1

I am operating on a LAN closed off from the internet, and there are a few devices (A, B, C, ...) connected via ethernet cable to a single router making this LAN possible. Operating system on all devices: Windows 10.

Questions:

  • Why is LLMNR failing, when DNS doesn't?
  • Why does 'ping A' use LLMNR, while 'ping A.' uses DNS?
  • Is there any way to force nslookup to use LLMNR, instead of DNS, and why?
  • What exactly is happening when I append a '.' to the hostname, for both 'ping' and 'nslookup'?
  • How do you know the answers to these questions (field of work & type of experience)?

THE CONTEXT OF THIS QUESTION CAN BE FOUND BELOW

nslookup A

and

nslookup A.

both yield the following satisfactory output

Server:  localDnsServerName
Address: 192.168.1.1

Name:    A
Address: 192.168.1.X

Even

ping A.

yields a satisfactory output ('.' is appended to the hostname being queried)

Pinging A [192.168.1.x] with 32 bytes of data:
Reply from 192.168.1.X: byte=32 time<1ms TTL=128
Reply from 192.168.1.X: byte=32 time<1ms TTL=128
Reply from 192.168.1.X: byte=32 time<1ms TTL=128
Reply from 192.168.1.X: byte=32 time<1ms TTL=128

Ping statistics for 192.168.1.X:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

However, the following command

ping A

yields an unsatisfactory output

Ping request could not find host A. Please check the name and try again.

Upon further investigation, via Wireshark, I see the nslookup commands and 'ping A.' command result in successful standard queries using the DNS protocol.

However, 'ping A' results in a standard query using the LLMNR protocol, which fails.

Via the RFC 4795, Abstract for LLMNR:
"The goal of Link-Local Multicast Name Resolution (LLMNR) is to enable name resolution in scenarios in which conventional DNS name resolution is not possible. LLMNR supports all current and future DNS formats, types, and classes, while operating on a separate port from DNS, and wtih a distinct resolver cache. Since LLMNR only operates on the local link, it cannot be considered a substitute for DNS."

Additional tag: 'llmnr'
I would have added the mentioned additional tag officially, but I don't have a reputation of at least 300 to create a new tag. Please add this tag, if it is possible to tag a question after it is created, by editing this question.

  • nslookup always queries DNS, so that test is sort-of pointless. I haven’t seen you mention an operating system. I guess it’s Windows...? – Daniel B May 7 '18 at 16:07
  • @DanielB I just edited the question so that it addresses the operating system. All devices on the LAN are Windows 10. I included the nslookup command input and output because I'm also curious what exactly happens when and why you would want to append a '.' to a hostname. – Hybr13 May 7 '18 at 16:09
  • Welcome to Super User. I'm assuming Windows here as well. Please edit your question to include the output of ipconfig /all. Also, you're asking a few too many questions in one post. You can post multiple questions, linking back to this one if necessary to provide context. – Twisty Impersonator May 7 '18 at 16:13
  • @TwistyImpersonator Thanks for the advice. I will do this in a timely manner (can only post a question once every 40 minutes). – Hybr13 May 7 '18 at 16:17
  • Do you have any Apple software installed on this specific PC? – Daniel B May 7 '18 at 17:14
1

LLMNR is intended to be used only on the local link for single-label names (or, as a special case, names of the form hostname.local, which is converted to hostname before resolving them). Hosts respond with their own names; there is no central name server.

Why is LLMNR failing, when DNS doesn't?

Possibly because the host A is known by some other name, i.e. the name A is known by the DNS, but the hostname command returns something else when run on A. Or host A is not acting as an LLMNR responder.

Why does 'ping A' use LLMNR, while 'ping A.' uses DNS?

Beacause A. is not a single-label name, i.e. a name without dots.

Is there any way to force nslookup to use LLMNR, instead of DNS, and why?

nslookup is tool for querying the DNS. The program is not aware of LLMNR.

DNS and LLMNR are designed to complement each other. LLMNR is used on the LAN, so you don't need to have a local DNS server serving local names. The DNS is used for resolving names on the Internet.

For a tutorial on LLMNR, see Link-Local Multicast Name Resolution

  • After reading your answer, I figured I'd try the 'hostname' command and realized that 'A' in my question was the "device name" (set by a DHCP Reservation I created), not the hostname. I had made the assumption that when you create a DHCP reservation via your router settings, the "Device Name" set with the reservation is the new hostname (via DNS at least). I shouldn't have made that assumption. The hostname still equals the "Full Computer Name." This experience gave me additional insight for these type of things. Thanks Johan! – Hybr13 May 7 '18 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.