IIS 5.1 localhost very slowly responses when connected to Network

Posted on 2008-10-06
Last Modified: 2008-10-25
I've got a new Thinkpad laptop downgraded to XP pro SP2 that I do development work on.  It's running IIS 5.1 and SQL Server 2005.  Whenever it's connected to any network (either via ethernet, wireless, etc) IIS chugs and responses are VERY slow (20-40 secs for the localhost).  However, when I'm not connected to a network, the webserver is extremely fast.  There are a couple computers on this network, all with similar setups, and they all work fine.  I've checked my IP info with the router's DNS settings and the other computers, and it all matches.  If I do an ipconfig /release and /renew then things work great for a few seconds but then the server starts the slow responses once Windows acquires the network info.  A /flushdns only helps momentarily, but then the problem kicks in again once the network info is acquired.  Other computers get the same info from our router (DHCP) minus the IP address, and they work fine.  When it is connected to any network (I've tried multiple different networks),  it's as if the localhost is waiting for something before sending back any data.  I've tried with and without firewalls.  When unconnected, it works like a charm.   Any ideas?

Question by:wrguy
  • 7
  • 6
LVL 57

Expert Comment

ID: 22658423
I would install a packet capture program (I use Wireshark, and run a capture to see what is going over the wire.


Author Comment

ID: 22659545
Thanks for the suggestion.  I installed wireshark (which is pretty cool btw) and found that when connected, NetBIOS Name Service is sending packets to from my IP.  When disconnected, these "requests" aren't being sent, which I'm guessing is the reason why things are responding so slowly.  We don't have any device on our network as, so I'm not sure why these requests are being sent there.  The Info section of Wireshark says "Name query NB ?<00>" or "Name query NB WPAD<00>"...for each click there's roughly between 12-18 of those packets.

So, if anyone knows a way to stop NBNS from sending those requests, it would be greatly appreciated!
LVL 57

Expert Comment

ID: 22659675
When you do ipconfig /all, what do you see (if anything) for your WINS servers?

Either is defined as a WINS server, or this happens to be the IP subnet broadcast address for your IP subnet.  

My guess is that is your IP broadcast address.  Your computer has attempted to look-up a host name using DNS and got back a "not found/no such host" and now your computer is sending a NBNS broadcast to try and find the IP address of some host.  It is waiting until it either gets a response or times out waiting for a response.

Your computer is attempting to find the Windows computer named ?, WPAD, and any other name that appears in the NBNS query.

If you  are in a Windows AD enviroment, then you may not need to have NETBIOS, so you could disable it.  However if you are not in a AD enviroment, you will need NETBIOS to do print and file sharing.  Please note, you could have other products/functions that depened on NETBIOS, so disabling it could lead to other problems.

Author Comment

ID: 22660017
Interesting.  There's nothing in ipconfig /all for WINS (WINS Proxy Enabled....No).  I checked these settings with another computer that's almost the exact same hardware setup, and the only difference (other than IP address) is the Node Type.  Mine is set to Unknown, while the working one is set to Hybrid.  I'm guessing this means there's something amuck with the DNS we're using since it's not seeing my localhost as my computer right away?  If I replace locahost with in the browser, the same problem persists.  I just took a look at Wireshark again, and it seems to be sending a DNS response to our ISP which bounces back the host not found reply, THEN it sends out the NBNS requests.       It almost looks like it might be sending DNS's directly to our ISP instead of handling it at the router...or is that what it always does?   Our router is a Dlink DIR655 EXtremeN:

Here's my ipconfig /all:

Windows IP Configuration
        Host Name . . . . . . . . . . . . : Jordan-3C6C62CE
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : **ISP**

Ethernet adapter Local Area Connection:
        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Intel(R) 82566MM Gigabit Network Connection
        Physical Address. . . . . . . . . : 00-1F-E2-16-68-85

Ethernet adapter Wireless Network Connection:
        Connection-specific DNS Suffix  . : **ISP**
        Description . . . . . . . . . . . : Intel(R) Wireless WiFi Link 4965AGN
        Physical Address. . . . . . . . . : **-**-**-**-**-**
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . :
        Subnet Mask . . . . . . . . . . . :
        Default Gateway . . . . . . . . . :
        DHCP Server . . . . . . . . . . . :
        DNS Servers . . . . . . . . . . . :
        Lease Obtained. . . . . . . . . . : Tuesday, October 07, 2008 9:59:10 AM
        Lease Expires . . . . . . . . . . : Wednesday, October 08, 2008 9:59:10 AM

LVL 57

Expert Comment

ID: 22660141
O.K. is your IP subnet broadcast address  This is gotten from the fact your IP address is and your network mask is  You IP subnet is and the broadcast is

Your only DNS server is, so all DNS requests should be going to that for name resolution requests.

