4

I'm reading about DNS cache and particularly about ipconfig /flushdns command. There are many resources out there - QA, blogs, sites - that explain what is DNS cache but none of them say where DNS cache is located on my Windows 8.1 machine. If I get it right, it should be a file with mappings, something like the following:

example.com 123.123.123.123
foo.net 123.123.0.0

Before I run ipconfig /flushdns, I want to see that DNS cache file. Where can I find it on my machine?

Improve this question
1
  • Probably in-memory.
    – Daniel B
    Jan 21, 2016 at 5:54

3 Answers 3

Reset to default
3

If you want to see the DNS cache, recent versions of Microsoft Windows support IPConfig /displaydns

(I don't think Windows 98 supported it; neither did Win98 support ipconfig /flushdns. I would guess both options got added to the same version of Microsoft Windows.)

This is the typical/easy way to view such information.

I'm not offhand sure what file this information is stored in. I'm pretty sure that it doesn't use the HOSTS-like format that you show, because I'm sure it also keeps track of expiration time. Using Process Explorer may help to find out what file gets accessed when using IPConfig/displaydns.

Improve this answer
1
  • 1
    There is no "cache file" – the cache is kept in memory only. It is maintained by the "DNS Client" service (internally named Dnscache), therefore the cache data would be somewhere inside one of the svchost.exe processes.
    – u1686_grawity
    Jan 21, 2016 at 6:05
4

Just to back up what others have said, using Process Hacker to search for strings within svchost.exe you can see the entries stored in memory. Eg.

enter image description here

A far less useful output than simply using ipconfig /displaydns (Which you can always output to a file using ipconfig /displaydns>output.txt if you wanted.

Improve this answer
3

The cache may be kept in memory, and the local dns service may not keep a cache file, but there is a little more to it.

My ipconfig /displaydns was preserving entries between reboots for me. It must be kept on disk somewhere.

I had a dns problem today and when checking with an old VM, I discovered some really old entries in my local dnscache. These were entries from my old company and at first I thought maybe they were hacking in or I was still connected somehow to their network. But they also contained some of my own entries from VMs from quite awhile ago.

ipconfig /flushdns would not wipe the entries. I tried stopping and restarting the dns service. Did not help. I disconnected my router from the Internet and the entries still remained. Then I remembered that that VM used to be a domain controller and dns server from long ago so I suspected something didn't get uninstalled correctly.

I used procman.exe and isolated the instance of svchost.exe that responded to ping requests. On a ping, it opened the hosts file and nothing else. Stupid me, I should have checked the hosts file before starting all this. All the old entries were in the hosts file. Once they were wiped there, they did not show up in ipconfig /displaydns.

When the local dns service is stopped and restarted, existing entries are wiped, so that tends to confirm they are only kept in cache memory. But yes, persistent ipconfig dns entries used by ping via the local dns are located in c:\windows\system32\drivers\etc\hosts.

Hope this helps anyone else trying to troubleshoot this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .