How Windows Knows It Has An Internet Connection Super User Blog

Windows 7 Network Awareness: How Windows knows it has an internet connection Super Us... http://blog.superuser.
com/2011/05/16/windows-7-network-awareness/
or
1 of 24 10/31/2015 1:57 PM
Windows 7 Network Awareness: How Windows knows it has an internet connection Super Us... http://blog.superuser.com/2011/05/16/windows-7-network-awareness/
Windows 7 Network Awareness: How Windows knows it has This is a community blog for
Super User. More community
an internet connection blogs are available at Blog
Overflow.
May 16, 2011 by nhinkle. 89 comments
Have you ever been connecting to a new wireless network and seen the following pop-up balloon? Subscribe via RSS
Search
Recent Posts
Geek on Sound (or.. does anyone
really need a sound card these
days?)
Whenever I connect to a WiFi network which requires in-browser What to Do After Buying a New
Laptop
authentication, such as university networks and hotel access
points, Windows somehow magically knows. Windows also Best of both worlds round 3:
mSATA SSDs
knows when your internet connection isnt working, and can
differentiate between having local LAN access, no network Windows 8 on a VHD Trying
access at all, or full internet access. But how? windows without the risk
What laptop should I buy for
This weeks question of the week is one I myself asked about college? (2013 edition)
this very topic. I guessed that there must be some online
Recent Comments
Microsoft site that Windows is checking to determine the state of
the connection, but I wanted proof, not just speculation. on FFmpeg: The ultimate Devyani
Video and Audio Manipulation Tool
How does Windows know whether it has internet access or if a Wi-Fi connection requires on What to Do After Buying a kimo
in-browser authentication? New Laptop
on FFmpeg: The ultimate Milind K.
Tobias Plutat and Jeff Atwood both replied with information about the Network Connectivity Status Indicator
Video and Audio Manipulation Tool
(NCSI) service, first introduced in Windows Vista.
on FFmpeg: The ultimate Video Raf
and Audio Manipulation Tool
When called on by Network Awareness, NCSI can add information about the following capabilities for a given on What laptop should I buy for Tien
network: college? (2013 edition)
Connectivity to an intranet Archives

Connectivity to the Internet (possibly including the ability to send a DNS query and obtain the July 2014
correct resolution of a DNS name) October 2013
August 2013
NCSI is designed to be responsive to network conditions, so it examines the connectivity of a network in a
variety of ways. For example, NCSI tests connectivity by trying to connect to http://www.msftncsi.com, a June 2013
simple Web site that exists only to support the functionality of NCSI. May 2013
March 2013
November 2012
How does it work?
October 2012
2 of 24 10/31/2015 1:57 PM
Windows does indeed check a Microsoft site for connectivity, using the Network Connectivity Status Indicator site. September 2012
Stack Exchange
There are a fewvariations
2015 Entries (RSS)
of the and Comments
connection checking(RSS). CC-Wiki
process: August 2012
July 2012
1. NCSI performs a DNS lookup on www.msftncsi.com, then requests http://www.msftncsi.com/ncsi.txt. This file is
a plain-text file and contains only the text Microsoft NCSI. June 2012
March 2012
2. NCSI sends a DNS lookup request for dns.msftncsi.com. This DNS address should resolve to
131.107.255.255. If the address does not match, then it is assumed that the internet connection is not February 2012
functioning correctly. January 2012
December 2011
The exact sequence of when which test is run is not documented; however, a little bit of digging around with a
November 2011
packet sniffing tool like Wireshark reveals some info. It appears that on any connection, the first thing NCSI does is
requests the text file (step 1 above). NCSI expects a 200 OK response header with the proper text returned. If the October 2011
response is never received, or if there is a redirect, then a DNS request for dns.msftncsi.com is made. If DNS September 2011
resolves properly but the page is inaccessible, then it is assumed that there is a working internet connection, but an August 2011
in-browser authentication page is blocking access to the file. This results in the pop-up balloon above. If DNS July 2011
resolution fails or returns the wrong address, then it is assumed that the internet connection is completely
June 2011
unsuccessful, and the no internet access error is shown.
May 2011
The order of events appears to be slightly different depending on whether the wireless network is saved, has been April 2011
connected to before even if it is not in the saved connections list, and possibly depending on the encryption type.
March 2011
The DNS and HTTP requests and responses showing up in Wireshark were not always consistent, even
February 2011
connecting to the same network, so its not entirely clear what causes different methods of detection under different
scenarios. January 2011
Categories
What about my privacy?
Ask Different
Some people may be concerned about Windows phoning home to Microsoft with their PCs information through Backup & Restore
this service. According to Microsofts documentation, NCSI retains the time of access and IP addresses of requests
Battle of the Giants
made to www.msftncsi.com:
Browsers
Charity
IIS logs are stored on the server at www.msftncsi.com. These logs contain the time of each access and the IP
College
address recorded for that access. These IP addresses are not used to identify users, and in many cases, they
are the address of a network address translation (NAT) computer or proxy server, not a specific client behind Compression
that NAT computer or proxy server. Computing
Encryption
It is possible to disable NCSI by a registry setting if you dont want Microsoft to be able to check your internet Featured
connection. Filesystems
Hard Drives
Hardware
1. HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNlaSvcParametersInternet History
2. Under the Internet key, double-click EnableActiveProbing, and then in Value data, type: 0.The HTPC
default for this value is 1. Setting the value to 0 prevents NCSI from connecting to a site on the Interviews
Internet during checks for connectivity.
Memory
Networking
News
3 of 24 10/31/2015 1:57 PM
When I changed this registry setting, Wireshark picked up no more communication to the NCSI site. As a result, Operating Systems
there was no indicator that in-browser authentication was required, and the connection indicator would say internet Organizing
connection even if there was in fact none present. Podcasts
In the same registry key were a series of other Productive Thursday

