I don't get it

[George Hester]

Wouldn't this issue be avoided by just shutting down IE once in that year's period?

http://support.microsoft.com/default.aspx?scid=kb;en-us;812175&FR=1

Doesn't doing that refresh, "entries in the Hosts file?"

Thanks.

 

[Wouter]

Wouldn't this issue be avoided by just shutting down IE
once in that year's period?

http://support.microsoft.com/default.aspx?scid=kb;en-us;812175&FR=1

Doesn't doing that refresh, "entries in the Hosts file?"

Thanks.

Internet Explorer is not the only application that uses the
hosts file.
The problem is not related to an issue in IE, it is a pre SP4
Windows 2000 issue, only to be solved by reboot once a year or
install SP4.

 

[George Hester]

Hmm never noticed that. I have had to refresh the host file and have always been successful doing it by just closing and reopening IE. There is an issue say with Outlook's HTML mail where a mail item once opened, a link in the HTML added to the hosts file, all IE closed, reopen the mail item, hosts don't work. But in that case close and reopen Outlook and the hosts works as it should.

So I believe that if a user knew what was using the hosts file, all they would need to do is close the application and then start it again and the hosts would refresh.

 

[Bruce Chambers]

Greetings --

The Hosts file and IP addressing are used for more than just
accessing the Internet. They both come into play daily on any TCP/IP
network. And it is conceivable for a Win2K Server to go a year or
longer without rebooting, if the admin is not particularly diligent
about applying service packs and patches.

Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


Wouldn't this issue be avoided by just shutting down IE once in that
year's period?

http://support.microsoft.com/default.aspx?scid=kb;en-us;812175&FR=1

Doesn't doing that refresh, "entries in the Hosts file?"

Thanks.

 

[Torgeir Bakken (MVP)]

Wouldn't this issue be avoided by just shutting down IE once in that year's period?

http://support.microsoft.com/default.aspx?scid=kb;en-us;812175&FR=1

Doesn't doing that refresh, "entries in the Hosts file?"

Hi

The KB article is about the refresh interval for the Time-to-Live (TTL) values for the
hosts file content, and not the entries itself.

The hosts file is a part of of your TCP/IP configuration, and is loaded by the TCP/IP
Protocol Driver at computer startup.

E.g. the location of the hosts file is decided by the value of DataBasePath
under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

As the KB article states, on pre-SP4, at computer startup, the Time-to-Live (TTL)
values for entries in the Hosts file are cached for one year (note, not the values
itself, but their TTL values).

So shutting down IE once in that year's period will not help, because IE does not
refresh the Time-to-Live (TTL) values.

 

[Enkidu]

The hosts file is a part of of your TCP/IP configuration, and is loaded by the TCP/IP
Protocol Driver at computer startup.

E.g. the location of the hosts file is decided by the value of DataBasePath
under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

The hosts file is not loaded at startup. It is read every time that
the computer needs to resolve a name that it doesn't know about.

eg, if you ping notvalid you will get a message saying "Ping request
could not find host notvalid". However if you then add a line to
hosts, such as 111.111.111.111 notvalid, then ping notvalid you will
get a message "Pinging notvalid\ [111.111.111.111] with 32 bytes of
data:" without rebooting or anything.

The problem described was with the cached values, so the above doesn't
make any difference. However the Microsoft workaround is pretty
drastic. It *should* be possible (though I've obviously not checked
this) to refresh the cached entries by merely editting the hosts file
so that its access date is changed. This should I believe force the
re-read of the hosts file. But I'd have to wait a year to test it!

Cheers,

Cliff

 

[Torgeir Bakken (MVP)]

The hosts file is not loaded at startup. It is read every time that
the computer needs to resolve a name that it doesn't know about.

No, it is loaded into memory (or more correctly the DNS resolver cache) at startup by the
TCP/IP Protocol Driver. It is also reloaded every time the hosts file is changed (the
Protocol Driver service gets a file change notification from the OS when the file is
edited).

Do a "ipconfig /displaydns" in a command prompt before and after a edit of the hosts file
to see this effect (you may want to do "ipconfig /flushdns" first to start with clean
sheets and avoid a lot of scrolling).

The file itself is not read when the computer needs to resolve a name that it doesn't know
about. Monitor the file access on your computer with filemon.exe from www.sysinternals.com
if you want to, and you will not see any access from services.exe or any other file
against this file in this case. But if you change the file, you will see that services.exe
reads the file afterwards.

eg, if you ping notvalid you will get a message saying "Ping request
could not find host notvalid". However if you then add a line to
hosts, such as 111.111.111.111 notvalid, then ping notvalid you will
get a message "Pinging notvalid\ [111.111.111.111] with 32 bytes of
data:" without rebooting or anything.

The problem described was with the cached values, so the above doesn't
make any difference. However the Microsoft workaround is pretty
drastic. It *should* be possible (though I've obviously not checked
this) to refresh the cached entries by merely editting the hosts file
so that its access date is changed. This should I believe force the
re-read of the hosts file. But I'd have to wait a year to test it!

Editing the file will not reset the Time-To-Live for the entries in the DNS cache and you
do not need to wait a year to test it ;-) You can check this by looking at the TTL values
for each entry by running "ipconfig /displaydns" before and after a edit on the host. Even
deleting the entries from the hosts file, saving the file, running "ipconfig /flushdns",
and then adding the entries back will not reset the TTL value.

