Why duplicate HOSTS file entries?

[iamme99]

I was looking through the hosts file today and noticed something strange - Spybot seems to put TWO entries in the file for each URL. Here is a sample:

127.0.0.1 platinumantivir.com
127.0.0.1 www.platinumantivir.com
127.0.0.1 www.rxhal.ru
127.0.0.1 rxhal.ru
127.0.0.1 www.snowroyal.com
127.0.0.1 snowroyal.com
127.0.0.1 www.summeryes.ru
127.0.0.1 summeryes.ru
127.0.0.1 www.tabnoland.ru
127.0.0.1 tabnoland.ru
127.0.0.1 www.web888casinoz.net
127.0.0.1 web888casinoz.net
127.0.0.1 www.onj2me.info
127.0.0.1 onj2me.info
127.0.0.1 www.pussii.ru
127.0.0.1 pussii.ru
127.0.0.1 www.yes18.ru
127.0.0.1 yes18.ru
# End of entries inserted by Spybot - Search & Destroy

One entry is with the "www", the other entry is without the "www".

IS it really necessary to have these two entries for each and every site?

[lewisje]

I was looking through the hosts file today and noticed something strange - Spybot seems to put TWO entries in the file for each URL. Here is a sample:

127.0.0.1 platinumantivir.com
127.0.0.1 www.platinumantivir.com
127.0.0.1 www.rxhal.ru
127.0.0.1 rxhal.ru
127.0.0.1 www.snowroyal.com
127.0.0.1 snowroyal.com
127.0.0.1 www.summeryes.ru
127.0.0.1 summeryes.ru
127.0.0.1 www.tabnoland.ru
127.0.0.1 tabnoland.ru
127.0.0.1 www.web888casinoz.net
127.0.0.1 web888casinoz.net
127.0.0.1 www.onj2me.info
127.0.0.1 onj2me.info
127.0.0.1 www.pussii.ru
127.0.0.1 pussii.ru
127.0.0.1 www.yes18.ru
127.0.0.1 yes18.ru
# End of entries inserted by Spybot - Search & Destroy

One entry is with the "www", the other entry is without the "www".

IS it really necessary to have these two entries for each and every site?

yes; each domain is treated separately and no wildcards are allowed in Windows HOSTS files

it goes back to the original purpose; when the HOSTS file was the only way to access a domain name, you may have wanted nist.gov, www.nist.gov, and ftp.nist.gov to have separate IP addresses

[tomdkat]

yes; each domain is treated separately and no wildcards are allowed in Windows HOSTS files

This is true but duplicate entries are NOT needed as aliases can be entered in the hosts file, like this:

127.0.0.1 platinumantivir.com www.platinumantivir.com

For example:

C:\WINNT\system32\drivers\etc>ping -n 1 platinumantivir.com

Pinging platinumantivir.com [127.0.0.2] with 32 bytes of data:

Reply from 127.0.0.2: bytes=32 time<10ms TTL=128

Ping statistics for 127.0.0.2:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\WINNT\system32\drivers\etc>ping -n 1 www.platinumantivir.com

Pinging www.platinumantivir.com [127.0.0.2] with 32 bytes of data:

Reply from 127.0.0.2: bytes=32 time<10ms TTL=128

Ping statistics for 127.0.0.2:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\WINNT\system32\drivers\etc>type hosts
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
127.0.0.2 platinumantivir.com www.platinumantivir.com

C:\WINNT\system32\drivers\etc>

Of course, 127.0.0.1 should be used as the IP address, not 127.0.0.2 as I used. I used 127.0.0.2 purely as an example.

At least doing this will reduce the number of individual entries in the hosts file.

I don't know if there's any performance hit from assigning each domain its own IP address so there shouldn't be any adverse effects from the duplicates.

Peace...

[iamme99]

This site says that you CAN use wildcards:
http://www.ezlan.net/host.html

Please Note.

Host File does work with wildcards to block a range of servers, such as *.site.com

HOSTS file can only map host names to IP addresses.

Mapping an IP to another IP, or a host name to another host name does not work.


So:
127.0.0.1 *.sitename.com

SHOULD be equivalent to the two entries of:

127.0.0.1 http://www.sitename.com --AND--
127.0.0.1 sitename.com

[tomdkat]

This site says that you CAN use wildcards:
http://www.ezlan.net/host.html

Please Note.

Host File does work with wildcards to block a range of servers, such as *.site.com

HOSTS file can only map host names to IP addresses.

Mapping an IP to another IP, or a host name to another host name does not work.


So:
127.0.0.1 *.sitename.com

SHOULD be equivalent to the two entries of:

127.0.0.1 http://www.sitename.com --AND--
127.0.0.1 sitename.com

That site seems to be mistaken. Here is a test from a Windows XP (SP3) system I have access to:

C:\WINDOWS\system32\drivers\etc>type hosts
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

127.0.0.2 *.platinumantivir.com

127.0.0.3 myantivir.com www.myantivir.com


C:\WINDOWS\system32\drivers\etc>ping -n 1 platinumantivir.com
Ping request could not find host platinumantivir.com. Please check the name and try again.

C:\WINDOWS\system32\drivers\etc>ping -n 1 www.platinumantivir.com
Ping request could not find host www.platinumantivir.com. Please check the name and try again.

C:\WINDOWS\system32\drivers\etc>ping -n 1 www.myantivir.com

Pinging myantivir.com [127.0.0.3] with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.3:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\WINDOWS\system32\drivers\etc>ping -n 1 myantivir.com

Pinging myantivir.com [127.0.0.3] with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.3:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\WINDOWS\system32\drivers\etc>

In my test, the pongs came from 127.0.0.1 but the IP resolved in the ping output match what's in my hosts file.

Peace...