parameters. The expected DNS response, the Question of the Week
host to query for a DNS address, the expected Reviews
content of the text file, the name of the text file,
Security
and the domain with the text file were all
Software
included. The other parameters are not quite as
self explanatory. I tried adapting Solid State Drives
PassivePollPeriod, expecting it to change how Super User
frequently NCSI would poll the server. It Ubuntu
appeared at first that the decimal value was
Uncategorized
equal to that many tenths of a minute, so a value
Utilities
of 5 polls every 30 seconds and a value of 10
polls every minute. However, the frequency also Virtualization
seemed to decrease with time. I could not figure Windows
out the use of the other two values. Windows 8 Challenge
WTFriday
Meta
Register
Log in
Entries RSS
Comments RSS
WordPress.org
Latest Articles
Geek on Sound (or.. does anyone
really need a sound card these
Can I run my own NCSI server? days?)
For those concerned about privacy, is it possible to run your own server to respond to these requests? Lets find What to Do After Buying a New
out! Laptop
Best of both worlds round 3:
I created ncsi.nathanhinkle.com on my web hosting, and set it up to send /ncsi.txt as a plain text file with the mSATA SSDs
content nhinkle NCSI. I then changed all of the registry values to point to the values for my server, and what do you
Windows 8 on a VHD Trying
know, it worked! Looking in Wireshark, requests were being made to my server instead of to Microsofts server, and
windows without the risk
the system was still determining the status of the internet connection correctly. The user agent on the requests was
What laptop should I buy for
still Microsoft NCSI, indicating that it was indeed the same service making the requests.
college? (2013 edition)
view all posts
Topics
Ask Different (12)
Backup & Restore (1)
4 of 24 10/31/2015 1:57 PM
Battle of the Giants (3)
Browsers (8)
Charity (1)
College (5)
Compression (3)
So, if you want your computer to be able to check its connectivity to the internet while not sending your every move
to Microsoft, this is a way to do it. As an added benefit, this could be used as a tracking mechanism to see where Computing (14)
your computer goes, particularly should it get lost or stolen, since any connection attempt will result in your server Encryption (4)
being requested. Featured (14)
Filesystems (7)
As operating systems become increasingly complex, features like this can make your life much easier, but its
always good to know whats happening behind the scenes. Hard Drives (1)
Hardware (18)
Filed under Question of the Week Windows
History (1)
HTPC (2)
Tagged: connection , internet , ncsi , Windows
Interviews (7)
Memory (1)
Migrating to Linux from Windows | Getting the Most Out Of Mac OS Xs Expos
Networking (10)
89 Comments News (3)

Operating Systems (14)
Subscribe to comments with RSS.
Organizing (2)
Podcasts (12)
says: Productive Thursday (7)
May 16, 2011 at 8:17 am
Question of the Week (33)
Great post! I always wondered how they did this! Awesome that you tried setting up your own server. Reviews (12)
Security (1)
And as the CAPTCHA says: Quality ofechana!
Software (29)
P.S. Whats that small green timer in your taskbar that says 3:21 at the top screen shot? Solid State Drives (9)
Reply to this Comment Super User (6)

