Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


IIS 5.1 localhost very slowly responses when connected to Network

Posted on 2008-10-06
Medium Priority
Last Modified: 2008-10-25
I've got a new Thinkpad laptop downgraded to XP pro SP2 that I do development work on.  It's running IIS 5.1 and SQL Server 2005.  Whenever it's connected to any network (either via ethernet, wireless, etc) IIS chugs and responses are VERY slow (20-40 secs for the localhost).  However, when I'm not connected to a network, the webserver is extremely fast.  There are a couple computers on this network, all with similar setups, and they all work fine.  I've checked my IP info with the router's DNS settings and the other computers, and it all matches.  If I do an ipconfig /release and /renew then things work great for a few seconds but then the server starts the slow responses once Windows acquires the network info.  A /flushdns only helps momentarily, but then the problem kicks in again once the network info is acquired.  Other computers get the same info from our router (DHCP) minus the IP address, and they work fine.  When it is connected to any network (I've tried multiple different networks),  it's as if the localhost is waiting for something before sending back any data.  I've tried with and without firewalls.  When unconnected, it works like a charm.   Any ideas?

Question by:wrguy
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 6
LVL 57

Expert Comment

ID: 22658423
I would install a packet capture program (I use Wireshark, http://www.wireshark.org) and run a capture to see what is going over the wire.


Author Comment

ID: 22659545
Thanks for the suggestion.  I installed wireshark (which is pretty cool btw) and found that when connected, NetBIOS Name Service is sending packets to from my IP.  When disconnected, these "requests" aren't being sent, which I'm guessing is the reason why things are responding so slowly.  We don't have any device on our network as, so I'm not sure why these requests are being sent there.  The Info section of Wireshark says "Name query NB ?<00>" or "Name query NB WPAD<00>"...for each click there's roughly between 12-18 of those packets.

So, if anyone knows a way to stop NBNS from sending those requests, it would be greatly appreciated!
LVL 57

Expert Comment

ID: 22659675
When you do ipconfig /all, what do you see (if anything) for your WINS servers?

Either is defined as a WINS server, or this happens to be the IP subnet broadcast address for your IP subnet.  

My guess is that is your IP broadcast address.  Your computer has attempted to look-up a host name using DNS and got back a "not found/no such host" and now your computer is sending a NBNS broadcast to try and find the IP address of some host.  It is waiting until it either gets a response or times out waiting for a response.

Your computer is attempting to find the Windows computer named ?, WPAD, and any other name that appears in the NBNS query.

If you  are in a Windows AD enviroment, then you may not need to have NETBIOS, so you could disable it.  However if you are not in a AD enviroment, you will need NETBIOS to do print and file sharing.  Please note, you could have other products/functions that depened on NETBIOS, so disabling it could lead to other problems.
Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.


Author Comment

ID: 22660017
Interesting.  There's nothing in ipconfig /all for WINS (WINS Proxy Enabled....No).  I checked these settings with another computer that's almost the exact same hardware setup, and the only difference (other than IP address) is the Node Type.  Mine is set to Unknown, while the working one is set to Hybrid.  I'm guessing this means there's something amuck with the DNS we're using since it's not seeing my localhost as my computer right away?  If I replace locahost with in the browser, the same problem persists.  I just took a look at Wireshark again, and it seems to be sending a DNS response to our ISP which bounces back the host not found reply, THEN it sends out the NBNS requests.       It almost looks like it might be sending DNS's directly to our ISP instead of handling it at the router...or is that what it always does?   Our router is a Dlink DIR655 EXtremeN:

Here's my ipconfig /all:

Windows IP Configuration
        Host Name . . . . . . . . . . . . : Jordan-3C6C62CE
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : **ISP**

Ethernet adapter Local Area Connection:
        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Intel(R) 82566MM Gigabit Network Connection
        Physical Address. . . . . . . . . : 00-1F-E2-16-68-85

Ethernet adapter Wireless Network Connection:
        Connection-specific DNS Suffix  . : **ISP**
        Description . . . . . . . . . . . : Intel(R) Wireless WiFi Link 4965AGN
        Physical Address. . . . . . . . . : **-**-**-**-**-**
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . :
        Subnet Mask . . . . . . . . . . . :
        Default Gateway . . . . . . . . . :
        DHCP Server . . . . . . . . . . . :
        DNS Servers . . . . . . . . . . . :
        Lease Obtained. . . . . . . . . . : Tuesday, October 07, 2008 9:59:10 AM
        Lease Expires . . . . . . . . . . : Wednesday, October 08, 2008 9:59:10 AM

LVL 57

Expert Comment

ID: 22660141
O.K. is your IP subnet broadcast address  This is gotten from the fact your IP address is and your network mask is  You IP subnet is and the broadcast is

Your only DNS server is, so all DNS requests should be going to that for name resolution requests.

