a test and I could not get any DNS queries for a host name with a ? in it.   I only saw NBNS queries.

Something is definitely attempting to do a host look-up for a host with the name ? someplace.  The problem is trying to find out what is doing it.

If the ? queries only show up when running your application, then all I can suggest is that review you code to see where you may be doing some type of host look-up and make sure that it is getting a valid host name.  If you have debugging tools for your program, you may be able to step through the code and see where this might be happening.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.