Ubuntu (5)
Uncategorized (6)
nhinkle says: Utilities (6)
May 16, 2011 at 5:03 pm
Virtualization (3)
Bloodphilia, thats BatteryBar. It was actually suggested to me in a Super User question! http://superuser.com Windows (16)
/q/127089/20088 Windows 8 Challenge (1)
Reply to this Comment WTFriday (10)
Chris Thompson says:

May 16, 2011 at 11:42 pm Latest Comments
I came for an interesting article and I was shocked to see my BatteryBar application in your screenshot! As the Devyani: Hi, I need to know what
options should I use to convert the .webm
5 of 24 10/31/2015 1:57 PM
author I love running into people running my app. to .mp4 without losing on the quality.
kimo: please, how can install mac os in
Reply to this Comment
windows pc ?
Milind K.: Excellent guide. I do have
some problems though, every time I try to
Ian says: either reelcode or copy a .mp4...
May 16, 2011 at 11:54 pm
Raf: Its possible that original MKV uses
This must be how the Zune detects internet access as well. Its the most annoying thing because a Zune wont an audio codec incompatible with MP4
allow you to connect to a network that doesnt have network access and therefore I cant connect to my container.
universitys network since I have to authenticate before the Zune can detect internet. Tien: LOL This review was too cute and
so helpful! I literally laughed out loud! as I
was reading the section you...
Jason says:
May 17, 2011 at 12:24 am
If the service was ddosd, would millions of windows users get a pop-up stating limited connectivity or
connected but further log in details required? Sound like a prank 4chan might play
Sigjuice says:
May 17, 2011 at 1:10 am
How does it work? should say http://www.msftncsi.com/ncsi.txt and not http://msftncsi.com/ncsi.txt
kronos says:
May 17, 2011 at 6:49 am
Fixed thanks.
Mike says:
May 17, 2011 at 11:21 am
Is the most recent result stored somewhere (so I could look somewhere in memory for it instead of having to
run another DNS lookup/HTTP request myself?)
ASP.Net Halifax says:

May 17, 2011 at 11:42 am
6 of 24 10/31/2015 1:57 PM
Some excellent investigative work to reveal how this works, very interesting read!
S says:
May 17, 2011 at 12:53 pm
Very interesting read, especially the bit about using this as a tracking mechanism application.
Small error: should say tenths of a minute not tenths of a second
RENi says:
May 17, 2011 at 1:32 pm
Maybe this is worth adding, the ncsi.txt file hosted on msftncsi.com seems to have no end of line.
$ file ncsi.txt ncsi.txt: ASCII text, with no line terminators
If you want to host your own, make sure it doesnt have an eol either or else the ballon Additional log on
information may be required will popup.
Ted Sbardella says:

May 17, 2011 at 2:49 pm
Very interesting thanks so much!
nhinkle says:
May 17, 2011 at 2:56 pm
Thanks S for pointing out that error, I have fixed it in the article.
Dinos says:
May 17, 2011 at 8:22 pm
Minor correction, NCSI performs a DNS lookup on http://www.msftncsi.com/ncsi.txt, then requests
DNS lookup is performed on the name not on the URI. Proper sentence will be NCSI performs a DNS lookup
on http://www.msftncsi.com then requests
7 of 24 10/31/2015 1:57 PM
Almost the same method is performed by Apple on iphone/ipod etc devices.
socceroos says:
May 18, 2011 at 12:32 am
Well, seems that its not quite telling the truth. If it can do a DNS lookup then it has internet access.
Tunneling traffic through DNS queries is a sinch these days with all the ready-made tools.
dinos_correction says:
May 18, 2011 at 12:36 am
if youre being picky lookup does not use schema either NCSI performs a DNS lookup on
http://www.msftncsi.com then requests
DrunkMunki says:
May 18, 2011 at 12:37 am
for those lazy people, you can find the registry import file below; http://www.drunkmunki.com/NCSI_Probing.reg
just edit it to what you want then import it to every pc you need.
Jason says:
May 18, 2011 at 12:41 am
Proper sentence will be NCSI performs a DNS lookup on http://www.msftncsi.com then requests
Actually, its NCSI performs a DNS lookup on http://www.msftncsi.com then requests
8 of 24 10/31/2015 1:57 PM
chefybuck says:
May 18, 2011 at 1:02 am
Can disabling the NCSI lookup be used a work-around for the infamous unknown network in Vista and
sometimes Win7?
Ansuz says:
May 18, 2011 at 1:05 am
brilliant write up. A good idea for higher education & corporate admins to implement via Domain Policy. Im
sure it will assist in reducing the number of calls for technical support
Windows 7 Network Awareness | digital explorations says:

