Understanding NetBIOS Name Resolution

NetBIOS, broadcasts names to listening nodes on the network. NetBIOS utilizes a User Datagram Protocol (UDP) query to broadcast names. NetBIOS names identified computers on the network before the introduction of Windows 2000. The NetBIOS name is resolved to an IP address through Windows Internet Name Service (WINS), broadcasting, or the LMHOSTS file. If the LAN is a NetBIOS LAN, the NetBIOS name is then the network address. The NetBIOS name is assigned by an administrator when the operating system is installed. To enable communication, the following requirements exist:

NetBIOS names have to be unique.

• A single device can have the same NetBIOS network name address

Before discussing NetBIOS names or naming any further lets first look at the name types used in Windows operating systems:

• NetBIOS name: A unique name used to identify a NetBIOS resource on the network. The NetBIOS name is resolved to an IP address for communication to occur.
• Host name: A host name is assigned to a computer to identify a host in a TCP/IP network. The host name can be described as being the alias that is assigned to a node, to identify it. When the host name is used, and not the IP address, the host name has to be resolved to an IP address for IP communication to occur. The HOSTS file is a text file that contains host names to IP addresses mappings. The HOSTS file is stored locally.
• Fully qualified domain name (FQDN): This is the DNS name that is used to identify a computer on the network. FQDNs have to be unique. The FQDN usually consists of the following:
  • Host name
  • Primary DNS suffix
  • Period
• Primary DNS suffix: Computers running in a Windows Server 2003 network are assigned primary DNS suffixes for name registration and name resolution purposes. The primary DNS suffix is also referred to as the primary domain name, or domain name. This is the name which is set in My Computer, on the Computer Name tab of the properties dialog box.
• Connection-specific DNS suffix: This is a DNS suffix which is assigned to an adapter. The connection-specific DNS suffix is called the adapter DNS suffix.

A NetBIOS name is a unique name that identifies a NetBIOS resource on the network. NetBIOS names are 16-byte address. NetBIOS computer names have 15 characters, and NetBIOS service names have 16 characters. The initial 15 characters of the NetBIOS service name is the identical as the host name. It is the physical NetBIOS name. Zeros are used for padding. The last character of a NetBIOS service name identifies the particular NetBIOS service or resource. This character is typically referred to as the type byte.

When you assign a NetBIOS name to a computer running a Windows operating system, you can only assign a 15 character name. A NetBIOS name can also include additional characters to define a NetBIOS scope. This is the method used to structure NetBIOS computers into groups. Computers that have the identical NetBIOS scope can communicate between each other. With the Windows 2000 and Windows Server 2003 operating systems, you can use Dynamic Host Configuration Protocol (DHCP) to distribute NetBIOS scopes.

The NetBIOS namespace is flat. This is different to the hierarchical namespace of Domain Name System (DNS). Because the NetBIOS namespace is not as scaleable as DNS, it does not work well for large networks. NetBIOS naming should be used for private networks.

The different name resolution mechanisms available for resolving NetBIOS names into IP addresses are listed below:

