Windows 7 Network Awareness: How Windows knows it has an Internet connection

[mlinsey]

" If the response is never received, or if there is a redirect, then a DNS request for dns.msftncsi.com is made. If DNS resolves properly but the page is inaccessible, then it is assumed that there is a working internet connection, but an in-browser authentication page is blocking access to the file. This results in the pop-up balloon above. If DNS resolution fails or returns the wrong address, then it is assumed that the internet connection is completely unsuccessful, and the “no internet access” error is shown."

Would this mean that DNS poisoning msftncsi.com would prevent Win7 machines from accessing the internet? Or would this merely cause the 'no internet access' error to be displayed despite your connection working anyway?

[alvarosm]

Which is terribly annoying when you have a crappy router that intercepts dns queries and sometimes fails to resolve, making Windows think there's no internet, which makes it NOT let you even try to send the packets. Not my case but I've seen it happen: big FAIL. What a crappy way of "checking" you have internet access... (@yakyak, no they don't work, that's what's so screwed up not just the half-assed method for checking)

[yakyak]

This service can be disabled, so obviously it doesn't prevent you from accessing the internet even if it thinks it doesn't have access. It would SAY "no internet connection", but internet resources would still work just fine.

[snprbob86]

The iPhone uses a very similar technique. If you connect to a wifi network that requires login, a browser sans address bar will pop-up over your current app and allow you to login. Once an external resource can be reached, the browser disappears and returns you to the previous app. Steve Jobs even alluded to it / bragged about it when the iPhone was first unveiled, 2 years before Win7 was released.

[upthedale]

In fairness, this has nothing to do with Win7 specifically. The NCSI service was introduced with Vista.

[wrs]

For the curious, previous HN discussion on this wifi captive portal trick ("WISPr"): http://news.ycombinator.com/item?id=1674911

[phlux]

Just a note - this functionality was not in the initial day-1 release of the iPhone... I don't recall which update had this, but it was well after 1.0

[jerrya]

Yes, I have wanted to build something like that for Android, mainly to keep my phone from getting confused when it's connected to someone's wifi that demands some check box be checked off for service.

It would periodically awaken, see if the wifi is connected, if it is is there connectivity, if there is, go back to sleep, if there is not, turn the wifi off.

I've also wanted to build for Android the same piece of code, but if for 2 or 5 urls it gets back the same page with a checkbox, it checks off the box and sends it back off.

But I am curious, do all those wifi dns terms and agreements hijacking pages break any sort of RFC?

And is there any solution in ip6?

Or is there a real fix possible in ip4?

[ephemient]

I'm not sure if you can access its state programmatically, but Android already does detection: the WiFi status icon is green if the system can make a connection to Google's servers, and grey otherwise.

IPv[46] have nothing to do with it. "Captive portal" pages are meant to prevent you from getting to the larger Internet, until you do whatever magic is required to dismiss them.

[telcodud]

Check out this open source application sbautologin (link: http://code.google.com/p/sbautologin/) that automatically logs into Starbucks (AT&T really) WiFi.

[dsl]

To answer all of your questions: Don't use someone else's wifi if you don't like how it behaves. Your sense of entitlement makes me sick.

[ilikejam]

Possible vector for some sort of attack? The ncsi service that requests www.msftncsi.com is presumably very simple, but then...

[jerrya]

It serves approx 32 bytes but it serves it to such an enormous number of machines that I have been curious as to how it is set up.

Netcraft says: F5 Big-IP Microsoft-IIS/7.0 213.199.181.90

But I am curious as to what the real details of the setup are.

[ahi]

I just assumed it noticed when I entered the login information 2 minutes prior, then waited until the most annoying moment to give me a completely useless fraking notification.

[known]

Sounds like http://linuxcommand.org/man_pages/ruptime1.html

[drivebyacct2]

if you're paranoid enough to disable this, you shouldn't be using windows. there are far more and better ways for windows and other windows software to phone home.

[Blarat]

I think that making it phone your own NCSI server instead would be quite interesting, just in case your computer gets stolen.

[idonthack]

Do we really need an entire article about this? Seriously, if you couldn't figure this out on your own in about 10 seconds, you're in the wrong line of work

[aneth]

It's nice to see the precise mechanics explained, and it might be rather "negative" to make your point, but it is a pretty obvious solution and I agree with you.

[dominikb]

Apple claims that Mac OS X is "the world's most advanced operating system". But it's these details that I consider advanced and clever. Apple's marketing statements went from funny to offensive and unsupported.