May 18, 2011 at 1:47 am
[] I was looking around on Slashdot tonight and found the article Windows 7 Network
Awareness: How Windows knows it has an internet connection. []
g0dkar says:
May 18, 2011 at 1:49 am
You just got into Slashdot. Watch out!! great article, btw (Yes, I RTFA, heh)
RO says:
May 18, 2011 at 1:53 am
Interesting displayed by lynx text-mode browser (from Linux PC):
Linkname: Entry into main screen URL: http://www.msftncsi.com/ncsi.txt Charset: iso-8859-1 Server: Microsoft-
IIS/7.0 Date: Wed, 18 May 2011 01:46:07 GMT Last Mod: Tue, 13 Jan 2009 00:37:56 GMT Cache-Control:
max-age=30,must-revalidate Content-Length: 14 bytes Owner(s): None size: 0 lines mode: normal
No Links on the current page
The text would indeed seem to have no terminating CR/NL since 14 bytes is the length of the text string exactly.
FWIW
9 of 24 10/31/2015 1:57 PM
Harry Johnston says:

May 18, 2011 at 2:09 am
In a corporate setting, this can be configured with Group Policy. See Network Connectivity Status Indicator in
Network in the Computer Configuration node.
samwyse says:
May 18, 2011 at 2:12 am
As an added benefit, this could be used as a tracking mechanism to see where your computer goes,
particularly should it get lost or stolen, since any connection attempt will result in your server being requested.
Personally, Id want to track several computers with one server. Looks like I just need to set up my server to
return the same file for many different requests, then imbed my host name in the request. For example, I could
set ActiveWebProbePath to nsci-NAME.txt or set ActiveWebProbeHost to NAME.nsci.example.com where
my DNS is configed to resolve *.nsci.example.com to the same IP address.
Vicks says:
May 18, 2011 at 2:12 am
What about NCSI for ipv6? How does that work?
WhizzMan says:
May 18, 2011 at 2:29 am
DNS lookups dont lookup http:// or /nsci-something.txt They only look up the hostname part
Magnus says:
May 18, 2011 at 2:38 am
Nice work, enjoyed the article.
Ron says:
10 of 24 10/31/2015 1:57 PM
May 18, 2011 at 2:47 am
If it can do a DNS lookup then it has internet access.
Unless theres a DNS server on the LAN which has access to the world even though you might be blocked.
Windows 7 and Windows Vista: Network Awareness Rob Sanders:

Sanders Technology says:
May 18, 2011 at 2:53 am
[] interesting article which documents how Windows Vista and later versions of Microsoft
Windows uses network location awareness to determine aspects of your computers
networking []
Jarmund says:
May 18, 2011 at 3:09 am
Another alternative for lazy people:
http://www.jarmund.net/stuff/JarmundNCSI.reg
..my server, using it myself.
By the way, ive been told this probably works for Windows Vista as well can someone confirm this?
WizADSL says:
May 18, 2011 at 5:48 am
I found this info from MS about how NCSI works http://technet.microsoft.com/en-us/library

/ee126135%28WS.10%29.aspx ; you may want to take a look
nhinkle says:
May 18, 2011 at 6:29 am
Thanks for the info, WizADSL. That looks to be an identical duplicate of the information in the article I linked to,
just updated with Windows 7 in the title instead of Windows Vista, but good to know!
11 of 24 10/31/2015 1:57 PM
Arno Nym says:

May 18, 2011 at 7:10 am
NCSI performs a DNS lookup on http://www.msftncsi.com/ncsi.txt, then requests http://www.msftncsi.com

/ncsi.txt. is bullshit.
NSCI performs a DNS lookup on http://www.msftncsi.com, then requests is correct.
killasmurf86 says:
May 18, 2011 at 9:29 am
@Jarmund << yes works on Vista as well
Marijn says:
May 18, 2011 at 9:42 am
Great article! I always assumed it had to make some call to check internet connectivity, now its good to know
exactly how it works and even better so how to change the behaviour.
One thing that might be noteworthy is that Microsoft isnt the only one who can track your internet connectivity.
The DNS servers you use, so probably your ISP, can track you just as easily. All they have to do is log any
lookups of www.msftncsi.com and dns.msftncsi.com.
Criao de Sites says:

