Thứ Năm, 28 tháng 7, 2016

hosts and lmhosts part 1


colinearpsycho

if i add an entry into the hosts file, shouldn't it stop me from trying to access that webpage? i'm also wondering, how to lookup the ip address of pages i visit, or servers i connect to so i can prepare similar file configurations to hosts and firewall settings.



pparks1

if you put an entry in a hosts file, the computer will NOT stop you from accessing the webpage, but rather will always use the IP address that you put into the hosts file. It's like writing down a phone number in an address book. If you ALWAYS use your address book, and never use the phone book (DNS), then you will always believe the phone number from your address book is the right number.

As far as looking up pages you visit, go to a command prompt and type, ping Google. And it will respond with an IP address of a google server. However, be advised that many big web services and such have tons and tons of machines that serve up their web pages. So, hard coding a specific server for a site into a hosts file is not always a desirable action.

colinearpsycho

so lmhosts.sam is a pain in the kilt-covered? I'm confused as to the hosts file (not lmhosts.sam). It seems to me that I should be putting MY IP address in place of 127.0.0.1. I have trouble with wording, and although a lot of information on the net says 127.0.0.1 is the loopback, I am unsure if the new ipv6 implementations have comprimised the integrity of an ipv4 loopback interface. I don't feel hosts is doing it's job tbh...I've read a few tutorials, and they all say the same thing but on this network I don't have to do anything technical in order to have to scratch my head and say, why is the screen glitching, what's the stall...

I am near to say it's 2gb of memory, but it's ddr3 and a 2.8 ghx athlon II x2 220, not top of the line I know, but it shouldn't have trouble running several non graphics intensive programs side by side and after I configured the task scheduler, there was a lot of hang-up; I was trying to think of a way to make a really secure hardware firewall without coding, because I don't know code, and with 3rd party programs. For instance, the idea was to get defender running on a schedule, and anti-virus, to setup windows firewall appropriately, and just dedicate this small form factor machine to that purpose (it didn't meet the specifications for heavy rendering, although it meets the minimum specs, those should be raised!).

that's the story short, and if you can't answer further, cool, thanks for your input. and of course, i was placing similar entries to hosts in restricted sites (like with spybot's hosts integration, and manual entries as I came across ad cookies, or research pages). It just doesn't seem sufficient enough. I'm almost sure it's something called wervault, or werfault? It is one of those stock programs that installed with Windows, I just can't finger the spelling, but the real issue is that just randomly blocking programs that sound funny, isn't working because it's always an issue with another service or program. Although the microsoft websites say a lot, they really don't place much emphasis on detail, except to say this is what the program does in the broadest spectrum. There is no cross reference for, these programs may implement the program wervault or whatever, these may implement it (with or without network connectivity), even again on a broad basis. So it's tough to nail down the system.

WebMattR

Okay. So, as I've read through this, I'm afraid I've lost track of something somewhere along the line, so I was hoping to start with a simple question, and perhaps the answer to that will help us help you with the original question you asked.

With this whole process you're doing, what exactly is your end goal? Are you trying to block websites, or something different?

colinearpsycho

to prevent redirection to known malware addresses.
i was under the impression that this is the purpose of the hosts file. and that's why it surprised me, that by entering ip's or domains on the list in conjunction with a local loopback point, IE will still allow users to navigate to those addresses. maybe this is a point of insecurity in IE, that it isn't monitoring it's own http redirection functions. and don't let me fool you into think i know the first thing about internet explorer besides knowing how to prompt for cookies.

logicearth

Alright. I'll put it clearly as possible. The hosts file does not do what you think it does. The hosts file is a low tech version of an DNS. A DNS turns domain names, like google.com, yahoo.com into something a computer understands, IP addresses. That is what a hosts file does, its a DNS a very low tech DNS.

colinearpsycho

lmhosts is from what i understand, but hosts i guess is supposed to (according to my reading) vary. providing the functionality of not permitting IE or other browsers redirect internet traffic to ip's or domains listed in the file, and instead (and this is where i'm confused) either redirecting them to a loopback point 127.0.0.1, or using the ip address on the file considered the loopback point to prevent redirection to a site, from that ip address.

so

127.0.0.1 doubleclick.net 0.0.0.0

in the hosts file says don't let doubleclick.net from 0.0.0.0 redirect traffice originating from 127.0.0.1

127.0.0.1 is supposed to be the localhost, and that's why i got confused as to whether i should input my ip address instead of 127.0.0.1. i understand what lmhosts does more or less, it registers ip's to websites. there are two troubles i see with it though, one being that dynamically assigned ip's seems to be all the craze so constant updating of that file would be annoying as all heck without a range of generic addresses for a page. and secondly i don't know if lack of having an lmhosts.sam file means that if i did have 128.6.4.32 suchandsuch.net (and that might be correct syntax but assume it were for an lmhosts entry just to suffice as an albeit bad, example), then does lmhosts.sam not tell me via an internet explorer prompt that website is trying to redirect traffic? i guess I should try it out. the problem is i don't have any means of testing it out....nor do I really want to.

to revert, the hosts file preventing traffic redirect doesn't sound like it should work without using my ip address, or without having a loopback point that is listening to web traffic, i.e. another machine for sandboxing or some such. it's like goto statement harmful. i installed a program called hostess, to help manage the hosts file too. and i experimented and placed my ip into the 127 setting, when hostess did her thing of manicuring the hosts file into well name groups and categories, it only renamed some of the entries back to the 127 setting. i'm not sure why, but i also want to associate 127 with doubleclick.net.

does that clarify my issue more?

