hosts and lmhosts

[colinearpsycho]

if i add an entry into the hosts file, shouldn't it stop me from trying to access that webpage? i'm also wondering, how to lookup the ip address of pages i visit, or servers i connect to so i can prepare similar file configurations to hosts and firewall settings.

 

[pparks1]

if you put an entry in a hosts file, the computer will NOT stop you from accessing the webpage, but rather will always use the IP address that you put into the hosts file. It's like writing down a phone number in an address book. If you ALWAYS use your address book, and never use the phone book (DNS), then you will always believe the phone number from your address book is the right number.

As far as looking up pages you visit, go to a command prompt and type, ping Google. And it will respond with an IP address of a google server. However, be advised that many big web services and such have tons and tons of machines that serve up their web pages. So, hard coding a specific server for a site into a hosts file is not always a desirable action.

 

[colinearpsycho]

so lmhosts.sam is a pain in the kilt-covered? I'm confused as to the hosts file (not lmhosts.sam). It seems to me that I should be putting MY IP address in place of 127.0.0.1. I have trouble with wording, and although a lot of information on the net says 127.0.0.1 is the loopback, I am unsure if the new ipv6 implementations have comprimised the integrity of an ipv4 loopback interface. I don't feel hosts is doing it's job tbh...I've read a few tutorials, and they all say the same thing but on this network I don't have to do anything technical in order to have to scratch my head and say, why is the screen glitching, what's the stall...

I am near to say it's 2gb of memory, but it's ddr3 and a 2.8 ghx athlon II x2 220, not top of the line I know, but it shouldn't have trouble running several non graphics intensive programs side by side and after I configured the task scheduler, there was a lot of hang-up; I was trying to think of a way to make a really secure hardware firewall without coding, because I don't know code, and with 3rd party programs. For instance, the idea was to get defender running on a schedule, and anti-virus, to setup windows firewall appropriately, and just dedicate this small form factor machine to that purpose (it didn't meet the specifications for heavy rendering, although it meets the minimum specs, those should be raised!).

that's the story short, and if you can't answer further, cool, thanks for your input. and of course, i was placing similar entries to hosts in restricted sites (like with spybot's hosts integration, and manual entries as I came across ad cookies, or research pages). It just doesn't seem sufficient enough. I'm almost sure it's something called wervault, or werfault? It is one of those stock programs that installed with Windows, I just can't finger the spelling, but the real issue is that just randomly blocking programs that sound funny, isn't working because it's always an issue with another service or program. Although the microsoft websites say a lot, they really don't place much emphasis on detail, except to say this is what the program does in the broadest spectrum. There is no cross reference for, these programs may implement the program wervault or whatever, these may implement it (with or without network connectivity), even again on a broad basis. So it's tough to nail down the system.

 

[WebMattR]

Okay. So, as I've read through this, I'm afraid I've lost track of something somewhere along the line, so I was hoping to start with a simple question, and perhaps the answer to that will help us help you with the original question you asked.

With this whole process you're doing, what exactly is your end goal? Are you trying to block websites, or something different?

 

[colinearpsycho]

...

to prevent redirection to known malware addresses.
i was under the impression that this is the purpose of the hosts file. and that's why it surprised me, that by entering ip's or domains on the list in conjunction with a local loopback point, IE will still allow users to navigate to those addresses. maybe this is a point of insecurity in IE, that it isn't monitoring it's own http redirection functions. and don't let me fool you into think i know the first thing about internet explorer besides knowing how to prompt for cookies.

 

[logicearth]

Alright. I'll put it clearly as possible. The hosts file does not do what you think it does. The hosts file is a low tech version of an DNS. A DNS turns domain names, like google.com, yahoo.com into something a computer understands, IP addresses. That is what a hosts file does, its a DNS a very low tech DNS.