The unknown type could be a know issue/proplem with Windows.  See:

You may want to verify that you have a valid hosts files on your computer.  Normally it is located at:


and the file name is hosts.  It should have at least one entry:     localhost


Author Comment

ID: 22660778
The host file only has one entry, which is   localhost.  It doesn't matter if I use localhost or still sends out the NBNS packets and takes a long time to respond.   I tried that KB article you sent, but it's a little misleading, as it just enables or disables the WINS proxy.  I took that key out and added a NodeType DWORD, with a value of 8 which set the NodeType to Hybrid...but it didn't solve the problem.    Do you know if there's anyway to edit the NetBIOS table settings or anything?

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

LVL 57

Expert Comment

ID: 22661416
After thinking about it a bit longer, changing the type really won't solve the problem, as you have found.  The issue is that your computer is attempting to find a host (or hosts) that do not have DNS entries anyplace.  So Windows uses NBNS as the last resort to find it.

Ah.  WPAD is short for Windows Proxy Auto Discovery, something that MS put there to try and automatically discover any proxy server.

In IE select Tools, Options, Connections, LAN settings and hopefully you will see "Automatically detected settings" checked.  If it is, uncheck it.

If it is not, then someplace you have a firewall client that is attempting to find a WPAD proxy or something else, like a DHCP server, is providing information to tell your computer to look for a WPAD.


Author Comment

ID: 22663163
I checked my LAN settings, and the "Automatically detect settings" was unchecked.  For kicks I checked it, and not much has changed.  Through Wireshark, NBNS checks for NB ?<00> or NB ?<20> and occasionally NB WORKGROUP<00>.  So, we've narrowed it down to trying to find something on my computer that's looking for a WPAD or the ?<00>...whatever that is?    Is there a setting somewhere in Windows, other than the host file, that allows it to "Know" that a localhost request is part of the local machine, and shouldn't need to use DNS to find out where to find the requested files?

Author Comment

ID: 22663373
Another update:  the URL I'm using is something like this "http://localhost/directory/application.exe".  If I allow directory browsing in IIS and try to hit "http://localhost/directory", the directory shows and there are no NBNS packets showing in Wireshark.  It appears as if the computer can identify the localhost, but when I try to run call the exe, it doesn't recognize it and starts sending out NBNS's.  does that make any sense?
LVL 57

Assisted Solution

giltjr earned 300 total points
ID: 22664903
It should find localhost quickly and this is shown when you only do a directory browse.

My guess is something in "application.exe" is attempting to find a network resource that is trigging something that causes the look for other hosts.

Do you see DNS requests for "?"

I'll thinkg about it some more, but you may want to see what happens if you just execute that pgm from a command prompt and not via the web server, if that is possible.

Author Comment

ID: 22711156
Sorry the delay in responses.  I've been playing around with this setup and still haven't found an answer for what's triggering the host lookup.  Wireshark does report a number of NBNS requests for NB ?<00> or ?<20>, but no DNS requests for just "?".  After the first NBNS request, there is a DNS request for ? that similar?  After that there are a couple more NBNS requests, a DNS for, some more NBNS requests, and then the app loads without any indication in Wireshark.

Unfortunately I can't run this app from the command line, so i can't test that.

If you have any more ideas, let me know, I'll try to respond quicker.

LVL 57

Expert Comment

ID: 22712484
I just did a test and I could not get any DNS queries for a host name with a ? in it.   I only saw NBNS queries.

Something is definitely attempting to do a host look-up for a host with the name ? someplace.  The problem is trying to find out what is doing it.

If the ? queries only show up when running your application, then all I can suggest is that review you code to see where you may be doing some type of host look-up and make sure that it is getting a valid host name.  If you have debugging tools for your program, you may be able to step through the code and see where this might be happening.

Accepted Solution

wrguy earned 0 total points
ID: 22762382
I haven't figured out what is causing the NBNS queries,  but there is a .dll of this app that runs quick on my system.  I've been using that for the past week or so and haven't had any problems.  Thanks for your suggestions, I'm going to close this question as we've at least narrowed down the exe sending out NetBios queries and I'm hitting a dead I've found a solution that works for me with the dll version.  Thanks again!

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

25 Experts available now in Live!

Get 1:1 Help Now