hosts and lmhosts

colinearpsycho · 19 Apr 2011

before you said that if i had an entry in the hosts file it wouldn't prevent traffic to that website, if i entered it in internet explorer. either that, or are you saying the fact that it doesn't SOUNDS like i have a virus that is redirecting traffic locally? however you answer those inquiries, how can i make sure that IE uses the local hosts file to some degree...then again, if i have a hosts file, what is the point of the dns service in administrative tools/services? i've read that having a very long hosts file, will see better use and performance if that service is turned off. so it shouldn't be difficult to see from this botched up mess how confusing this becomes.

OR if you find that for some reason your DNS server is returning bad addresses for say Google you can put in something like

www.google.com 74.125.224.171

And instead of using DNS it will use that known good address for google.

in that quote you're talking about lmhosts file right? because if you're still talking about the aforementioned hosts file, then it's just all the more confusing and the trouble is, it's the same pathetic answer from the entire internet (and i don't mean to sound a prick, but you google it and see what you can come up with, it's taxing). also whether you're talking about hosts or lmhosts you have the syntax backwards, it's loopback domain name ip for hosts and ip domain # for lmhosts.

pparks1 · 19 Apr 2011

LMHosts file is for handling windows workgroup and domain nanming when methods such as WINS fails. This is not for resolving names of websites and such on the Internet. It's for the local network. LM stands for LAN Manager. So, LMHOSTS is a LAN MANAGER hosts file. This is for resolving things like the NETBIOS name of the machine.
LMHOSTS - Wikipedia, the free encyclopedia.

Now, some people don't care whatsoever about a netbios name of their computer. For example, Linux boxes aren't configured with that at all. They just have a local hostname on the box....and all name resolution is strictly done with DNS or a hosts file. So, it's not absolutely required that you have both configured.

If you have a hosts file on your computer (C:\Windows\system32\drivers\etc\hosts), then Windows will use this file without question to resolve the IP address for the website you are attempting to find. Same thing happens in linux, but here the file is /etc/resolv.conf. If you want to test that it's working, put in 10.10.10.1 for www.google.com...then try to hit Google in your IE web browser. If you do NOT get the Google web page, you know that your machine is indeed using HOSTS and not DNS to resolve that name.

The DNS client service allows your computer to use DNS to look things up on the Internet. While you can shut this off, it would break pretty much everything on the Internet that you didn't manually specify in your hosts file. While a hosts file can improve performance (as it doesn't need to look up the address in DNS on the Internet), these lookups are nearly instantaneous. Plus, if you hard code a web page into a HOSTS file and the person running the website decides to move it to another IP address...your access will break until you figure out what the new IP address is and then adjust your hosts file accordingly. Seriously, I wouldn't even consider shutting off DNS in favor of HOSTS for any type of performance reason. You will spend far more time troubleshooting why nothing works properly on your machine which will far outweight any times savings in DNS lookups.

the syntax for HOSTS, is
x.x.x.x www.domainname.com

If there is any confusion, look at the same lines MS provides in their file. And the # means the line is commented out...thus won't work.

Code:

#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

fseal · 19 Apr 2011

Oops yeah I used the OPs example and got the entries reversed for the hosts file sorry

danforward · 19 Apr 2011

Forget about lmhosts.sam. It is a SAMPLE file and does nothing. It shows examples of what can be done in the lmhosts file, which is not what you want either.

When your computer tries to resolve the IP address for a website, it first looks in your C:\Windows\System32\drivers\etc\hosts file. If it is not found in there, it checks your DNS cache. If not in there, it will contact your DNS server. That is what makes your hosts file such a great place to block unwanted web sites. It always gets checked first.

It does not really matter what IP address you assign to web sites you want to block. 127.0.0.1 is usually a good choice, unless you run a web server on your machine. It just tells your computer to go to your machine rather than theirs, which of course fails. I prefer to use 0.0.0.0 because it is never a valid machine.