 

[colinearpsycho]

lmhosts is from what i understand, but hosts i guess is supposed to (according to my reading) vary. providing the functionality of not permitting IE or other browsers redirect internet traffic to ip's or domains listed in the file, and instead (and this is where i'm confused) either redirecting them to a loopback point 127.0.0.1, or using the ip address on the file considered the loopback point to prevent redirection to a site, from that ip address.

so

127.0.0.1 doubleclick.net 0.0.0.0

in the hosts file says don't let doubleclick.net from 0.0.0.0 redirect traffice originating from 127.0.0.1

127.0.0.1 is supposed to be the localhost, and that's why i got confused as to whether i should input my ip address instead of 127.0.0.1. i understand what lmhosts does more or less, it registers ip's to websites. there are two troubles i see with it though, one being that dynamically assigned ip's seems to be all the craze so constant updating of that file would be annoying as all heck without a range of generic addresses for a page. and secondly i don't know if lack of having an lmhosts.sam file means that if i did have 128.6.4.32 suchandsuch.net (and that might be correct syntax but assume it were for an lmhosts entry just to suffice as an albeit bad, example), then does lmhosts.sam not tell me via an internet explorer prompt that website is trying to redirect traffic? i guess I should try it out. the problem is i don't have any means of testing it out....nor do I really want to.

to revert, the hosts file preventing traffic redirect doesn't sound like it should work without using my ip address, or without having a loopback point that is listening to web traffic, i.e. another machine for sandboxing or some such. it's like goto statement harmful. i installed a program called hostess, to help manage the hosts file too. and i experimented and placed my ip into the 127 setting, when hostess did her thing of manicuring the hosts file into well name groups and categories, it only renamed some of the entries back to the 127 setting. i'm not sure why, but i also want to associate 127 with doubleclick.net.

does that clarify my issue more?

 

[WebMattR]

to revert, the hosts file preventing traffic redirect doesn't sound like it should work without using my ip address, or without having a loopback point that is listening to web traffic, i.e. another machine for sandboxing or some such. it's like goto statement harmful. i installed a program called hostess, to help manage the hosts file too. and i experimented and placed my ip into the 127 setting, when hostess did her thing of manicuring the hosts file into well name groups and categories, it only renamed some of the entries back to the 127 setting. i'm not sure why, but i also want to associate 127 with doubleclick.net.

does that clarify my issue more?

The hosts file isn't designed to prevent anything. The host file is a very very basic DNS function. Mainly, it just specifies a loop back address. Now, I'm almost afraid to ask, but why would you want to specify that your loopback address points to doubleclick.net? That probably would just break things... not to mention sending you to doubleclick.net.

Personally, I'd say install Antivirus, a Firewall, and just leave the poor host file alone. It really isn't designed to do what you're trying to do, if I'm even understanding it correctly.

 

[pparks1]

What happens with a host file and malware, is that some malware will PUT entries into a hosts file so that your computer goes to whatever site "THEY" want you to go to, versus the legitimate site that DNS would direct you to.

 

[fseal]

so

127.0.0.1 doubleclick.net 0.0.0.0

in the hosts file says don't let doubleclick.net from 0.0.0.0 redirect traffice originating from 127.0.0.1

1) lmhosts is for windows networking only so forget about that, hosts is for the internet

2) You sort of have it backwards. Your entry above means that when your computer tries to look up the address of "doubleclick.net" it will use 127.0.0.1 instead of the actual address.

So yes you can block sites that way.

OR if you find that for some reason your DNS server is returning bad addresses for say Google you can put in something like

www.google.com 74.125.224.171

And instead of using DNS it will use that known good address for google.

BUT!

If you have a virus or something that is redirecting your lookups locally then the hosts file maynever get used or as mentione above even rewritten in order to cause the redirection...

The hosts file is most useful for two things. Blocking a web site by NAME (not number). or if your DNS is out or bad or some other reason, entering entries by hand...