WebMattR

Quote�� Quote: Originally Posted by colinearpsycho View Post
to revert, the hosts file preventing traffic redirect doesn't sound like it should work without using my ip address, or without having a loopback point that is listening to web traffic, i.e. another machine for sandboxing or some such. it's like goto statement harmful. i installed a program called hostess, to help manage the hosts file too. and i experimented and placed my ip into the 127 setting, when hostess did her thing of manicuring the hosts file into well name groups and categories, it only renamed some of the entries back to the 127 setting. i'm not sure why, but i also want to associate 127 with doubleclick.net.

does that clarify my issue more?
The hosts file isn't designed to prevent anything. The host file is a very very basic DNS function. Mainly, it just specifies a loop back address. Now, I'm almost afraid to ask, but why would you want to specify that your loopback address points to doubleclick.net? That probably would just break things... not to mention sending you to doubleclick.net.

Personally, I'd say install Antivirus, a Firewall, and just leave the poor host file alone. It really isn't designed to do what you're trying to do, if I'm even understanding it correctly.

pparks1

What happens with a host file and malware, is that some malware will PUT entries into a hosts file so that your computer goes to whatever site "THEY" want you to go to, versus the legitimate site that DNS would direct you to.

fseal

Quote�� Quote: Originally Posted by colinearpsycho View Post
so

127.0.0.1 doubleclick.net 0.0.0.0

in the hosts file says don't let doubleclick.net from 0.0.0.0 redirect traffice originating from 127.0.0.1
1) lmhosts is for windows networking only so forget about that, hosts is for the internet

2) You sort of have it backwards. Your entry above means that when your computer tries to look up the address of "doubleclick.net" it will use 127.0.0.1 instead of the actual address.

So yes you can block sites that way.

OR if you find that for some reason your DNS server is returning bad addresses for say Google you can put in something like

www.google.com 74.125.224.171

And instead of using DNS it will use that known good address for google.

BUT!

If you have a virus or something that is redirecting your lookups locally then the hosts file maynever get used or as mentione above even rewritten in order to cause the redirection...

The hosts file is most useful for two things. Blocking a web site by NAME (not number). or if your DNS is out or bad or some other reason, entering entries by hand...

colinearpsycho

before you said that if i had an entry in the hosts file it wouldn't prevent traffic to that website, if i entered it in internet explorer. either that, or are you saying the fact that it doesn't SOUNDS like i have a virus that is redirecting traffic locally? however you answer those inquiries, how can i make sure that IE uses the local hosts file to some degree...then again, if i have a hosts file, what is the point of the dns service in administrative tools/services? i've read that having a very long hosts file, will see better use and performance if that service is turned off. so it shouldn't be difficult to see from this botched up mess how confusing this becomes.

Quote:
OR if you find that for some reason your DNS server is returning bad addresses for say Google you can put in something like

www.google.com 74.125.224.171

And instead of using DNS it will use that known good address for google.
in that quote you're talking about lmhosts file right? because if you're still talking about the aforementioned hosts file, then it's just all the more confusing and the trouble is, it's the same pathetic answer from the entire internet (and i don't mean to sound a prick, but you google it and see what you can come up with, it's taxing). also whether you're talking about hosts or lmhosts you have the syntax backwards, it's loopback domain name ip for hosts and ip domain # for lmhosts.



pparks1

LMHosts file is for handling windows workgroup and domain nanming when methods such as WINS fails. This is not for resolving names of websites and such on the Internet. It's for the local network. LM stands for LAN Manager. So, LMHOSTS is a LAN MANAGER hosts file. This is for resolving things like the NETBIOS name of the machine.
LMHOSTS - Wikipedia, the free encyclopedia.

Now, some people don't care whatsoever about a netbios name of their computer. For example, Linux boxes aren't configured with that at all. They just have a local hostname on the box....and all name resolution is strictly done with DNS or a hosts file. So, it's not absolutely required that you have both configured.

If you have a hosts file on your computer (C:\Windows\system32\drivers\etc\hosts), then Windows will use this file without question to resolve the IP address for the website you are attempting to find. Same thing happens in linux, but here the file is /etc/resolv.conf. If you want to test that it's working, put in 10.10.10.1 for www.google.com...then try to hit Google in your IE web browser. If you do NOT get the Google web page, you know that your machine is indeed using HOSTS and not DNS to resolve that name.

The DNS client service allows your computer to use DNS to look things up on the Internet. While you can shut this off, it would break pretty much everything on the Internet that you didn't manually specify in your hosts file. While a hosts file can improve performance (as it doesn't need to look up the address in DNS on the Internet), these lookups are nearly instantaneous. Plus, if you hard code a web page into a HOSTS file and the person running the website decides to move it to another IP address...your access will break until you figure out what the new IP address is and then adjust your hosts file accordingly. Seriously, I wouldn't even consider shutting off DNS in favor of HOSTS for any type of performance reason. You will spend far more time troubleshooting why nothing works properly on your machine which will far outweight any times savings in DNS lookups.

the syntax for HOSTS, is
x.x.x.x www.domainname.com

If there is any confusion, look at the same lines MS provides in their file. And the # means the line is commented out...thus won't work.
Code:
#      102.54.94.97     rhino.acme.com          # source server #       38.25.63.10     x.acme.com              # x client host

fseal

Oops yeah I used the OPs example and got the entries reversed for the hosts file sorry

danforward

Forget about lmhosts.sam. It is a SAMPLE file and does nothing. It shows examples of what can be done in the lmhosts file, which is not what you want either.