Also new entries in the hosts file will get the same TTL value as the ones that originally
was there, so this is a global value that starts at approx. 31536000 (60x60x24x365) when
the computer is started up and then is decremented with 1 for each second. If 0 is
reached, all the host names from the hosts file are no longer resolved, and you need to
reboot the computer (unless you have SP4 installed).

 

[I. E.]

Wouldn't this issue be avoided by just shutting down IE once in that year's period?

http://support.microsoft.com/default.aspx?scid=kb;en-us;812175&FR=1

Doesn't doing that refresh, "entries in the Hosts file?"

Thanks.

Just goes to show that even Microsoft doesn't expect Windows to run
without a reboot for more than a year... ROFL....



.................................................................
Posted via TITANnews - Uncensored Newsgroups Access-=Every Newsgroup - Anonymous, UNCENSORED, BROADBAND Downloads=-

 

[Enkidu]

No, it is loaded into memory (or more correctly the DNS resolver cache) at startup by the
TCP/IP Protocol Driver. It is also reloaded every time the hosts file is changed (the
Protocol Driver service gets a file change notification from the OS when the file is
edited).

Do a "ipconfig /displaydns" in a command prompt before and after a edit of the hosts file
to see this effect (you may want to do "ipconfig /flushdns" first to start with clean
sheets and avoid a lot of scrolling).

The file itself is not read when the computer needs to resolve a name that it doesn't know
about. Monitor the file access on your computer with filemon.exe from www.sysinternals.com
if you want to, and you will not see any access from services.exe or any other file
against this file in this case. But if you change the file, you will see that services.exe
reads the file afterwards.

Ah my bad! This appears to have changed from Win98 and I hadn't
realised. The following Win98 reference says, in part, "The HOSTS file
is parsed whenever a host name is referenced". Obviously this has
changed.

http://www.microsoft.com/technet/tr...et/prodtechnol/win98/reskit/part7/wrkappf.asp

eg, if you ping notvalid you will get a message saying "Ping request
could not find host notvalid". However if you then add a line to
hosts, such as 111.111.111.111 notvalid, then ping notvalid you will
get a message "Pinging notvalid\ [111.111.111.111] with 32 bytes of
data:" without rebooting or anything.

The problem described was with the cached values, so the above doesn't
make any difference. However the Microsoft workaround is pretty
drastic. It *should* be possible (though I've obviously not checked
this) to refresh the cached entries by merely editting the hosts file
so that its access date is changed. This should I believe force the
re-read of the hosts file. But I'd have to wait a year to test it!

Editing the file will not reset the Time-To-Live for the entries in the DNS cache and you
do not need to wait a year to test it ;-) You can check this by looking at the TTL values
for each entry by running "ipconfig /displaydns" before and after a edit on the host. Even
deleting the entries from the hosts file, saving the file, running "ipconfig /flushdns",
and then adding the entries back will not reset the TTL value.

Also new entries in the hosts file will get the same TTL value as the ones that originally
was there, so this is a global value that starts at approx. 31536000 (60x60x24x365) when
the computer is started up and then is decremented with 1 for each second. If 0 is
reached, all the host names from the hosts file are no longer resolved, and you need to
reboot the computer (unless you have SP4 installed).

Fairy nuff! My apologies.

Cheers,

Cliff

 

[Bruce Chambers]

Greetings --

It's not really a "change," per se, as Win2K is descended from
WinNT and is therefore completely unrelated to Win98, except for the
purely superficial similarities of the user interface.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Enkidu]

Greetings --

It's not really a "change," per se, as Win2K is descended from
WinNT and is therefore completely unrelated to Win98, except for the
purely superficial similarities of the user interface.

Hi Bruce, I beg to differ. It IS a significant change.

You say that Win2K is descended from NT. Well, in NT4 the hosts file
was parsed whenever a machine needed to resolve a host name via that
mechanism. This reference says in part "Remember that the
\%SystemRoot%\system32\drivers\etc\HOSTS file can still be used for
Host name resolution. However, DNS will be queried before the HOSTS
file is parsed".

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndns/html/dnsnt4.asp

Although I talked about Win98, it is more general than that. So far as
I know all Unix systems still read the hosts file when they need to
locate a host that they do not know of (depending on how the resolver
is set up). So it is a significant change, but not one with an
enormous impact.

Cheers,

Cliff

 

[George Hester]

That is exactly what I think Enkidu

--
George Hester
__________________________________

The hosts file is a part of of your TCP/IP configuration, and is loaded by the TCP/IP
Protocol Driver at computer startup.

E.g. the location of the hosts file is decided by the value of DataBasePath
under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

The hosts file is not loaded at startup. It is read every time that
the computer needs to resolve a name that it doesn't know about.

eg, if you ping notvalid you will get a message saying "Ping request
could not find host notvalid". However if you then add a line to
hosts, such as 111.111.111.111 notvalid, then ping notvalid you will
get a message "Pinging notvalid\ [111.111.111.111] with 32 bytes of
data:" without rebooting or anything.

The problem described was with the cached values, so the above doesn't
make any difference. However the Microsoft workaround is pretty
drastic. It *should* be possible (though I've obviously not checked
this) to refresh the cached entries by merely editting the hosts file
so that its access date is changed. This should I believe force the
re-read of the hosts file. But I'd have to wait a year to test it!

Cheers,

Cliff