• NetBIOS name cache: Windows computers maintain a NetBIOS name cache that includes the most recent resolved NetBIOS names together with their associated IP addresses. The NetBIOS name cache is stored in memory and therefore generates no network traffic. The NetBIOS name cache is checked initially, and is used for name resolution before any other name resolution mechanism is attempted. You can use the Nbtstat.exe utility if you want to examine the content of the NetBIOS name cache.
• Windows Internet Naming Service (WINS): This is a NetBIOS name server (NBNS). WINS works as follows:
  • When NetBIOS computers start, WINS registers the names and IP addresses of these computers.
  • The names are stored in the WINS name resolution database.
  • A WINS client exists for each computer running the Windows operating system. The administrator sets the IP address of the WINS server(s) on the network that the WINS client should utilize.
  • For communication to take place between a Windows computer and a NetBIOS computer, a NAME QUERY REQUEST message is sent to the configured WINS server.
  • The NAME QUERY REQUEST message includes the NetBIOS name of the computer with which communication should be established.
  • The WINS server provides NetBIOS name resolution by returning the IP address that is associated with the NetBIOS name of the other computer.
• Broadcast name resolution mechanism: If a Windows Internet Naming Service (WINS) is not configured on the network for NetBIOS name resolution, NetBIOS names are resolved into IP addresses through broadcasting of the NAME QUERY REQUEST message. With broadcasting, the computer that has the NetBIOS name included in the NAME QUERY REQUEST message has to reply to the sender and return its IP address. With WINS, the NAME QUERY REQUEST message is sent as a unicast to the WINS server. Broadcasting creates greater traffic on the network than unicasts. Broadcasting is also restricted to the local network. Because of these characteristics of broadcasting, WINS is considered a more efficient method to resolve NetBIOS names into IP addresses.
• LMHOSTS files: LMHOSTS files are text files, similar to the HOSTS files used for name resolution for TCP/IP based networks. The HOSTS files contain host name to IP address mapping. A LMHOSTS file is the lookup table that is much like a HOSTS file, but is used for NetBIOS name resolution. Each computer has to have a copy of a LMHOSTS file. LMHOSTS files can resolve the NetBIOS names of servers that exist on other LANs. LMHOSTS files have to be manually maintained by administrators. This means that they have to be updated by someone whenever the network changes.

Because Windows systems utilize name resolution mechanisms as a name resolution process, the following events would occur to resolve the NetBIOS name of a computer into an IP address:

1. If the computer is set up to utilize a Windows Internet Naming Service (WINS) server for name resolution, the NetBIOS name cache is first checked to determine whether the NetBIOS name can be resolved.
2. If the NetBIOS name is not in the NetBIOS name cache, the NAME QUERY REQUEST message is sent to the configured WINS server.
3. If the WINS server cannot resolve the NetBIOS name, the broadcast name resolution mechanism is used.
4. Computers that have no configured WINS server use the broadcast name resolution mechanism after the NetBIOS name cache is checked.
5. If the broadcast name resolution mechanism is unsuccessful, the LMHOSTS file is used for name resolution.

Understanding the NetBIOS Node Types

When computers use different name resolution mechanisms to resolve names to IP addresses, the process is called nodes. Nodes can be defined as the combination of the different name resolution methods used by a NetBIOS computer to resolve a NetBIOS name to an IP address. This process was outlined in the preceding section of this Article. The NetBIOS node types are configured locally on each computer.

You can use either of following methods to configure the NetBIOS node types:

• You can distribute the NetBIOS node types through a Dynamic Host Configuration Protocol (DHCP) server.
• You can manually edit the registry by using the Registry Editor. The registry subkey that should be edited is HKLMSYSTEMCurrentControlSetServicesNetBTParametersNodeType

Based on the node type, you can configure the nodes to utilize any of the mechanisms listed below to resolve the NetBIOS name of a computer into an IP address:

• NetBIOS name cache
• NetBIOS name server, such as a WINS server.
• Broadcasting
• LMHOSTS file
• HOSTS file
• Domain Name System (DNS) server

All node types first check the NetBIOS name cache for name resolution. All Windows 2000, Windows XP, and Windows Server 2003 computers that are not using a WINS server for name resolution, are using Microsoft Enhanced b-node for name resolution. The NetBIOS name cache is first checked for name resolution. Following this, the broadcast method is used.

Because DNS is the primary name registration and name resolution method used in Windows Server 2003, all Windows 2000, Windows XP, and Windows Server 2003 NetBIOS clients first determine the following information for each request:

• Whether the request exceeds the 15 character limit
• Whether periods are included.

This would determine whether the FQDN naming convention is used. If it is used, the request is sent to the DNS server for name resolution. Following this, the configured node type is implemented.

The NetBIOS node types are listed below:

• b-node – broadcasts: NetBIOS clients that use the b-node type register their own NetBIOS names. b-node type clients only utilize broadcasts to resolve NetBIOS names to IP addresses. The Microsoft implementation of the b-node method is Enhanced b-node. The order in which b-node type NetBIOS clients resolve NetBIOS names are:
  • NetBIOS name cache.
  • Broadcasting name resolution method.

