Technical Deep Dive: hosts vs lmhosts Files – Key Differences in Windows Network Resolution


11 views

While both hosts and lmhosts files serve as local name resolution mechanisms in Windows, they operate at different network layers and serve distinct protocols:

# Example hosts file entry
127.0.0.1       localhost
192.168.1.10    server.company.com

# Example lmhosts file entry
192.168.1.15    APPSERVER    #PRE #DOM:WORKGROUP

The hosts file handles standard DNS resolution (TCP/IP), while lmhosts specifically deals with NetBIOS name resolution (NetBT). This distinction becomes crucial in mixed network environments.

Both files typically reside in %SystemRoot%\System32\drivers\etc\, but their formats differ significantly:

# hosts uses simple IP-to-hostname mapping
192.168.1.100   fileshare.dev

# lmhosts supports special tags like #PRE and #DOM
192.168.1.200   DC1    #PRE #DOM:MYDOMAIN #PDC

Modern developers might use hosts for:

  • Local development environment setup
  • Blocking malicious sites
  • Testing DNS changes

lmhosts remains relevant for:

  • Legacy NetBIOS applications
  • Windows domain environments without WINS
  • Cross-subnet name resolution

Here's how you might programmatically modify these files in PowerShell:

# Add entry to hosts file
Add-Content -Path "$env:windir\System32\drivers\etc\hosts" -Value "192.168.1.50tapi.staging"

# Add entry to lmhosts file
Add-Content -Path "$env:windir\System32\drivers\etc\lmhosts" -Value "192.168.1.60tLEGACYSRVt#PRE"

When troubleshooting, remember:

nbtstat -c  # Shows NetBIOS name cache
ipconfig /displaydns  # Shows DNS resolver cache

The hosts file bypasses DNS completely, while lmhosts supplements NetBIOS name resolution when WINS isn't available.


Both hosts and lmhosts files serve as local name resolution mechanisms, but they operate at different network layers and protocols:

# Typical hosts entry (IPv4)
127.0.0.1       localhost
192.168.1.10    server1.mydomain.com

# Typical lmhosts entry
192.168.1.15    FILESERVER    #PRE #DOM:mydomain

The hosts file (located in %SystemRoot%\System32\drivers\etc\hosts) performs DNS-style name resolution for TCP/IP applications. The lmhosts file (same directory) specifically handles NetBIOS name resolution for legacy Windows networking components.

Modern development environments primarily use the hosts file for:

  • Local development domain mapping
  • Testing DNS changes before propagation
  • Blocking specific domains

The lmhosts file remains relevant for:

  • Legacy application support
  • Windows domain environments with older systems
  • Special NetBIOS name resolution cases

Example of dynamic hosts file manipulation in PowerShell:

# Add entry to hosts file
Add-Content -Path "$env:windir\System32\drivers\etc\hosts" -Value "192.168.1.100tapi.staging.local"

# Query lmhosts entries
Get-Content "$env:windir\System32\drivers\etc\lmhosts" | Where-Object { $_ -match "#PRE" }

The hosts file is checked first in the name resolution order (before DNS), while lmhosts is consulted after WINS server queries fail. Both files are cached in memory after first use during a session.

For contemporary development needs, consider:

# Docker container name resolution
# In docker-compose.yml
services:
  app:
    extra_hosts:
      - "test.local:192.168.1.50"