Good evening,

I lack some knowledge about how to interpret the result of the ipconfig /all screen. My IP address is 192.168.0.2. When I use the ping command for this IP address is it any different than using the ping command with 127.0.0.1? My default gateway, DHCP server and DNS server are all set to 192.168.0.1. The other dns server is not a private IP address. It was my guess that the dns server of 192.168.0.1 referred to the HOSTS file. When I use the ipconfig /displaydns, it isn't the same as what is on the HOSTS file. Where does the dns cache reside in Windows? Why isn't the dns cache the same as the HOSTS file?

There are probably others who are better prepared to answer your questions. But I'll take a quick whack at them.

In the infancy age of networking, the hosts file was used to resolve a name designating a company's internal file server or printer to its IP address. That way users could say copy a file from say \\FILESRVR-1 to their PC. Much easier to remember FILESRVR-1 as the file server than 192.168.3.250 (or whatever). The hosts file also could be used to resolve internet names (which can be good or bad). One of the downsides to the hosts file was you would have to manually change each and every hosts file in the company if the IP address ever changed. And say a branch office has a file server with the same name but a different IP address -- someone with a laptop who works in both offices will have to edit the file each time they find themselves working in a different office.

With the arrival of the DNS protocol, where a computer passes the DNS server a name, and the DNS server returns an IP address, there is little need for a hosts file (except perhaps for special redirection purposes -- for good or bad). Host files do not need to be modified, and a buffer of previously queried resource names (and their corresponding IP addresses) is kept by the operating system until it is lost when it is shut down. This dynamic buffer is the dns cache of which you speak. I don't know if the hosts file populates the dns cache when the OS is booted up -- you need to talk to an expert about that. The benefit of the dns cache is to remember the results of previous resource name queries. Resolving names is instantaneous that way, as compared to the computer and network overhead to query a resource name.

The IPv4 address 127.0.0.1 is a loopback address, and it is the network adapter's TCP/IP stack. If you get a successful Ping using the loopback address, it means your TCP-IP stack is working. You'll need an expert to tell you if a ping of your computer's loopback and IP address is the identical same thing.

Just for completeness sake, DHCP functions as a way to dynamically assign IP addresses. Like host files, IP addresses once were configured statically. That meant they had to be edited so that a laptop computer would work in another branch office's network. With DNS configured on a computer, when the computer is booted it effectively asks to be given an IP address, subnet mask, DNS address(s) and default gateway address. The DNS server has a pool of addresses it can "lease" to the requesting PC for some specified time period configured on the DNS server.

That leaves the default gateway address. It is the IP address where the network message will be sent if the destination address is outside the local subnet. An analogy would be for you to go to the post office to mail a letter. If the clerk sees the same zip code (hint: IP subnet) as the post office zip code, the mail will be delivered locally. If the zip code is some other city, the letter goes to some other location for sorting and distribution.

As evidenced by your ipconfig /all listing, the computer whose IP address is 192.168.0.1 is running a software router (gateway), DNS and DHCP server. If y our computer is configured to use DHCP, that computer gave you your computer's IP, DNS and default gateway addresses. By the way, the listing will also tell you if your computer has DHCP enabled. If not enabled, it means all that information was manually configured.

Hope this helps.

There is a difference between when you ping your internal RFC1918 address of 192.168.0.2 and the loopback 127.0.0.1. The loopback address although in windows environments is mostly thought of as 127.0.0.1, you can actually use any 127.x.x.x address. Try pinging 127.100.100.254 and you'll get a response. This is because the entire 127.x.x.x is reserved for loopback testing. Loopback testing means sending a echo request and getting a reply back. It is a bit line SONAR signals underwater. By pinging the 127 range you veryify that your network card's TCP/IP software are functioning.

Your internal (private RFC1918) IP address of 192.168.0.2 was acquired from your DHCP Server. In many cases the DHCP server is actually a service which runs within your wireless/LAN router. What happens is this:
When you switch your PC on, it sends out what is known as a broadcast Discovery Packet asking any DHCP Servers to reply.
Your router replies back with an offer of an IP address,lease time and also included is the router's own default gateway IP.
Your PC receives the offer and sends back a broadcast REQUEST for more information. Actually this REQUEST states "I am accepting the offer of DHCP server {IP address of DHCP goes here}

Finally your router confirms the rest of the information (DNS addresses) by sending what is known as a Acknowledgement.This is a unicast packet. Collectively this entire process of finding a DHCP, getting an IP and learning DNS information is called DORA.A good one to remember.

In home networks it is very common for the default gateway, dns and DHCP server IPs to have the same IP address. However in reality although your pc will look to your router for DNS lookups, the router actually will go out to an external DNS server(most likely belonging to your ISP) if it doesn't have the information cached.

There is a command to display what is in the dns cache. It is "ipconfig /displaydns". It can be flushed with the /flushdns command

The Hosts file is the old way of storing dns entries. You can modify the hosts file and even use it instead of the "normal way".I think (although I might be wrong) that the dns cache is stored in the registry. You'd need to go into regedit to view it.Although don't do this unless you know what you're looking for exactly.

Mention of the current DNS cache being kept in the registry poked my curiosity. Sure enough, according to several references in microsoft's technical library, it is in the registry.

Learn something new every day.