oreilly.comSafari Books Online.Conferences.


AddThis Social Bookmark Button

Hacking Windows XP, Part 2
Pages: 1, 2, 3

Hack #44: Tweak DNS Settings for Faster Internet Access

A handful of DNS hacks for speeding up access to web sites.

You use the Web by typing in hostnames such as, but web servers and Internet routers can't understand plain English words, so they need those letters translated into numeric IP addresses. Whenever you type in a hostname, such as, it needs to be resolved to its IP address, such as DNS servers provide that name resolution automatically and behind the scenes as you surf the Web.

There are several ways you can hack your DNS settings so that you can get faster web access.

Speed Up Web Access with a HOSTS File

It takes time to send your request to a DNS server, have the server look up the proper IP address to resolve the name, and then send the IP address back to your PC. You can eliminate that delay by creating or editing a local HOSTS file on your own PC that contains hostnames and their corresponding IP addresses. When you create one, XP will first look into the HOSTS file to see if there's an entry for the hostname, and, if it finds it, it will resolve the address itself. That way, you won't have to go out to a DNS server and wait for the response before visiting a web site. The HOSTS file is a plain text file you can create or edit with a text editor like Notepad.

You'll find an existing HOSTS file in C:\System32\Drivers\Etc\HOSTS. The file has no extension; it is named only HOSTS. Open it in Notepad and enter the IP addresses and hostnames of your commonly visited web sites, like this:

Each entry in the file should be on one line. The IP address should be in the first column, and the corresponding hostname in the next column. At least one space should separate the two columns. You can add comments to the file by preceding the line with a #, in which case the entire line will be ignored by the file, or by putting a # after the hostname, in which case only the comment after will be ignored. You might want to comment on individual entries-for example:        #still in beta

When you're finished editing the file, save it to its existing location.

WARNING: Make sure to check your HOSTS file regularly and keep it up to date, or else you may deny yourself access to certain web sites. For example, if the web site were to change its IP address, but your HOSTS file kept the old, incorrect address, your browser would not be able to find the site, because it would be given the wrong addressing information.

Adjust XP's DNS Cache Settings

As a way of speeding up DNS, when you visit a site, XP puts the DNS information into a local DNS cache on your PC. So, when you want to go to a site, XP first looks in its local DNS cache, called the resolve cache, to see whether the DNS information is contained there. That way, if it finds the information locally, it doesn't have to query a remote DNS server to find IP information. The cache is made up of recently queried names and entries taken from your HOSTS file.

The cache contains both negative and positive entries. Positive entries are those in which the DNS lookup succeeded, and you were able to connect to the web site. When XP looks in the cache, if it finds a positive entry, it immediately uses that DNS information and sends you to the requested web site.

Negative entries are those in which no match was found, and you end up getting a "Cannot find server or DNS Error" in your browser. Similarly, when XP looks in the cache and finds a negative entry, it gives you the error message without bothering to go out to the site.

Negative entries can lead to problems. When you try to make a connection to a site that has a negative entry in your cache, you'll get an error message, even if the site's problems have been resolved and it's now reachable.

You can solve this problem, though, using a Registry hack. By default, XP caches negative entries for five minutes. After five minutes, they're cleared from your cache. But if you'd like, you can force XP not to cache these negative entries, so that you'll never run into this problem. Run the Registry Editor [Hack #68] and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters. Create a new DWORD value with the name NegativeCacheTime and give it a value of 0. (The value may already exist. If it does, edit its value to 0.) The DWORD determines how much time, in seconds, to keep negative entries in the DNS cache. If you like, you can have the entries stay alive for one second by giving it a value of 1.

After you're done editing, exit the Registry. To make the change take effect, restart your computer, or flush your cache by issuing the command ipconfig /flushdns at a command prompt.

TIP: For more information about using ipconfig, see [Hack #52].

That command will flush your DNS cache-all the entries, both positive and negative, will be flushed, and it will be empty until you start visiting web sites. Negative entries, however, will not be added to the cache if you've given the DWORD a value of 0.

You can also use the Registry to control the amount of time that positive entries are kept in the DNS cache. By default, they are kept for 24 hours. To change the default, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters again and create a DWORD value called MaxCacheEntryTtlLimit. (If it's already present, just edit the value.) For the value, enter the amount of time you want the entry to remain, in seconds, making sure to use Decimal as the base.

Fix DNS Problems

Sometimes when you can't connect to a web site, the cause is a DNS problem. There are things you can do to solve these problems, though. If you're having trouble connecting, to find out if DNS is a potential culprit first ping [Hack #52] the site to which you can't connect, by issuing the ping command like this at the command prompt or Run box, like this:


If the site is live, you'll get an answer like this:

Pinging [] with 32 bytes of data:

Reply from bytes=32 time=119ms TTL=242
Reply from bytes=32 time=79ms TTL=242
Reply from bytes=32 time=80ms TTL=242
Reply from bytes=32 time=101ms TTL=242

Ping statistics for
Approximate round trip times in milli-seconds:
    Minimum = 79ms, Maximum = 119ms, Average = 94ms

If it's not, you'll get a response like this:

Ping request could not find host. Please check the name and try again.

If you ping a site and it's live, but you can't connect to it with your browser, a DNS problem might be the reason. If you suspect you're having a DNS problem, take the following actions:

  • Check your HOSTS file. If your HOSTS file contains an incorrect or outdated listing, you won't be able to connect. Even if you don't recall adding listings to a HOSTS file, it still may contain listings, because some Internet accelerator utilities edit them without telling you. Open your HOSTS file with Notepad and see if the site you can't connect to is listed there. If it is, delete the entry, and you should be able to connect.

  • Check your DNS settings. Make sure your DNS settings are correct for your ISP or network. Find out from your ISP or network administrator what yours are supposed to be. Then, to find out your current DNS settings, double-click on the problem connection in the Network Connections folder, choose Support → Details, look at the bottom of the tab to find your DNS servers. If they don't match what they're supposed to be, right-click on the problem connection and choose Properties. Then, highlight Internet Protocol (TCP/IP) and choose Properties. Change the DNS servers to the proper ones, or choose "Obtain DNS server address automatically" if your ISP or network administrator tells you to.

  • Flush your DNS cache. The problem may be related to your DNS cache, so flush it out. To flush the cache, type ipconfig /flushdns at a command prompt.

  • Find out if your ISP is having DNS problems. The cause may be your ISP. One possibility is that one of its DNS servers is down, and you're trying to access the down server. Ping each of your ISP's DNS servers and, if any of them don't respond, remove them from your DNS list, as outlined earlier in this hack.


Return to the O'Reilly Network.