May 18, 2011 at 12:12 pm
Thanks for letting us know how to disable this NCSI thing.
samwyse says:
May 18, 2011 at 12:24 pm
OK, anyone can now use samwyse.appspot.com as an NCSI server. http://samwyse.appspot.com/ncsi-

example.txt will return a file consisting of example NCSI (no newline!), while http://samwyse.appspot.com
/ncsi-example.reg will return a Windows registry file to use this for the Active Web Probe; the Active DNS Probe
is currently unchanged. Note that you can replace the word example with any text that you wish. Note that all
access is logged via App Engines server log, so Google and I will know what youre doing. Ill try later to add an
internal log to allow users to view just accesses to their strings.
12 of 24 10/31/2015 1:57 PM
sirmuzz says:
May 18, 2011 at 2:45 pm
LOL arguing about the DNS lookup. You both have it wrong.
DNS lookup is performed on the name not on the URI. Proper sentence will be NCSI performs a DNS
lookup on http://www.msftncsi.com then requests
Well your closer but still not there.
It is DNS lookup is performed on the name not on the URI. Proper sentence will be NCSI performs a DNS
lookup on http://www.msftncsi.com then requests
DNS = Networking 101.
sirmuzz says:
May 18, 2011 at 2:46 pm
Ok so you were rightdamn website auto adds http:// bad webmaster bad!
Windows 7 Phones Home Every Time You Change Networks |

Discourse.net says:
May 18, 2011 at 2:50 pm
[] good news is that, not only can you disable the service, you can even tell it to check your
own server instead. If you have a []
DigiP says:
May 18, 2011 at 3:25 pm
Funny, because I had wrote about this in 2009 when troubleshooting connection issues in Windows 7 after a
new install. Ive disabled this service because of the whole connectivity issue, if 7 cant see that site because its
down or for whatever reason, it causes all sorts of issues trying to get online, even when you manually set an IP
configuration for the NIC.
See http://www.twistedpairrecords.com/blog/2009/11/07/windows-7-connectivity-issues/ for rant. You can also

change priority for IPv4 over IPv6, since IPv6 connections wil be tried first over IPv4, if your router only does
IPv4, its just one less step your machine has to perform to check for first.
13 of 24 10/31/2015 1:57 PM
Doug M. says:
May 18, 2011 at 4:23 pm
all your network connection belong to us.
kronos says:
May 18, 2011 at 4:29 pm
dont you mean are belong to us?
Kurt Shubert says:

May 18, 2011 at 7:45 pm
Very interesting article. Thanks for the enlightenment on this.
This is one of those things I have wanted to know for some time but have never cared enough about to do the
research. Thanks for having taken the time to do it for me!
Jason O. says:
May 18, 2011 at 7:46 pm
We had a different problem. It was the winhttp machine proxy settings. Info here.
http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/e3e7a1e4-d410-4668-8c33-
a57175c44e48
doofus says:
May 18, 2011 at 9:18 pm
No need to insert the verb are.
It already does belong.
doofus says:
14 of 24 10/31/2015 1:57 PM
May 18, 2011 at 9:19 pm
It should be belongs anyway.
Windows 7 Network Awareness - Tech Support Forums - TechIMO.com

says:
May 19, 2011 at 1:27 am
[] 7 Network Awareness Windows 7 Network Awareness: How Windows knows it has an

internet connection Super User Blog If you have Windows 7 Home you can manually add
the registry key to keep it from polling []
Michele says:
May 19, 2011 at 5:46 am
It should be belongs anyway.
I believe Doug M. was parodying the famous 1991 Sega video game message All your base are belong to us
(as translated direct from Japanese).
iam8up says:
May 19, 2011 at 10:43 pm
GREAT article. I was curious myself for some time.
Sysadmin Sunday #31 Boxed Ice Blog says:

May 22, 2011 at 4:03 pm
[] Windows 7 Network Awareness: How Windows knows it has an internet connection []
loco says:
June 1, 2011 at 4:07 pm
can this be set to an intranet adress of the router and internal dns?
15 of 24 10/31/2015 1:57 PM
ActiveDnsProbeContent 192.168.1.123 ActiveDnsProbeHost dns.localdomain.local ActiveWebProbeHost
192.168.1.1
Internet Marketing says:

June 28, 2011 at 10:13 am
No. You are not XKCD and you are not even half as funny as you think you are ksplice.
robsku says:
July 10, 2011 at 1:46 pm
Hi, thanks, bumped here from slashdot article comments, found this interesting enough to bookmark in
microsoft software bookmark folder for any later possible needs even though I myself never run Windows on
my own machines as real OS but I might someday run one or more of versions of Win for software testing
and I dont want it to phone home
How Windows knows if your network requires you to visit a web page |
The Silicon Underground says:
July 12, 2011 at 1:47 am
[] This is a nice writeup on how Windows Vista and Windows 7 know whether you have an
active Internet connection and whether you need to visit a page in your web browser to
activate it. It also talks about the privacy implications, and how to set up the service to use
your server, rather than Microsofts. []
Gary says:
July 18, 2011 at 3:39 am
Hi nhinkle,
Great post. I have a question for you. Some users in my office uses windows 7 and whenever they login to the
domain, they get Access Denied (policy denied) error from time to time when they try to access the internet.
The network team from global office says disabling ncsi from the registry will fix the problem but it didnt and
after months the problem is still there and they couldnt come back with a different solution. We are using blue
coat.
16 of 24 10/31/2015 1:57 PM
What do Microsoft and NCIS have in common? | TechRepublic says:

July 25, 2011 at 1:06 pm
[] found out how NCSI works by reading this Super User Community blog. Network
Awareness checks the following at the beginning of each network connection: NCSI []
What do Microsoft and NCSI have in common? | Microsoft Security

Essentials says:
July 25, 2011 at 3:57 pm
[] found out how NCSI works by reading this Super User Community blog. Network
Awareness checks the following at the beginning of each network []
Lurka says:
August 4, 2011 at 10:09 am
Interesting info, thank you. Strange enough, I had set EnableActiveProbing to 0 months ago, but sometimes I
still found event viewer warning Name resolution for the name dns.msftncsi.com timed out after none of the
configured DNS servers responded. Possibly because my PC is registered to a domain? Now I turned it off
through internet communication settings policy and will see what happens.
How do I fix No Internet Access message in Network And Sharing

Center on Windows 7 when connected through corporate proxy? -
Admins Goodies says:
August 13, 2011 at 11:11 pm
[] Seems theres been a full expos on the topic over at SuperUser. []
Super Users 2nd Birthday Super Contest - Super User Blog says:
August 19, 2011 at 7:36 am
[] Windows 7 Network Awareness: How Windows knows it has an internet connection []
17 of 24 10/31/2015 1:57 PM
The Microsoft way of performing Network and Internet connection

Awareness in C# | Mr Pfisters Random Waffle says:
September 6, 2011 at 4:50 am
[] to a SuperUser Blog post the checks are performed as the []
Thoughts on my editing and content ? - Learn how to make money on

the Internet! - Internet Money Making Ideas says:
October 7, 2011 at 8:05 pm
[] The First To Answer This QuestionGot a better answer? Share it below! RelativePixels
Asked: Thoughts on my editing and content ?'ve made a video but there's somou think of
the editing and/or content? Would you watch more?Any help would be appreciated []
neo says:
October 11, 2011 at 12:16 pm
Very nice windows 7 artcle. I like it so much.Please keep update your artcle about windows 7. thanks for
sharing.
NCSI (pt. I) Talant's def4ult Space says:

October 12, 2011 at 12:37 pm
[] led me to this article explaining that it was part of the mechanism that Windows Vista,
Windows 7 and Windows Server 2008 []
Could I share an internet connection with two computers if only one has
a modem installed? says:
October 12, 2011 at 12:40 pm
[] in LAN to the first computer. Check out our user posted comments/solutions, or post your
own! Mr. Cloud asks, I want to connect a computer via a LAN cable to my current computer
which has a broaheck out our user posted comments/solutions, or post your own!
18 of 24 10/31/2015 1:57 PM
WordPress []
vtdone says:
October 12, 2011 at 11:22 pm
Great tracing work. I just hope that MS doesnt release a Windows Update that overwrites this new registry set
up.
DougE says:
November 20, 2011 at 4:52 pm
There must be something more to it. I took a Win 7 Pro PC and removed the default gateway. I then added
these routes to use the router gateway. 64.4.18.0 mask 255.255.255.0 192.168.1.1 131.107.255.0 mask
255.255.255.0 192.168.1.1 I can ping the url http://www.msftncsi.com and dns.msftncsi.com and the ip resolves
but I still get the icon no internet access. If I add a defualt gateway of 192.168.1.1 it shows interent access. Is
there more to it then this?
Use What You Have At Your Disposal | Information Technology says:

November 24, 2011 at 7:16 pm
[] #split {}#single {}#splitalign {}#singlealign {}#splittitlebox {text-align: ;}#singletitlebox {text-

align: ;}.linkboxtext {}.linkboxcontainer {}.linkboxdisplay {}.linkboxdisplay td {text-align:
;}.linkboxdisplay a:link {text-decoration: none;}.linkboxdisplay a:hover {text-decoration:
none;}Mobile Video Streaming in Business World is Thriving?Windows 7 Network
Awareness: How Windows knows it has an internet connection Super User Blog []
Blu-ray Players and The Internet | Blu-Ray Players Reviewed says:

December 2, 2011 at 5:30 am
[] Qnap TS 212 US 2 Bay USB Server lowes black friday dealsWindows 7 Network
Awareness: How Windows knows it has an internet connection Super User Blog function
quick_contact_send() { //Send Message Ajax Call //Deactivate submit button var []
19 of 24 10/31/2015 1:57 PM
Wireless WEP Key Password Spy 1.0 | Daily Freeware Download says:
[] SpyDownload link Wireless WEP Key Password Spy 1.1.0Phenotropil SoftwareSoftware

For Your PCWindows 7 Network Awareness: How Windows knows it has an internet
connection Super User Blog /* []
tommis says:
February 1, 2012 at 3:36 am
Nice article! I have Win7 firewall restricted with outbound rules. Obviously NCSI is now blocked because I get
not connected icons for internet and lan server but both are connected. So it is just the connection test that is
blocked, but I cant figure out what rule I need to allow NCSI to do the testing. NCSI is a service I understand
but which program is running and needs to be allowed access? Anyone any info?? Thanks
zhou says:
I use wireshark,but i cannt catch any packages why
Tom Wijsman says:

February 22, 2012 at 8:10 pm
Try asking on Super User if you cant get it working. Please first try to run Wireshark as an administrator,
follow a tutorial/guide on how to capture packets as you might get it working on a second try
nap company says:

July 6, 2012 at 7:39 am
Love Microsoft ^^
Tushar Agarwal says:

August 3, 2012 at 2:08 am
Excellent, i always wondered how internet connection is detected by windows. It had to be a some kind of dns
20 of 24 10/31/2015 1:57 PM
lookup.
Super User Blog says:

[] its its so freakin awesome that it had to be mentioned again. Its actually one of the
blog posts that still brings in daily []
Oscar Mederos says:

You should probably edit the post and fix this:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNlaSvcParametersInternet
Very useful info by the way
Ari says:
September 21, 2012 at 4:08 pm
Put ncsi.txt file to C:\inetpub\wwwroot directory. Make sure IIS is up and running and you can access the file
with localhost/ncsi.txt
Modify the registry values: ActiveDnsProbeContent = 127.0.0.1 ActiveDnsProbeHost = localhost

ActiveWebProbeHost = 127.0.0.1
21 of 24 10/31/2015 1:57 PM
R2D3 says:
December 17, 2012 at 6:15 pm
Good article! Just two additions: First, I dont really understand why they separate DNS lookups for the
dns.msftncsi.com domain name are done, since the DNS request for http://www.msftncsi.com already did tell
the device that DNS is working, isnt it? But wait: thats Microsoft. Ok.
Second, the device requesting the http://www.msftncsi.com/ncsi.txt indeed honors redirecting replies from the
server. We have lots of such requests in our web servers logfile on a WiFi Captive Portal. It would be better to
just leave the redirect reply unanswered. But as I said, this is Microsoft. So we will need to answer those URLs
locally in our routers to not get flooded with useless requests.
Dave says:
May 23, 2013 at 3:40 pm
It needs a separate lookup for http://www.msftncsi.com because its distributed through a CDN and the query
response will be different depending on your location. The response for dns.msftncsi.com has only one
answer. Theyre not checking to see if DNS is working, theyre checking to see if they get the correct answer.
Some captive portals will redirect HTTP traffic but will pass DNS requests to the Internet.
Michael says:
You guys were great. Thanks for this.
Bob Bobson says:

July 6, 2013 at 4:36 pm
And the original TechNet article:
http://technet.microsoft.com/en-us/library/cc766017.aspx
zerox says:
September 14, 2013 at 3:12 pm
Android can detect that wifi needs authorization when you connect to a public wifi, how does it do this?
22 of 24 10/31/2015 1:57 PM
Tom Hudson says:

