Link to home
Start Free TrialLog in
Avatar of wrguy
wrguy

asked on

IIS 5.1 localhost very slowly responses when connected to Network

I've got a new Thinkpad laptop downgraded to XP pro SP2 that I do development work on.  It's running IIS 5.1 and SQL Server 2005.  Whenever it's connected to any network (either via ethernet, wireless, etc) IIS chugs and responses are VERY slow (20-40 secs for the localhost).  However, when I'm not connected to a network, the webserver is extremely fast.  There are a couple computers on this network, all with similar setups, and they all work fine.  I've checked my IP info with the router's DNS settings and the other computers, and it all matches.  If I do an ipconfig /release and /renew then things work great for a few seconds but then the server starts the slow responses once Windows acquires the network info.  A /flushdns only helps momentarily, but then the problem kicks in again once the network info is acquired.  Other computers get the same info from our router (DHCP) minus the IP address, and they work fine.  When it is connected to any network (I've tried multiple different networks),  it's as if the localhost is waiting for something before sending back any data.  I've tried with and without firewalls.  When unconnected, it works like a charm.   Any ideas?

Thanks!
Avatar of giltjr
giltjr
Flag of United States of America image

I would install a packet capture program (I use Wireshark, http://www.wireshark.org) and run a capture to see what is going over the wire.

Avatar of wrguy
wrguy

ASKER

Thanks for the suggestion.  I installed wireshark (which is pretty cool btw) and found that when connected, NetBIOS Name Service is sending packets to 192.168.0.255 from my IP.  When disconnected, these "requests" aren't being sent, which I'm guessing is the reason why things are responding so slowly.  We don't have any device on our network as 192.168.0.255, so I'm not sure why these requests are being sent there.  The Info section of Wireshark says "Name query NB ?<00>" or "Name query NB WPAD<00>"...for each click there's roughly between 12-18 of those packets.

So, if anyone knows a way to stop NBNS from sending those requests, it would be greatly appreciated!
When you do ipconfig /all, what do you see (if anything) for your WINS servers?

Either 192.168.0.255 is defined as a WINS server, or this happens to be the IP subnet broadcast address for your IP subnet.  

My guess is that is your IP broadcast address.  Your computer has attempted to look-up a host name using DNS and got back a "not found/no such host" and now your computer is sending a NBNS broadcast to try and find the IP address of some host.  It is waiting until it either gets a response or times out waiting for a response.

Your computer is attempting to find the Windows computer named ?, WPAD, and any other name that appears in the NBNS query.


If you  are in a Windows AD enviroment, then you may not need to have NETBIOS, so you could disable it.  However if you are not in a AD enviroment, you will need NETBIOS to do print and file sharing.  Please note, you could have other products/functions that depened on NETBIOS, so disabling it could lead to other problems.
Avatar of wrguy

ASKER

Interesting.  There's nothing in ipconfig /all for WINS (WINS Proxy Enabled....No).  I checked these settings with another computer that's almost the exact same hardware setup, and the only difference (other than IP address) is the Node Type.  Mine is set to Unknown, while the working one is set to Hybrid.  I'm guessing this means there's something amuck with the DNS we're using since it's not seeing my localhost as my computer right away?  If I replace locahost with 127.0.0.1 in the browser, the same problem persists.  I just took a look at Wireshark again, and it seems to be sending a DNS response to our ISP which bounces back the host not found reply, THEN it sends out the NBNS requests.       It almost looks like it might be sending DNS's directly to our ISP instead of handling it at the router...or is that what it always does?   Our router is a Dlink DIR655 EXtremeN:

Here's my ipconfig /all:

Windows IP Configuration
        Host Name . . . . . . . . . . . . : Jordan-3C6C62CE
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : **ISP**

Ethernet adapter Local Area Connection:
        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Intel(R) 82566MM Gigabit Network Connection
        Physical Address. . . . . . . . . : 00-1F-E2-16-68-85

Ethernet adapter Wireless Network Connection:
        Connection-specific DNS Suffix  . : **ISP**
        Description . . . . . . . . . . . : Intel(R) Wireless WiFi Link 4965AGN
        Physical Address. . . . . . . . . : **-**-**-**-**-**
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.0.172
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . . . . : 192.168.0.1
        DNS Servers . . . . . . . . . . . : 192.168.0.1
        Lease Obtained. . . . . . . . . . : Tuesday, October 07, 2008 9:59:10 AM
        Lease Expires . . . . . . . . . . : Wednesday, October 08, 2008 9:59:10 AM

O.K. 192.168.0.255 is your IP subnet broadcast address  This is gotten from the fact your IP address is 192.168.0.172 and your network mask is 255.255.255.0.  You IP subnet is 192.168.0.0 and the broadcast is 192.168.0.255.