 

[colinearpsycho]

before you said that if i had an entry in the hosts file it wouldn't prevent traffic to that website, if i entered it in internet explorer. either that, or are you saying the fact that it doesn't SOUNDS like i have a virus that is redirecting traffic locally? however you answer those inquiries, how can i make sure that IE uses the local hosts file to some degree...then again, if i have a hosts file, what is the point of the dns service in administrative tools/services? i've read that having a very long hosts file, will see better use and performance if that service is turned off. so it shouldn't be difficult to see from this botched up mess how confusing this becomes.

OR if you find that for some reason your DNS server is returning bad addresses for say Google you can put in something like

www.google.com 74.125.224.171

And instead of using DNS it will use that known good address for google.

in that quote you're talking about lmhosts file right? because if you're still talking about the aforementioned hosts file, then it's just all the more confusing and the trouble is, it's the same pathetic answer from the entire internet (and i don't mean to sound a prick, but you google it and see what you can come up with, it's taxing). also whether you're talking about hosts or lmhosts you have the syntax backwards, it's loopback domain name ip for hosts and ip domain # for lmhosts.

 

[pparks1]

LMHosts file is for handling windows workgroup and domain nanming when methods such as WINS fails. This is not for resolving names of websites and such on the Internet. It's for the local network. LM stands for LAN Manager. So, LMHOSTS is a LAN MANAGER hosts file. This is for resolving things like the NETBIOS name of the machine.
LMHOSTS - Wikipedia, the free encyclopedia.

Now, some people don't care whatsoever about a netbios name of their computer. For example, Linux boxes aren't configured with that at all. They just have a local hostname on the box....and all name resolution is strictly done with DNS or a hosts file. So, it's not absolutely required that you have both configured.

If you have a hosts file on your computer (C:\Windows\system32\drivers\etc\hosts), then Windows will use this file without question to resolve the IP address for the website you are attempting to find. Same thing happens in linux, but here the file is /etc/resolv.conf. If you want to test that it's working, put in 10.10.10.1 for www.google.com...then try to hit Google in your IE web browser. If you do NOT get the Google web page, you know that your machine is indeed using HOSTS and not DNS to resolve that name.

The DNS client service allows your computer to use DNS to look things up on the Internet. While you can shut this off, it would break pretty much everything on the Internet that you didn't manually specify in your hosts file. While a hosts file can improve performance (as it doesn't need to look up the address in DNS on the Internet), these lookups are nearly instantaneous. Plus, if you hard code a web page into a HOSTS file and the person running the website decides to move it to another IP address...your access will break until you figure out what the new IP address is and then adjust your hosts file accordingly. Seriously, I wouldn't even consider shutting off DNS in favor of HOSTS for any type of performance reason. You will spend far more time troubleshooting why nothing works properly on your machine which will far outweight any times savings in DNS lookups.

the syntax for HOSTS, is
x.x.x.x www.domainname.com

If there is any confusion, look at the same lines MS provides in their file. And the # means the line is commented out...thus won't work.

#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

 

[fseal]

Oops yeah I used the OPs example and got the entries reversed for the hosts file sorry

 

[danforward]

Forget about lmhosts.sam. It is a SAMPLE file and does nothing. It shows examples of what can be done in the lmhosts file, which is not what you want either.

When your computer tries to resolve the IP address for a website, it first looks in your C:\Windows\System32\drivers\etc\hosts file. If it is not found in there, it checks your DNS cache. If not in there, it will contact your DNS server. That is what makes your hosts file such a great place to block unwanted web sites. It always gets checked first.

It does not really matter what IP address you assign to web sites you want to block. 127.0.0.1 is usually a good choice, unless you run a web server on your machine. It just tells your computer to go to your machine rather than theirs, which of course fails. I prefer to use 0.0.0.0 because it is never a valid machine.