The unknown type could be a know issue/proplem with Windows.  See:


You may want to verify that you have a valid hosts files on your computer.  Normally it is located at:


and the file name is hosts.  It should have at least one entry:     localhost


Author Comment

ID: 22660778
The host file only has one entry, which is   localhost.  It doesn't matter if I use localhost or still sends out the NBNS packets and takes a long time to respond.   I tried that KB article you sent, but it's a little misleading, as it just enables or disables the WINS proxy.  I took that key out and added a NodeType DWORD, with a value of 8 which set the NodeType to Hybrid...but it didn't solve the problem.    Do you know if there's anyway to edit the NetBIOS table settings or anything?

LVL 57

Expert Comment

ID: 22661416
After thinking about it a bit longer, changing the type really won't solve the problem, as you have found.  The issue is that your computer is attempting to find a host (or hosts) that do not have DNS entries anyplace.  So Windows uses NBNS as the last resort to find it.

Ah.  WPAD is short for Windows Proxy Auto Discovery, something that MS put there to try and automatically discover any proxy server.

In IE select Tools, Options, Connections, LAN settings and hopefully you will see "Automatically detected settings" checked.  If it is, uncheck it.

If it is not, then someplace you have a firewall client that is attempting to find a WPAD proxy or something else, like a DHCP server, is providing information to tell your computer to look for a WPAD.


Author Comment

ID: 22663163
I checked my LAN settings, and the "Automatically detect settings" was unchecked.  For kicks I checked it, and not much has changed.  Through Wireshark, NBNS checks for NB ?<00> or NB ?<20> and occasionally NB WORKGROUP<00>.  So, we've narrowed it down to trying to find something on my computer that's looking for a WPAD or the ?<00>...whatever that is?    Is there a setting somewhere in Windows, other than the host file, that allows it to "Know" that a localhost request is part of the local machine, and shouldn't need to use DNS to find out where to find the requested files?

Author Comment

ID: 22663373
Another update:  the URL I'm using is something like this "http://localhost/directory/application.exe".  If I allow directory browsing in IIS and try to hit "http://localhost/directory", the directory shows and there are no NBNS packets showing in Wireshark.  It appears as if the computer can identify the localhost, but when I try to run call the exe, it doesn't recognize it and starts sending out NBNS's.  does that make any sense?
LVL 57

Assisted Solution

giltjr earned 1200 total points
ID: 22664903
It should find localhost quickly and this is shown when you only do a directory browse.

My guess is something in "application.exe" is attempting to find a network resource that is trigging something that causes the look for other hosts.

Do you see DNS requests for "?"

I'll thinkg about it some more, but you may want to see what happens if you just execute that pgm from a command prompt and not via the web server, if that is possible.

Author Comment

ID: 22711156
Sorry the delay in responses.  I've been playing around with this setup and still haven't found an answer for what's triggering the host lookup.  Wireshark does report a number of NBNS requests for NB ?<00> or ?<20>, but no DNS requests for just "?".  After the first NBNS request, there is a DNS request for ?.isp.net....is that similar?  After that there are a couple more NBNS requests, a DNS for wpad.isp.net, some more NBNS requests, and then the app loads without any indication in Wireshark.

Unfortunately I can't run this app from the command line, so i can't test that.

If you have any more ideas, let me know, I'll try to respond quicker.

LVL 57

Expert Comment

ID: 22712484
I just did a test and I could not get any DNS queries for a host name with a ? in it.   I only saw NBNS queries.

Something is definitely attempting to do a host look-up for a host with the name ? someplace.  The problem is trying to find out what is doing it.

If the ? queries only show up when running your application, then all I can suggest is that review you code to see where you may be doing some type of host look-up and make sure that it is getting a valid host name.  If you have debugging tools for your program, you may be able to step through the code and see where this might be happening.

Accepted Solution

wrguy earned 0 total points
ID: 22762382
I haven't figured out what is causing the NBNS queries,  but there is a .dll of this app that runs quick on my system.  I've been using that for the past week or so and haven't had any problems.  Thanks for your suggestions, I'm going to close this question as we've at least narrowed down the exe sending out NetBios queries and I'm hitting a dead end....plus I've found a solution that works for me with the dll version.  Thanks again!

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Preparing an email is something we should all take special care with – especially when the email is for somebody you may not know very well. The pressures of everyday working life stacked with a hectic office environment can make this a real challen…
Make the most of your online learning experience.
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question