When your computer tries to resolve the IP address for a website, it first looks in your C:\Windows\System32\drivers\etc\hosts file. If it is not found in there, it checks your DNS cache. If not in there, it will contact your DNS server. That is what makes your hosts file such a great place to block unwanted web sites. It always gets checked first.

It does not really matter what IP address you assign to web sites you want to block. 127.0.0.1 is usually a good choice, unless you run a web server on your machine. It just tells your computer to go to your machine rather than theirs, which of course fails. I prefer to use 0.0.0.0 because it is never a valid machine.

So, to achieve the effect you want, append the entries to your hosts files like this:

0.0.0.0 doubleclick.net www.doubleclick.net
0.0.0.0 badsite.com www.badsite.com ads.badsite.com

The format is an IP address followed by spaces or tabs, followed by one or more domain names separated by spaces or tabs. In theory you could put all sites you want to block on one line. In practice, it is easier to manage by placing one domain on each line or related domains on each line as I have done above. I could have just as easily done this:


0.0.0.0 doubleclick.net
0.0.0.0 www.doubleclick.net
0.0.0.0 badsite.com
0.0.0.0 www.badsite.com
0.0.0.0 ads.badsite.com

or this:


0.0.0.0 doubleclick.net www.doubleclick.net badsite.com www.badsite.com ads.badsite.com

WebMattR

Quote�� Quote: Originally Posted by danforward View Post
It does not really matter what IP address you assign to web sites you want to block. 127.0.0.1 is usually a good choice, unless you run a web server on your machine. It just tells your computer to go to your machine rather than theirs, which of course fails. I prefer to use 0.0.0.0 because it is never a valid machine.
The problem with this usage of the host files is that it will slow down every query your machine makes, because it has to compare that to each individual entry in the hosts file. I seriously suggest you simply install antivirus, run a firewall, and forget this entire idea. it's just going to kludge things up for you. You can't add sites fast enough for it to ever be relevant, and every entry slows your ability to use the internet down a little, since it has to be scanned for every query that goes out.

SledgeDG

You're not serious, are you?
Unless you cramp your hosts with literally thousands of lines, in the time your computer does 1 DNS query it could probably do some 500 queries of the local hosts file .
I don't think that one shouldn't worry about any speed concerns in this context

-DG

fseal

Yeah, the hosts file can be actually be used to speed up your internet surfing by hard coding local lookups for sites you visit often (Though you may have to keep them up to date now and then). DNS queries are one of the major slowdowns of web surfing... (That and the BW to DL all the images and ad spam, which is why all these browser speed tests are really amusingly misplaced in 99% of all cases)

WebMattR

Quote�� Quote: Originally Posted by SledgeDG View Post
You're not serious, are you?
Unless you cramp your hosts with literally thousands of lines, in the time your computer does 1 DNS query it could probably do some 500 queries of the local hosts file .
I don't think that one shouldn't worry about any speed concerns in this context

-DG
I was/am serious. I was told that by the guy who taught my CCNA course.

SledgeDG

Just think about it for a sec (hard drive access time/RAM access times once it's cached compared to the time a query to your DNS takes with all your average net latency and stuff.
Still we're haggling about milliseconds here. that's why I said that this is nothing to be worried about.
I'm not question the qualification of your teacher. Maybe said guy had a bad day or the whole story had a different context who knows... but I have bee told BS before even from guys who should know better

Anyways..I leave it at that I wasn't trying to convince anyone

-DG

colinearpsycho

well that clears up the issues about hosts. i have to admit though i'm still a little fuzzy when some of you are referring to hosts or lmhosts. when i read the descriptions provided by ms, they are distinctly different pages, so presuming one is useless to the other is apparently only a matter obstascles in resolution.

lmhosts for use with netbios is a register then

&

hosts is a file which redirects traffic

in conversation, hosts doesn't sound unlike http redirection and lmhosts doesn't sound to far unlike default document, except that it is a name resolution for a (hopefully) overseen page on the network or webpage.

insofar as the example of inputting 10.10.10.1 and google, you mean to place that in lmhosts if i'm correct? i attempted to look up 10.0.0.1 simply by typing it into IE (which it's settings don 't permit the submission of unknown addresses), and it popped up a very broad search result for a number of webpages, and I did not see google listed therein. google pings are also not coming back from 10.10.10.1.

and I should add that having input entries into hosts in the required syntax, and still being able to reach a webpage is disconcerting, i should think i would be getting an error, or loading hang. so hosts also doesn't seem far from default document in addition to http redirection. which i've noticed, because if i input an unavailable domain, the web server returns with very similarly comprised css pages advertising domain sales.