So, to achieve the effect you want, append the entries to your hosts files like this:

0.0.0.0 doubleclick.net www.doubleclick.net
0.0.0.0 badsite.com www.badsite.com ads.badsite.com

The format is an IP address followed by spaces or tabs, followed by one or more domain names separated by spaces or tabs. In theory you could put all sites you want to block on one line. In practice, it is easier to manage by placing one domain on each line or related domains on each line as I have done above. I could have just as easily done this:

0.0.0.0 doubleclick.net
0.0.0.0 www.doubleclick.net
0.0.0.0 badsite.com
0.0.0.0 www.badsite.com
0.0.0.0 ads.badsite.com

or this:

0.0.0.0 doubleclick.net www.doubleclick.net badsite.com www.badsite.com ads.badsite.com

WebMattR · 19 Apr 2011

danforward said:

It does not really matter what IP address you assign to web sites you want to block. 127.0.0.1 is usually a good choice, unless you run a web server on your machine. It just tells your computer to go to your machine rather than theirs, which of course fails. I prefer to use 0.0.0.0 because it is never a valid machine.

The problem with this usage of the host files is that it will slow down every query your machine makes, because it has to compare that to each individual entry in the hosts file. I seriously suggest you simply install antivirus, run a firewall, and forget this entire idea. it's just going to kludge things up for you. You can't add sites fast enough for it to ever be relevant, and every entry slows your ability to use the internet down a little, since it has to be scanned for every query that goes out.

SledgeDG · 19 Apr 2011

You're not serious, are you?
Unless you cramp your hosts with literally thousands of lines, in the time your computer does 1 DNS query it could probably do some 500 queries of the local hosts file .
I don't think that one shouldn't worry about any speed concerns in this context

-DG

fseal · 19 Apr 2011

Yeah, the hosts file can be actually be used to speed up your internet surfing by hard coding local lookups for sites you visit often (Though you may have to keep them up to date now and then). DNS queries are one of the major slowdowns of web surfing... :) (That and the BW to DL all the images and ad spam, which is why all these browser speed tests are really amusingly misplaced in 99% of all cases)

WebMattR · 19 Apr 2011

SledgeDG said:

You're not serious, are you?
Unless you cramp your hosts with literally thousands of lines, in the time your computer does 1 DNS query it could probably do some 500 queries of the local hosts file .
I don't think that one shouldn't worry about any speed concerns in this context

-DG

I was/am serious. I was told that by the guy who taught my CCNA course.

SledgeDG · 19 Apr 2011

Just think about it for a sec (hard drive access time/RAM access times once it's cached compared to the time a query to your DNS takes with all your average net latency and stuff.
Still we're haggling about milliseconds here. that's why I said that this is nothing to be worried about.
I'm not question the qualification of your teacher. Maybe said guy had a bad day or the whole story had a different context who knows... but I have bee told BS before even from guys who should know better

Anyways..I leave it at that I wasn't trying to convince anyone

-DG

colinearpsycho · 19 Apr 2011

well that clears up the issues about hosts. i have to admit though i'm still a little fuzzy when some of you are referring to hosts or lmhosts. when i read the descriptions provided by ms, they are distinctly different pages, so presuming one is useless to the other is apparently only a matter obstascles in resolution.

lmhosts for use with netbios is a register then

&

hosts is a file which redirects traffic

in conversation, hosts doesn't sound unlike http redirection and lmhosts doesn't sound to far unlike default document, except that it is a name resolution for a (hopefully) overseen page on the network or webpage.

insofar as the example of inputting 10.10.10.1 and google, you mean to place that in lmhosts if i'm correct? i attempted to look up 10.0.0.1 simply by typing it into IE (which it's settings don 't permit the submission of unknown addresses), and it popped up a very broad search result for a number of webpages, and I did not see google listed therein. google pings are also not coming back from 10.10.10.1.

and I should add that having input entries into hosts in the required syntax, and still being able to reach a webpage is disconcerting, i should think i would be getting an error, or loading hang. so hosts also doesn't seem far from default document in addition to http redirection. which i've noticed, because if i input an unavailable domain, the web server returns with very similarly comprised css pages advertising domain sales.