Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a 3 computer network connected through a Linksys/Cisco E3000 Router in a small office. One is running Windows 2008 R2 Foundation and the other 2 are running windows 7.

When I ping the R2 from the windows 7 machine using the name (eg. ping server), the ping waits for 6 seconds, and then starts printing the round trip times (no problems with the round trip time). The printed time is 1ms, and once ping starts printing, it goes fine.

When I ping using the ip of the server though, the ping starts printing out immediately, and there is no start up delay.

I did not remember to check the arp tables on the 7 machine, but this seems strange. The router is handling the DNS.

I can access shared folder on the server and is pretty snappy. However, we have an application (that is uses machine names to work) and has become incredibly slow. I suspect that if I figure out what is happening with the ping start up times, I can maybe figure out why the application is running slow.

I'd appreciate any thoughts on this strange ping behavior.

share|improve this question
Is your network an Active Directory domain or a workgroup? – Chris McKeown Mar 27 '12 at 13:48
Network is Active Directory domain. I would like to demote the AD because it is not really needed and would prefer the workgroup option (I am not a MS person). If you think there are a few things I need to look at, I am all ears. Thanks for the reply. – Trewq Mar 27 '12 at 13:55
up vote 0 down vote accepted

If the server is configured as an Active Directory domain controller, it should also be running a DNS service for the internal clients.

Your client machines should be using the address of the domain controller as their DNS server (the server should be pointing at itself for DNS). You'll then need to configure the DNS service on your domain controller to forward anything it can't resolve to your router.

If you want to switch it to a workgroup then you should be able to use Network Discovery for local name resolution, but personally I'd keep the domain.

share|improve this answer
ChrisMcK: I'd like to move to the workgroup and get rid of the AD. I assume the network discovery would be done by the client. In essence, I'd like to move from AD to workgroup and get rid of all these headaches. I got a scary warning that all accounts will get deleted (I hope the administrator account remains (??) and do not care about other accounts). I'll be back there and will report back on what I find. Ideally, I'd like to use a network tap and wireshark to find out what is going on with the slowness. Thank you. – Trewq Mar 27 '12 at 14:44
The slowness is due to your DNS resolution timing out. Your internal client machines should be set to use the DNS service on the DC. They're trying to resolve the machine names by querying your local router - but your local router will have no knowledge of your internal machine names. The initial DNS query times out, so the machines fall back to using Network Discovery/NetBIOS broadcast. This is the source of the initial delay when pinging. Don't thow your AD domain away just because of that! – Chris McKeown Mar 27 '12 at 14:49
ChrisMcK - excellent deduction! I agree with you, and will check this out. I am curious as to why the router is not replying back, because the router does have the name "server" (yes, that is the name of the R2 :) ) in its DNS cache.. – Trewq Mar 27 '12 at 15:24

The ping startup times that you describe are probably not related to the application performance problem.

When you ping the server by name, and when no DNS or ARP cache data for the server is present, the client needs to perform both DNS resolution and ARP resolution for the server. This is likely the cause of the delay in getting the first ICMP Echo Reply from the server.

To confirm this, clear the DNS and ARP cache on the client and ping the server by name. Once the ping completes run it again and see if the response time exhibits no delay in the first ICMP Echo Reply.

share|improve this answer
I'll try this out and get back to you. I thought that the first time the ping goes through, the arp cache would get updated, and subsequent tries will not have a problem - no? Thanks for the reply! – Trewq Mar 27 '12 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.