  If the Enhanced b-node method is used, the order changes as follows. All Windows 2000, Windows XP, and Windows Server 2003 computers that are not using a WINS server for name resolution, use Enhanced b-node for name resolution.

  • NetBIOS name cache.
  • Broadcasting name resolution method.
  • LMHOSTS file
• p-node – peer-to-peer: Clients that use the p-node type register their NetBIOS names with a NetBIOS name server, such as WINS, and then use the NetBIOS name server for name resolution. The order in which p-node type clients resolve NetBIOS names are:
  • NetBIOS name cache.
  • NetBIOS name server
• m-node – mixed: Clients that use the m-node type use a combination of both the b-node type and p-node type to register their names, and to resolve NetBIOS names to IP addresses. The b-node type is used first to resolve NetBIOS names to IP addresses through broadcasting on the network. If this is unsuccessful, a NetBIOS name server is used for name resolution. The order in which m-node type clients resolve NetBIOS names are:
  • NetBIOS name cache.
  • Broadcasting name resolution method.
  • NetBIOS name server
• h-node – hybrid: Clients that use the h-node type use a combination of both the p-node type and b-node type to register their names, and to resolve NetBIOS names to IP addresses. The p-node type is used first to resolve NetBIOS names to IP addresses. If this is unsuccessful, broadcasting is used. The order in which h-node type clients resolve NetBIOS names are:
  • NetBIOS name cache.
  • NetBIOS name server
  • Broadcasting name resolution method.
• Enhanced h-node: Clients that use the Enhanced h-node type use the p-node type and b-node type, and DNS to resolve NetBIOS names to IP addresses. Enhanced h-noe type is the default node type used for Windows 2000, Windows XP, and Windows Server 2003 NetBIOS clients who have a configured WINS server for name resolution. The order in which Enhanced h-node type clients resolve NetBIOS name are:
  • NetBIOS name cache.
  • NetBIOS name server – WINS
  • Broadcasting name resolution method.
  • LMHOSTS file
  • DNS name cache
  • HOSTS file
  • DNS server

How to generate a LMHOSTS file

1. Click Start, Control Panel, and then click Network Connections.
2. Right-click the network connection you want to work with, and then click Properties from the shortcut menu.
3. Select Internet Protocol (TCP/IP), and then click the Properties button.
4. When the Internet Protocol (TCP/IP) Properties dialog box opens, click the Advanced button.
5. The Advanced TCP/IP Settings dialog box contains four tabs (IP Settings, DNS, WINS, Option). Click the WINS tab.
6. The Enable LMHOSTS lookup checkbox should be selected.
7. Click the Import LMHOSTS button.
8. Locate the text file, and after selecting the file, click Open
9. Click OK to close the Advanced TCP/IP Settings dialog box.
10. Click OK to close the Internet Protocol (TCP/IP) Properties dialog box
11. Click OK to close the Local Area Connections dialog box.

How to distribute NetBIOS scopes in Windows 2000 and Windows Server 2003

With Windows Server 2003, and Windows 2000, you can use a DHCP server to distribute NetBIOS scopes. To do this, you have to use the Registry Editor to add a registry value:

1. Click Start, Run, and enter regedt32.exe to open the Registry Editor.
2. Navigate to HKLMSystemCurrentControlSetServicesNetBTParameters.
3. Select the Parameters registry subkey, and click Add Value from the Edit menu.
4. In the Value Name field, enter ScopeID.
5. Select REG_SZ in the Data Type box.
6. Click OK.
7. Proceed to restart the computer.

How to disable NetBIOS name resolution

1. Click Start, Control Panel, and then click Network Connections.
2. Right-click Local Area Connection, and then click Properties from the shortcut menu.
3. Select Internet Protocol (TCP/IP), and then click the Properties button.
4. When the Internet Protocol (TCP/IP) Properties dialog box opens, click the Advanced button.
5. Click the WINS tab.
6. Click the Disable NetBIOS Over TCP/IP option.
7. Click OK to close the Advanced TCP/IP Settings dialog box.
8. Click OK to close the Internet Protocol (TCP/IP) Properties dialog box
9. Click OK to close the Local Area Connections dialog box.