How does netstat get a hostname from IP while nslookup & nblookup fail every time?

Question

In Windows Server 2003, when I run netstat with no flags, it takes much longer than netstat -n to return results. I realize this is because it has to perform reverse lookups by IP address to get the corresponding hostname.

There are some rows in the results that netstat seems to hiccup on and take longer than usual. As far as I can tell, these are all addresses where there is no IP to hostname mapping in our local DNS servers. No big deal. nslookup and nblookup both fail to find hostnames for the IPs in question as well, agreeing that this would be part of the slowness related to these records.

However, in the netstat results, these records show the correct hostname. How is that possible? How is netstat able to discern the hostname for the connections with no reverse DNS or reverse WINS (is there such a thing) entries?

I have tried flushing the local DNS cache and still get the same results. Edit: There are forward DNS entries for the hostnames in question. Is it possible the underlying connection is somehow able to "hold on" to the original name used to create the connections?

Solution

Apparently nblookup does not work with reverse IP -> hostname lookups. I started capturing packets with MS Network Monitor to see how netstat was resolving the name and learned something new. Apparently it will revert to NetBIOS lookups if DNS fails.

Another important thing to note, I ran into trouble when troubleshooting this because my local machine is Windows 7. Another method Windows 7 uses is called LLMNR. So, if DNS fails it will try to perform a LLMNR lookup. LLMNR isn't available in Windows Server 2003.

Resolution order:

1. DNS
   a. Resolver Cache (Hosts File + Cached DNS Queries) (ipconfig /displaydns)
   b. DNS Server Query (ipconfig /all to see DNS Servers that will be queried, nslookup to attempt queries)
   
2. LLMNR (Windows Vista/7/8, Server 2008)
   a. LLMNR Cache
   b. LLMNR Multicast Query
   
3. NetBIOS (Order and methods depend on NetBIOS Node Type -- find type by: ipconfig /all | findstr "Node Type"
   a. WINS Servers (h node, m node, p node)
   b. LMHosts File
   c. Broadcast (h node, m node, b node)
   
   

Here is a fantastic youtube video on the different resolution techniques: https://www.youtube.com/watch?v=gzqjeds8gDg and there is a great MSDN TechNet Article on name resolution, search for "Link-Local Multicast Name Resolution: The Cable Guy".