Getting Under the Hood with a Network Monitor

When you want to observe name-resolution behavior on your Windows network, I recommend that you use a network-monitoring product, such as Microsoft Network Monitor for Windows NT, Network Monitor for Microsoft Systems Management Server (SMS), or a third-party product such as Network Associates' Sniffer Pro LAN (formerly NetXRay—see "Third-Party Network-Monitoring Products.") Screen A shows an example network-monitoring session, which displays the results of a WINS client using the Ping command for a name query. Frames 1 through 8 show that the network traffic from the client starts with a series of DNS queries to each of the clients' configured DNS servers, each of which fails. Frame 9 shows that the client then sends the query to the first configured WINS server, which responds with the queried name's resolved IP address, as Frame 10 shows. Frames 11 through 13 show the Internet Control Message Protocol (ICMP) traffic that the Ping command generates between the two hosts.