Im running Windows 7/64. Im trying to troubleshoot the Internet dropping out on me every 12 hours Im on
Time Warner Roadrunner service and it literally stops working for 3 minutes every 12 hours, like clockwork.
When the Internet drops, I see the little yellow (!) symbol over the network icon indicating I have no Internet
connection, as youd expect. Tonight I tried to log into my cable modem when this happened, to see if the signal
strength was bad or whatever couldnt connect to it. Tried getting into the Vonage router, which is connected
directly to the modem couldnt get in there either, until the Internet came back up. Is this a known behavior
that if Windows sees you have no Internet, trying to get to a LAN address like 192.168.0.1 doesnt work either?
Ive seen this happen before on one of my other computers as well (Time Warners Internet drops out a lot for
us occasionally).
Iraj says:
March 23, 2014 at 4:44 am
My network is not connect to internet but in taskbar it shows the internet access. is any idea?
test says:
March 31, 2014 at 3:41 pm
Android does the same thing it checks clients3.google.com
Just put 127.0.0.1 clients3.google.com as an extra line in your /system/etc/hosts file to kill it.
Dan Roberts says:

October 14, 2014 at 9:59 pm
Things have changed since this article was published. Not sure if this is peculiar to domain member machines
or not, but on our Win 7 x64 machines, Windows tests connectivity by making an http connection to
http://www.microsoft.com, then doing a DNS lookup to microsoft.com, then using an HTTP connection to the IP
address returned, which is an address in the 134.170.0.0 block. The msftncsi.com lookups and
http://www.msftncsi.com/ncsi.txt connection are no longer done. I have a few machines that are blocked from
the Internet, so I had to allow http access to http://www.microsoft.com and to the entire 134.170.0.0 block to
clear the connectivity test so the yellow caution would not show.
23 of 24 10/31/2015 1:57 PM
Leave a comment
Name (required)
Log in Mail (will not be published) (required)

with Stack Exchange
Website
Submit comment
24 of 24 10/31/2015 1:57 PM

How Windows Knows It Has An Internet Connection Super User Blog

Enviado por

Dados do documento

Título original

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

How Windows Knows It Has An Internet Connection Super User Blog

Enviado por

Direitos autorais:

Formatos disponíveis

Windows 7 Network Awareness: How Windows knows it has an internet connection Super Us... http://blog.superuser.

Connectivity to an intranet Archives

In the same registry key were a series of other Productive Thursday

89 Comments News (3)

Reply to this Comment Super User (6)

Chris Thompson says:

Reply to this Comment

How does it work? should say http://www.msftncsi.com/ncsi.txt and not http://msftncsi.com/ncsi.txt

Reply to this Comment

Reply to this Comment

ASP.Net Halifax says:

Reply to this Comment

Small error: should say tenths of a minute not tenths of a second

Reply to this Comment

$ file ncsi.txt ncsi.txt: ASCII text, with no line terminators

Reply to this Comment

Ted Sbardella says:

Very interesting thanks so much!

Reply to this Comment

Reply to this Comment

Minor correction, NCSI performs a DNS lookup on http://www.msftncsi.com/ncsi.txt, then requests

Reply to this Comment

Reply to this Comment

Reply to this Comment

Reply to this Comment

Actually, its NCSI performs a DNS lookup on http://www.msftncsi.com then requests

Reply to this Comment

Reply to this Comment

Reply to this Comment

Windows 7 Network Awareness | digital explorations says:

Reply to this Comment

Reply to this Comment

Interesting displayed by lynx text-mode browser (from Linux PC):

No Links on the current page

Harry Johnston says:

Reply to this Comment

Reply to this Comment

What about NCSI for ipv6? How does that work?

Reply to this Comment

Reply to this Comment

Nice work, enjoyed the article.

Reply to this Comment

If it can do a DNS lookup then it has internet access.

Reply to this Comment

Windows 7 and Windows Vista: Network Awareness Rob Sanders:

Reply to this Comment

Another alternative for lazy people:

..my server, using it myself.

Reply to this Comment

I found this info from MS about how NCSI works http://technet.microsoft.com/en-us/library

Reply to this Comment

Reply to this Comment

Arno Nym says:

NCSI performs a DNS lookup on http://www.msftncsi.com/ncsi.txt, then requests http://www.msftncsi.com

NSCI performs a DNS lookup on http://www.msftncsi.com, then requests is correct.

Reply to this Comment

@Jarmund << yes works on Vista as well

Reply to this Comment

Reply to this Comment

Criao de Sites says:

Thanks for letting us know how to disable this NCSI thing.

Reply to this Comment

OK, anyone can now use samwyse.appspot.com as an NCSI server. http://samwyse.appspot.com/ncsi-