Weird DNS Stuff on Windows

Hi there. I work with networking for my job. That means I do all kinds of wacky stuff with IP addresses, but if you say "IP address", I'm going to ask "v4 or v6"? Comes with the territory, I'm afraid.

I did some debugging of some configurations the other day that resulted in some surprising results, so I thought I might share a couple of wacky DNS tricks I learned about.

One: what the heck is fec0:0:0:ffff::1??

We had a strange situation the other day where our system was explicitly configured with no DNS servers... and yet, name resolution was taking place, same as it ever was. This gave us some head scratching. It wasn't being handled by the hosts file, either. We took some Netmon captures and noticed something interesting: our machine was making DNS queries to the IPv6 address fec0:0:0:ffff::1.

But what is this thing? Well, fec0 is not actually programmer humor for "fecal." It indicates a "site-local" prefix. As for the rest of it, I had no idea how it came to be configured or known by the system. I thought it was some Microsoft-specific name resolution logic at first, some hard-coded values baked into the resolver.

Well, it kind of is, but even better, it's part of an IETF draft recommendation--an old one, I might add--called IPv6 Stateless DNS Discovery.

A set of three well-known site-local IPv6 addresses are reserved for autodiscovery of DNS servers. These addresses may be used as unicast addresses, assigned to different servers, or as anycast addresses with one of them being assigned to all DNS servers in the site, or any combination of anycast and unicast addresses. In any case, host routes are propagated in the site's routing tables. This document proposes that these three addresses be fec0:0:0:ffff::1, fec0:0:0:ffff::2, and fec0:0:0:ffff::3. This list of three addresses may be hardcoded into a host.

So there you have it. Apparently Microsoft is one of the authors of the draft--big shocker--but at least it's a draft out there. A bunch of our campus is now fully IPv6 enabled now, with direct Internet reachability and stuff, which is fantastic. Every machine in our building, for instance, has a global IPv6 address. It's pretty neat. The future is coming!

Two: what is this ..localmachine thing????

This one deals with Winsock programming. Let's say you want to get a list of the IP addresses on a machine that you could listen on. Firstly, you don't typically need to do this at all. Instead, I'd recommend simply binding to the machine's default IPv4 address (usually passed in as 0.0.0.0) or IPv6 address, ::. But leaving that aside, say you do want to listen explicitly on each individual address.

The typical method will probably be to call GetAddrInfoW with your own hostname, which will enumerate all your addresses. What if you don't want to do that? Maybe you're an embedded computer with a limited stack and no hostname. Well, on Windows, there's actually a neat trick.

If you pass in the special string, "..localmachine" into basically any function that hits the name resolver, it will get you all the addresses associated with the current machine. It's a pretty neat trick, I have to say, though perhaps a bit niche in its use. All of this is documented on the MSDN page, by the way; I just happened to stumble on it recently.