So, to achieve the effect you want, append the entries to your hosts files like this:

0.0.0.0 doubleclick.net www.doubleclick.net
0.0.0.0 badsite.com www.badsite.com ads.badsite.com

The format is an IP address followed by spaces or tabs, followed by one or more domain names separated by spaces or tabs. In theory you could put all sites you want to block on one line. In practice, it is easier to manage by placing one domain on each line or related domains on each line as I have done above. I could have just as easily done this:


0.0.0.0 doubleclick.net
0.0.0.0 www.doubleclick.net
0.0.0.0 badsite.com
0.0.0.0 www.badsite.com
0.0.0.0 ads.badsite.com

or this:


0.0.0.0 doubleclick.net www.doubleclick.net badsite.com www.badsite.com ads.badsite.com

 

[WebMattR]

It does not really matter what IP address you assign to web sites you want to block. 127.0.0.1 is usually a good choice, unless you run a web server on your machine. It just tells your computer to go to your machine rather than theirs, which of course fails. I prefer to use 0.0.0.0 because it is never a valid machine.

The problem with this usage of the host files is that it will slow down every query your machine makes, because it has to compare that to each individual entry in the hosts file. I seriously suggest you simply install antivirus, run a firewall, and forget this entire idea. it's just going to kludge things up for you. You can't add sites fast enough for it to ever be relevant, and every entry slows your ability to use the internet down a little, since it has to be scanned for every query that goes out.

 

[SledgeDG]

You're not serious, are you?
Unless you cramp your hosts with literally thousands of lines, in the time your computer does 1 DNS query it could probably do some 500 queries of the local hosts file .
I don't think that one shouldn't worry about any speed concerns in this context

-DG

 

[fseal]

Yeah, the hosts file can be actually be used to speed up your internet surfing by hard coding local lookups for sites you visit often (Though you may have to keep them up to date now and then). DNS queries are one of the major slowdowns of web surfing... (That and the BW to DL all the images and ad spam, which is why all these browser speed tests are really amusingly misplaced in 99% of all cases)

 

[WebMattR]

You're not serious, are you?
Unless you cramp your hosts with literally thousands of lines, in the time your computer does 1 DNS query it could probably do some 500 queries of the local hosts file .
I don't think that one shouldn't worry about any speed concerns in this context

-DG

I was/am serious. I was told that by the guy who taught my CCNA course.

 

[SledgeDG]

Just think about it for a sec (hard drive access time/RAM access times once it's cached compared to the time a query to your DNS takes with all your average net latency and stuff.
Still we're haggling about milliseconds here. that's why I said that this is nothing to be worried about.
I'm not question the qualification of your teacher. Maybe said guy had a bad day or the whole story had a different context who knows... but I have bee told BS before even from guys who should know better

Anyways..I leave it at that I wasn't trying to convince anyone

-DG

 

[colinearpsycho]

well that clears up the issues about hosts. i have to admit though i'm still a little fuzzy when some of you are referring to hosts or lmhosts. when i read the descriptions provided by ms, they are distinctly different pages, so presuming one is useless to the other is apparently only a matter obstascles in resolution.

lmhosts for use with netbios is a register then

&

hosts is a file which redirects traffic

in conversation, hosts doesn't sound unlike http redirection and lmhosts doesn't sound to far unlike default document, except that it is a name resolution for a (hopefully) overseen page on the network or webpage.

insofar as the example of inputting 10.10.10.1 and google, you mean to place that in lmhosts if i'm correct? i attempted to look up 10.0.0.1 simply by typing it into IE (which it's settings don 't permit the submission of unknown addresses), and it popped up a very broad search result for a number of webpages, and I did not see google listed therein. google pings are also not coming back from 10.10.10.1.

and I should add that having input entries into hosts in the required syntax, and still being able to reach a webpage is disconcerting, i should think i would be getting an error, or loading hang. so hosts also doesn't seem far from default document in addition to http redirection. which i've noticed, because if i input an unavailable domain, the web server returns with very similarly comprised css pages advertising domain sales.