« Yavar source code is now online! | Main | Windows XP SP2 TCP connection throttling...No problem! »
December 07, 2005
Answers! Finally!
A while back I'd noticed that if I had VMWare installed on my PC, VNCAdmin scans would take forever. Shortly after that, I realized that if I disabled the two network interfaces that VMWare installs, the scan speed went back to normal. This bothered me, but I assumed that it was just an isolated issue on my machine. However, I asked around and tested on other machines and found that it wasn't just an isolated issue.
Well, after a year or two of wondering, I've finally figured out what the issue is. It has to do with using the gethostbyaddr() function for retrieving hostnames when all you have is an IP address. This function will use several different methods of finding the hostname if it needs to before giving up, (I forget in which order it does these, or even what all the methods are :) ). At some point, this function will try sending NetBIOS name requests to the remote PC. The issue here is that it sends NetBIOS requests on each network interface that is defined on your host. So we're doing a lot more work, for the same result, (If you wonder how I know this, it's because I've sniffed the network traffic that the function generates). However, these VMWare interfaces are configured with 192.168.0.0/24 addresses, so they may not even be communicating with your network. I would assume that this would cause gethostbyaddr() to wait for responses on those interfaces or timeout when it doesn't get one, thus slowing it down even more.
However, now the question is, "How do I get around this?". Do I look for a newer reverse lookup function? Do I just write my own name resolution code by crafting and injecting DNS/NetBIOS packets? Do I ignore this as it's probably a pretty rare occurrence? We'll see I guess...
I can't help but wonder if the NetBIOS name requests being sent to each interface is a protocol spec, or if it's just the way Microsoft decided to implement the function? Perhaps neither I suppose. Either way, it's great to finally know what on earth was causing the slowdown. :)
Posted by Casey at December 7, 2005 06:23 PM