SledgeDG

Google can't have any 10.x.x.x-address those are private addresses like the notorious 192.168.x.x and thus not routable

Check this out: http://tools.ietf.org/html/rfc1918



pparks1

Quote�� Quote: Originally Posted by SledgeDG View Post
Google can't have any 10.x.x.x-address those are private addresses like the notorious 192.168.x.x and thus not routable

Check this out: RFC 1918 - Address Allocation for Private Internets
For Pete's sake, I realize this. It was simply put as an example. If he puts in 10.something into the hosts file and then pings and it resolves 10.something then he knows the host file is working as expected and DNS is not taking over.

colinearpsycho

@pparks1

i didn't understand your last answer parks. i didn't catch the example either, but no harm no foul. but you have me confused insofar as dns taking over, i thought dns and hosts are playing on the same team? do you mean to say that in regard to the suggestion that there is some server side confusion with name resolution that was made earlier? excuse me, i'm not slow but the whole playing the middle diddle puts me in kilts.

WebMattR

You open a web browser, and type in www.sevenforums.com. The following is a simplification of what occurs:

Your machine looks at hosts file.
It doesn't find 7F.
It then sends a query to a DNS server.
The DNS server searches until it finds 7F.
It transmits the required information to your web browser, and you are sent to the page.

Does that help?

pparks1

Quote�� Quote: Originally Posted by colinearpsycho View Post
i didn't understand your last answer parks. i didn't catch the example either, but no harm no foul. but you have me confused insofar as dns taking over,
If you don't have anything in your hosts file, your computer will look up the answer via a DNS server. If you have an entry for the address in question in the hosts file, it will use that.


Quote�� Quote: Originally Posted by colinearpsycho View Post
i thought dns and hosts are playing on the same team?
DNS and hosts files do the same thing. 1 is centralized and available on the Internet for everybody to use, and one is local on your own computer that only you can use. And your computer will use an entry in the local hosts file, if 1 exists.

Jacee

This is about DNS cache poisoning and redirects DNS cache poisoning - Wikipedia, the free encyclopedia

This is about the Hosts file and DNS
Hosts (file) - Wikipedia, the free encyclopedia

See the faq and add a good Hosts file http://msmvps.com/blogs/hostsnews/default.aspx

colinearpsycho

hahaha, everyone is quite fixated on the hosts file, but the discussion is about the hosts and lmhosts files. i understand the process of the hosts file, i was trying to clarify what parks was saying because it conflicted with previous answers, and the use of syntax has bounced back and forth through replies so i need to catch up on which file repliers are referring to; so that the confusion is minimal and things don't get heated in discussion & then I become lost. apologies.

this shouldn't defer the topic, would using a proxy software like squid or tor help? tor seems to bounce your connection location data around to hide your surfing, and presumedly squid performs the exact same action, but all this talk about dns servers has me wondering if squid-cache, you see, doesn't lend to that function.

and then of course, your help is appreciated, but it doesn't help to have ms windows saying different things about hosts than the common suggestion says or other websites. wikias tend to be user interactive, which doesn't take away from their validity but it might diminish the clarity of logic. wikipedia and hosts say the same thing, but you have to admit that the mapping of addresses seems more pertinent to lmhosts, and with programs like spybot offering hosts files, msvps.org, or gorilla, stevere martin; etc. also providing hosts files which are meant as redirect entries in the hosts file, the mapping term is confusing. so i guess that means that as for the hosts file itself, i don't have to simply provide a redirect like 127.0.0.1 or 0.0.0.0 i could place accurate entries like #.#.#.# example.com which are actual address/domain combinations and it would still be correct use of the hosts.file file. so why are there hosts and lmhosts files?

pparks1

Quote�� Quote: Originally Posted by colinearpsycho View Post
hahaha, everyone is quite fixated on the hosts file, but the discussion is about the hosts and lmhosts files.
Do you now understand what the lmhosts file does. It's for netbios names on a Microsoft based network, either workgroup based on domain based. For example, I I could have 4 machines on the network, named "fish", "pony", "horse", and "donkey". These would ALL be the lmhosts names of these machines. So, if I wanted to access a share from any of them, I would look for their name in Network places to locate the share. But, I might run 4 websites off each of these. Perhaps "fish" hosts www.fishtanksRcool.com, and "pony" hosts www.poniesarecool.com, and "horse" hosts Horseplay.com! and finally "donkey" hosts www.donkeypunch.com". So, these fully qualified domain names would be controlled by DNS or by the hosts file.

Quote�� Quote: Originally Posted by colinearpsycho View Post
this shouldn't defer the topic, would using a proxy software like squid or tor help?
Help to do what, what are you trying to accomplish?

Quote�� Quote: Originally Posted by colinearpsycho View Post
so why are there hosts and lmhosts files?
Please see my answer above. The lmhosts is a lan manager hosts file. It maps netbios names on a microsoft based network. The hosts file is a hosts file and it does fully qualified domain names to IP addresses. The hosts file is like a small manually controlled copy of DNS that you put right on your own computer. But unlike DNS, you have to maintain it and know about any and all changes.

hosts and lmhosts is kinda like engines versus motors. 1 of them runs on gasoline or diesel fuel, and 1 of them runs on battery power. Both can be placed into a car allowing you to go from point A to point B. And on the Internet, you will find people that talk about the motor in their car...when in fact it's an engine. And you might find somebody discussing the engine in the radio control car, when in reality it's a motor.

colinearpsycho

motors accrue mileage. engines run horsepower.

i guess that puts the two in perspective whether or not you meant to, although it's and i hate to say it, hardly from understanding a straight forward bit. lots of run around.

mileage being that hosts adds a mile (sends traffic back to loopback point) everytime x amount of feet (an ip) is reached.

the engine has x amount of pistons (domains) that translate into horsepower (ip's) <--- that ones kind of off i know. beats trying to figure out the analytical engine...

and the thing to note about when i changed my hosts.file file is this was a few days ago and it was for a brief time so (also i've reloaded the os), hopefully minimal damage happened in that period.

hosts.file is understood well enough now, and i hate being redundant so shame on me for asking: 127.0.0.1 or 0.0.0.0 or x.x.x.x is a loopback point

0.0.0.0

and it sends badwebsite.com queries to this loopback point to prevent communication reaching and data traversing to and from badwebsite.com

0.0.0.0 badwebsite.com

the real question has yet to be answered though, why doesn't an entry being made in the hosts.file file then, not prevent traffic to badwebsite.com. as stated, i placed a website on the hosts.file file in proper syntax, having (and this wasn't mentioned) 127.0.0.1 localhost NOT commented out (meaning having no comment characters before the line), yet when I entered the address into the IE address bar, traffic still went to the webpage. unless there are replications of the website so that it knows if my hosts says don't go there, go here it's the same thing with a different address but how is stupid is so stupid does going to know?

i do understand the lmhosts file now. i just don't see the purpose and that's only because I don't well understand the preload and domain functions yet. according to the file they don't serve as comments. there is no need to go into that matter here, I just want to clarify the precise roles and faults of these two files, aside from being goto statements.

thanks for all your help, sort of

pparks1

Quote�� Quote: Originally Posted by colinearpsycho View Post
hosts.file is understood well enough now, and i hate being redundant so shame on me for asking: 127.0.0.1 or 0.0.0.0 or x.x.x.x is a loopback point
The ONLY address that is a loopback address is 127.0.0.1 and that means, "THIS HOST".


Quote�� Quote: Originally Posted by colinearpsycho View Post
0.0.0.0 badwebsite.com

the real question has yet to be answered though, why doesn't an entry being made in the hosts.file file then, not prevent traffic to badwebsite.com.
If you put that entry into a HOSTS file, it WOULD prevent you from accessing badwebsite because you would only look to 0.0.0.0 to find it...which of course it isn't there. In fact, you could practically set it to any address other than it's actual address and you would PREVENT yourself from accessing the site.


Quote�� Quote: Originally Posted by colinearpsycho View Post
as stated, i placed a website on the hosts.file file in proper syntax, having (and this wasn't mentioned) 127.0.0.1 localhost NOT commented out (meaning having no comment characters before the line), yet when I entered the address into the IE address bar, traffic still went to the webpage.
You must have done it wrong. Try this, put this line into hosts
Code:
68.42.10.10 www.google.com
Now, open up a command line, type:
Code:
ping www.google.com
. It better respond with 68.42.10.10. Now, open your web browser. Type in :
Quote:
It should NOT open google.com unless I get horendously unlucky and 68.42.10.10 is in fact google.



Quote�� Quote: Originally Posted by colinearpsycho View Post
i do understand the lmhosts file now. i just don't see the purpose
That's because there practically is NO purpose for LMHOSTS these days. It was used like 15 years ago when Windows workgroups and such weren't using DNS for name resolution. Everything more or less uses DNS or hosts files these days to accomplish the same thing that lmhosts used to do in a Windows environment. Like I said, other Operating Systems like Linux or OSX don't even use LMHOSTS files. I haven't used an lmhosts file or worked with WINS in a number of years now. It's all handled in DNS and when DNS isn't the answer, a HOSTS file.

colinearpsycho

but why should i even do that, if the iterated process of hosts is to send addresses to a loopback point? if i use 127.0.0.1 google.com it will open. being that the address you give isn't google, why shouldn't it open? where is the variation, except that 127.0.0.1 is sending traffic back to a generic (like 168.192 or 192.168.x.x)... then again supposing someone is using a web server with that address on the network i just (presuming the address is bad) screwed them over. so it's like hot potatoe, and that's crap in terms of keeping a computer well maintenanced and configured. then if 127.0.0.1 is the only loopback point, it sounds more like you are saying in an office environment, you have a loopback point, don't deviate from that point in order to place our traffic into the sandbox and not screw people over. 0.0.0.0 makes sense as an alternate then, because insofar as i know there is no applicable web address for 0.0.0.0 (unless y2k was supposed to happen not because of numerical issues with time handling, but because some berkley genius didn't realize an important server was dedicated 0.0.0.0 when the protocol emerged).

i'm just saying that your example doesn't seem relevant in the same way that the hosts file is supposed to work where i can say, it's functioning because i can't look at the ip you gave and say, 'google' traffic was redirected there. did the website open then because i used 127.0.0.1 ? i don't understand that either, because my ip address is not 127.0.0.1 when i use cmd.exe to look it up with ipconfig. then again, it isn't the same when i use a live disc either. windows reports it as one number with ipconfig, and gentoo will report it as another number with ifconfig.

to fruther the discussion (if you want to call three pages on this topic that) would i then have to have a seperate machine to test if traffic is redirecting, or could i setup another disc and make it dedicated server space, and test it in that way? i'm not sure if you can 'fool' windows in that way, but i would presume because with 7 you can convert discs to dynamic although i guess that's flawed logic. I can't say whether the foolery is technically similar.

and i'm presuming by ::1 being present in the example that I can use ipv6 protocol addresses in the same way as tcp/ip/udp addresses are used respective to format?

so i suppose this is where confusion of a sort turns to frustration because i have to assume that Windows isn't (and i hope this is the correct term) enumerating internet address protocols correctly. otherwise, since my ip isn't the loopback point, i should have gotten an http error trying to direct traffic to the test entry. unless i had entered my ip in the test line, which i did not at that phase in trying to understand the hosts file function and process.



colinearpsycho

...make that 4 pages on the topic, it really isn't a bother to myself though...sorry if it's a nuissance on you..

i did try your example and i tried it in four ways:

googles ip
an odd ip (sorry odd ip it's just google)
my ip
and 127.0.0.1

the web browser did surf to google.com everytime. and i entered it in the address bar the exact same way it was listed in the hosts file. google.com. i used the hosts.file file, not lmhosts.sam because lmhosts is supposed to provide netbios names, and some functions regarding addresses to surf to from what i gather, and not traffic redirection.

as stated, if i enter an ip in the address bar it's producing google searches for that ip.

as a side note, can i enter addresses as http:// or https:// or ftp:// etc? or does a working hosts file strictly rely on a simple format of ya.da.com or yada.com; etc. does that syntactic form have a name like there is pnrp?

logicearth

Do you even know what it is you are trying to do, colinearpsycho?
Because, right now this thread is nothing but a waste of time.

pparks1

Quote�� Quote: Originally Posted by colinearpsycho View Post
i did try your example and i tried it in four ways:

googles ip
an odd ip (sorry odd ip it's just google)
my ip
and 127.0.0.1

the web browser did surf to google.com everytime. and i entered it in the address bar the exact same way it was listed in the hosts file. google.com. i used the hosts.file file,
Well, you MUST be doing something wrong. This is a fundamental process. it's as easy as 1+1=2.
And the file is simply hosts....not hosts.file

Do, these steps exactly like this;
Run command prompt as administrator.
Code:
notepad C:\windows\system32\drivers\etc\hosts
Ensure it looks like this;
Code:
# localhost name resolution is handled within DNS itself. #    127.0.0.1       localhost #    ::1             localhost 127.0.0.1        www.google.com
Then, from command line, run ping Google. Your results should be exactly like this;
Code:
C:\Windows\system32>ping www.google.com  Pinging www.google.com [127.0.0.1] with 32 bytes of data: Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128  Ping statistics for 127.0.0.1:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 0ms, Maximum = 0ms, Average = 0ms  And it should be noted that you have to try hitting www and then the .google.com.   If you simply put google.com...well that's a different name and it will resolve using DNS to the right thing as shown;  
Quote:
C:\Windows\system32>ping google.com Pinging google.com [74.125.225.17] with 32 bytes of data: Reply from 74.125.225.17: bytes=32 time=63ms TTL=55 Reply from 74.125.225.17: bytes=32 time=61ms TTL=55 Reply from 74.125.225.17: bytes=32 time=64ms TTL=55 Reply from 74.125.225.17: bytes=32 time=64ms TTL=55 Ping statistics for 74.125.225.17: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 61ms, Maximum = 64ms, Average = 63ms C:\Windows\system32>
Now, if you put a line in C:\Windows\system32\drivers\etc\hosts as follows, it would then work;
Code:
#    127.0.0.1       localhost #    ::1             localhost 127.0.0.1        www.google.com 127.0.0.2        google.com 172.16.10.1        www.wackyexample.com
Watch what happens
Quote:
C:\Windows\system32>ping www.google.com Pinging www.google.com [127.0.0.1] with 32 bytes of data: Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Ping statistics for 127.0.0.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms C:\Windows\system32>ping google.com Pinging google.com [127.0.0.2] with 32 bytes of data: Reply from 127.0.0.2: bytes=32 time<1ms TTL=128 Reply from 127.0.0.2: bytes=32 time<1ms TTL=128 Reply from 127.0.0.2: bytes=32 time<1ms TTL=128 Reply from 127.0.0.2: bytes=32 time<1ms TTL=128 Ping statistics for 127.0.0.2: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms C:\Windows\system32>ping www.wackyexample.com Pinging www.wackyexample.com [172.16.10.1] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 172.16.10.1: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), C:\Windows\system32>
Now, if I change up the hosts file to read differently, look at new results;
Code:
# localhost name resolution is handled within DNS itself. #    127.0.0.1       localhost #    ::1             localhost 1.1.1.1        www.google.com 1.1.2.1        google.com 1.1.3.1        www.wackyexample.whattheheck.com  C:\Windows\system32>ping www.google.com  Pinging www.google.com [1.1.1.1] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out.  Ping statistics for 1.1.1.1:     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),  C:\Windows\system32>ping google.com  Pinging google.com [1.1.2.1] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out.  Ping statistics for 1.1.2.1:     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),  C:\Windows\system32>ping www.wackyexample.whattheheck.com  Pinging www.wackyexample.whattheheck.com [1.1.3.1] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out.  Ping statistics for 1.1.3.1:     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),  C:\Windows\system32>
C:\Windows\system32>
Finally, if you open IE and type in
Code:
http://www.google.com
You should get a page cannot be displayed error page


Now, watch what happens as I adjust host file entries;

Code:
# localhost name resolution is handled within DNS itself. #    127.0.0.1       localhost #    ::1             localhost 1.1.1.1        www.google.com 1.1.2.1        google.com 1.1.3.1        www.wackyexample.whattheheck.com   C:\Windows\system32>ping www.google.com  Pinging www.google.com [1.1.1.1] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out.  Ping statistics for 1.1.1.1:     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),  C:\Windows\system32>ping google.com  Pinging google.com [1.1.2.1] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out.  Ping statistics for 1.1.2.1:     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),  C:\Windows\system32>ping www.wackyexample.whattheheck.com  Pinging www.wackyexample.whattheheck.com [1.1.3.1] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out.  Ping statistics for 1.1.3.1:     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),  C:\Windows\system32>


Yeah, I'm throwing in the towel in this thread. I do computer systems admin stuff for a living. I manage windows servers and Linux servers and have been doing so for 12+ years. I run some of the DNS servers in our shop and have a fair amount of experience with networking overall. I cannot for the life of me, even determine what the OP is trying to accomplish or what they are doing.

colinearpsycho

what's an OP? and i told you i performed those steps, they aren't working. apparently one or two of you fellers could use some time away from the terminal.

logicearth

OP in this context means, Original Poster, you colinearpsycho.

colinearpsycho

ok thanks for that information. yeah i realize i'm trialing parks patience and you might not see the logic in my asking in conversation versus reading the knowledge bases. to say it readily, the idea of tutoring someone on the topic just isn't straight forward through the internet; while i can find a tutorial, it isn't going to make me understand concretely which ip to use, or why the file is not acting according to the way that it is described in literature as as it has been described here. the simple fact for me is that it is not. i think i've put it pretty plainly, i'm not sure how expertise could alude to unclarity in explaining the issue so that i can resolve it; meaning the trouble doesn't seem amateurish as i've tried the proper syntax. so it only seems fit that i should ask someone knowledgeable, and then again if the entire trouble i'm experiencing with name resolution and/or hosts is more than just understanding the file structure of a hosts file, then it doesn't make sense to surf the internet trying to find the answer. maybe it's rude to post on a forum expericing a possible computer error, but stopping me short of i'm better than you isn't resolving a damn thing. hate to sound like a highlander who has lived in texas for twenty years, but i'd like to understand why the file isn't functioning. and the only two possible answers i can come up with, or three if you want to be concise, is that either dns just isn't resolving properly, there is a default document on the network providing redirection to newly addressed websites when a hosts entry is made (i'm not sure if that differs from a hijacking it seems more like a bypass), or there is a peripheral or interface error that is causing the trouble as an underlying factor, making the hosts file obselete (which is why i said it sounds like goto statement harmful).

i'd just like to resolve the trouble, and learn from the issue. reloading the operating system time and again for errors i might be able to solve is not productive. the entire idea behind maintaining a forum i think, and i apologize again if this is rude to you gurus, is that it is productive and ducking out the back oin the OP like this were an mmo duel is ridiculous. if that's the case, why respond? even more still, i don't intend to produce a reality ... script.... (show) and i don't see why forums for technical problem solving seem to reduce themselves to conflicts over RTFM. acquisition of and effective use of human correspondance is as a fact faster and more productive when dealing with i/o systems. i'm just trying to procure some more learned advice for myself on the matter. i'll recap again, but i'm not trying to draw out the resolution of the issues placed forth in this post:

-the hosts file syntax is correct
- i understand the function of hosts and lmhosts
- redirection function of the hosts file is somehow being thwarted

that seems to be where the resolution process has arrived.

pparks1

Quote�� Quote: Originally Posted by colinearpsycho View Post
- redirection function of the hosts file is somehow being thwarted

that seems to be where the resolution process has arrived.
Yes, this must be the case. Perhaps you have some malware or something else on your machine that is preventing the HOSTS file proper working. I work with hosts files every single day at work in a lab where we don't have DNS in place and I can guarantee you that what I am showing is the way that it's supposed to work.

1. Did you by any chance apply a system tweak that prevented your computer from using the HOSTS file?
2. And when you do make changes to C:\windows\system32\drivers\etc\hosts you are SAVING the file before testing, right?


Code:
Microsoft Windows [Version 6.1.7600] Copyright (c) 2009 Microsoft Corporation.  All rights reserved.  C:\Windows\system32>notepad C:\windows\system32\drivers\etc\hosts   # For example: # #      102.54.94.97     rhino.acme.com          # source server #       38.25.63.10     x.acme.com              # x client host  # localhost name resolution is handled within DNS itself. #    127.0.0.1       localhost #    ::1             localhost 192.168.1.1        www.google.com 192.168.1.2        www.sevenforums.com
Now, the results of a ping should come back as follows; Notice that the replies are from my router (192.168.1.1) and from my file server (192.168.1.2). These replies are NOT from the legitimate web servers which host either Google or Sevenforums. If I attempted to hit either of these pages with my web browser, they would NOT come up as the web server code for Google and Sevenforums is NOT running on either my router (192.168.1.1) or my file server (192.168.1.2).

Code:
C:\Windows\system32>ping www.google.com  Pinging www.google.com [192.168.1.1] with 32 bytes of data: Reply from 192.168.1.1: bytes=32 time=4ms TTL=64 Reply from 192.168.1.1: bytes=32 time=4ms TTL=64 Reply from 192.168.1.1: bytes=32 time=4ms TTL=64 Reply from 192.168.1.1: bytes=32 time=5ms TTL=64  Ping statistics for 192.168.1.1:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 4ms, Maximum = 5ms, Average = 4ms  C:\Windows\system32>ping www.sevenforums.com  Pinging www.sevenforums.com [192.168.1.2] with 32 bytes of data: Reply from 192.168.1.2: bytes=32 time=4ms TTL=128 Reply from 192.168.1.2: bytes=32 time=4ms TTL=128 Reply from 192.168.1.2: bytes=32 time=4ms TTL=128 Reply from 192.168.1.2: bytes=32 time=4ms TTL=128  Ping statistics for 192.168.1.2:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 4ms, Maximum = 4ms, Average = 4ms  C:\Windows\system32>
If you deleted the lines (or comment them out) in C:\windows\system32\drivers\etc\hosts, you should get the following legitimate addresses back from DNS as shown.
Code:
# For example: # #      102.54.94.97     rhino.acme.com          # source server #       38.25.63.10     x.acme.com              # x client host  # localhost name resolution is handled within DNS itself. #    127.0.0.1       localhost #    ::1             localhost #192.168.1.1        www.google.com #192.168.1.2        www.sevenforums.com  C:\Windows\system32>ping www.google.com  Pinging www.l.google.com [74.125.225.16] with 32 bytes of data: Reply from 74.125.225.16: bytes=32 time=62ms TTL=55 Reply from 74.125.225.16: bytes=32 time=65ms TTL=55 Reply from 74.125.225.16: bytes=32 time=64ms TTL=55 Reply from 74.125.225.16: bytes=32 time=64ms TTL=55  Ping statistics for 74.125.225.16:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 62ms, Maximum = 65ms, Average = 63ms  C:\Windows\system32>ping www.sevenforums.com  Pinging sevenforums.com [74.86.171.210] with 32 bytes of data: Reply from 74.86.171.210: bytes=32 time=46ms TTL=113 Reply from 74.86.171.210: bytes=32 time=42ms TTL=113 Reply from 74.86.171.210: bytes=32 time=41ms TTL=113 Reply from 74.86.171.210: bytes=32 time=43ms TTL=113  Ping statistics for 74.86.171.210:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 41ms, Maximum = 46ms, Average = 43ms  C:\Windows\system32>
Now, if you want to see what DNS says the proper addresses are, you can use nslookup from command line as shown below; (note: you can also see that sevenforums has a legitiate ipv6 address )

Code:
C:\Windows\system32>nslookup Default Server:  vnsc-bak.sys.gtei.net Address:  4.2.2.2  > www.google.com Server:  vnsc-bak.sys.gtei.net Address:  4.2.2.2  Non-authoritative answer: Name:    www.l.google.com Addresses:  74.125.225.17           74.125.225.18           74.125.225.19           74.125.225.20           74.125.225.16 Aliases:  www.google.com  > www.sevenforums.com Server:  vnsc-bak.sys.gtei.net Address:  4.2.2.2  Non-authoritative answer: Name:    sevenforums.com Addresses:  2607:f0d0:1003:7b::2           74.86.171.210 Aliases:  www.sevenforums.com
I really hope this helps.

colinearpsycho

the syntax for hosts is

loopback friendly name resolution for the domain domain ip

that syntax is working sufficiently to block redirection to webpages. when i entered bleeping copmuter, (which i had made a few entries previously) MSE found and removed a hosts hijacker.

this is how i have lmhosts structured, the example is unclear and the terminology has me at odds.

site ip friendly name resolution #includes

i'm sure that format is working, at least it's what the file says to us, but i don't understand the #Include \\file. Does this cause lmhosts to query another file, run it as a script/batch, or start a program?
#Include C:\Windows\System32\drivers\etc\hosts

logicearth

Leave lmhosts alone.

colinearpsycho

why's that?

nslookup returned this:


drive:\directory\location>nslookup
Default Server: UnKnown
Address: serv.er.ip
>



logicearth

Because the lmhosts file is only used for special-purpose corporate environments.

colinearpsycho

like Pup/PARC? I don't mean to be redundant and beg the question, but the purpose seems like while it was designed for xxxx....it can be applied general purpose. any reason why it can't, as a finite answer, be applied more generally than an in-house network?

i was assignging the #pre ... switch? argument? so that when the browser loads, it is already anticipating this ip to this domain. is that not an accurate use?

WebMattR

Quote�� Quote: Originally Posted by logicearth View Post
Leave lmhosts alone.
x2. In this day and age, lmhosts is ignored by your machine.

pparks1

lmhosts isn't used anymore. Like I have said, probably a dozen times, it's for netbios name resolution on Microsoft workgroup or domain based networks. However, it's been replaced with DNS for a number of years now and is almost not used anywhere. The only thing it's applicable to is a home, business or corporate network. This isn't routable on the Internet and won't be used for resolving websites and the like. It's only for netbios names on a Microsoft Network.

colinearpsycho

ok, fair enough. take care folks.

Không có nhận xét nào:

Đăng nhận xét