Your only DNS server is 192.168.0.1, so all DNS requests should be going to that for name resolution requests.

The unknown type could be a know issue/proplem with Windows.  See:

     http://support.microsoft.com/kb/310570

You may want to verify that you have a valid hosts files on your computer.  Normally it is located at:

   c:\windows\system32\drivers\etc

and the file name is hosts.  It should have at least one entry:

127.0.0.1     localhost

Avatar of wrguy

ASKER

The host file only has one entry, which is 127.0.0.1   localhost.  It doesn't matter if I use localhost or 127.0.0.1...it still sends out the NBNS packets and takes a long time to respond.   I tried that KB article you sent, but it's a little misleading, as it just enables or disables the WINS proxy.  I took that key out and added a NodeType DWORD, with a value of 8 which set the NodeType to Hybrid...but it didn't solve the problem.    Do you know if there's anyway to edit the NetBIOS table settings or anything?

Thanks
After thinking about it a bit longer, changing the type really won't solve the problem, as you have found.  The issue is that your computer is attempting to find a host (or hosts) that do not have DNS entries anyplace.  So Windows uses NBNS as the last resort to find it.

Ah.  WPAD is short for Windows Proxy Auto Discovery, something that MS put there to try and automatically discover any proxy server.

In IE select Tools, Options, Connections, LAN settings and hopefully you will see "Automatically detected settings" checked.  If it is, uncheck it.

If it is not, then someplace you have a firewall client that is attempting to find a WPAD proxy or something else, like a DHCP server, is providing information to tell your computer to look for a WPAD.

Avatar of wrguy

ASKER

I checked my LAN settings, and the "Automatically detect settings" was unchecked.  For kicks I checked it, and not much has changed.  Through Wireshark, NBNS checks for NB ?<00> or NB ?<20> and occasionally NB WORKGROUP<00>.  So, we've narrowed it down to trying to find something on my computer that's looking for a WPAD or the ?<00>...whatever that is?    Is there a setting somewhere in Windows, other than the host file, that allows it to "Know" that a localhost request is part of the local machine, and shouldn't need to use DNS to find out where to find the requested files?
Avatar of wrguy

ASKER

Another update:  the URL I'm using is something like this "http://localhost/directory/application.exe".  If I allow directory browsing in IIS and try to hit "http://localhost/directory", the directory shows and there are no NBNS packets showing in Wireshark.  It appears as if the computer can identify the localhost, but when I try to run call the exe, it doesn't recognize it and starts sending out NBNS's.  does that make any sense?
SOLUTION
Avatar of giltjr
giltjr
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of wrguy

ASKER

Sorry the delay in responses.  I've been playing around with this setup and still haven't found an answer for what's triggering the host lookup.  Wireshark does report a number of NBNS requests for NB ?<00> or ?<20>, but no DNS requests for just "?".  After the first NBNS request, there is a DNS request for ?.isp.net....is that similar?  After that there are a couple more NBNS requests, a DNS for wpad.isp.net, some more NBNS requests, and then the app loads without any indication in Wireshark.

Unfortunately I can't run this app from the command line, so i can't test that.

If you have any more ideas, let me know, I'll try to respond quicker.

Thanks!
I just did a test and I could not get any DNS queries for a host name with a ? in it.   I only saw NBNS queries.

Something is definitely attempting to do a host look-up for a host with the name ? someplace.  The problem is trying to find out what is doing it.

If the ? queries only show up when running your application, then all I can suggest is that review you code to see where you may be doing some type of host look-up and make sure that it is getting a valid host name.  If you have debugging tools for your program, you may be able to step through the code and see where this might be happening.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial