...no warranty, expressed or implied... | ||
--relevant disclaimer |
The table below classifies NetBIOS names according to their base names, the suffix byte, and their status as a unique or group name. The list was gathered from sources scattered around the Internet, old documentation, and hear-say. There are many references out there, and a good deal of variation among them. As usual, what is available is at times both contradictory and incomplete. As a result, the information presented below should be viewed with suspicion. If you have updates or comments which you can share freely, please send them to [email protected].
Name Format | Suffix Group/Unique | Service/Description |
---|---|---|
| Workstation Service Known as the NetBIOS Computer Name or the Client Service Name because it is typically sent as the Some of the documentation indicates that the purpose of the Workstation Service is to receive mailslot messages directed at the node. | |
machine |
| Messenger Service Under some versions of Windows, this name is registered by the Messenger Service and used as the Not all implementations use this name as the |
machine |
| Messenger Service This name is registered by the Messenger Service, which is used to exchange “WinPopup” messages. Like the Server Service, the Messenger Service speaks SMB protocol, but it uses a different set of SMB messages and is a distinct service. When creating an NBT session, the Messenger Service client uses either the username Some, but not all, implementations of the Messenger Service client will also use the client’s machine See also machine |
machine |
| RAS Server Service |
machine |
| NetDDE Service |
File Server Service This, of course, is the Server Service, which is the primary recipient of SMB connections. SMB services may be offered under any name, but this is the standard. Clients expect that the Server Service name will have a suffix value of | ||
machine |
| RAS Client Service |
machine |
| Microsoft Exchange |
machine |
| Microsoft Exchange |
machine |
| Microsoft Exchange |
machine |
| Lotus Notes Server Service |
machine |
| Modem Sharing Server Service |
machine |
| Modem Sharing Client Service |
machine |
| McAfee anti-virus Several sites list this suffix as being used by McAfee (or, incorrectly, McCaffee) anti-virus software, but no further documentation was found to support the claim. The information may be out of date. |
machine |
| SMS Client Remote Control |
machine |
| SMS Administration Remote Control Tool |
machine |
| SMS Client Chat |
machine |
| SMS Client Remote Transfer |
machine |
| DEC Pathworks TCP/IP Service for Windows NT |
machine |
| DEC Pathworks TCP/IP Service for Windows NT |
machine |
| Microsoft Exchange |
machine |
| Microsoft Exchange |
machine |
| Network Monitor Agent Microsoft’s Network Monitor (NetMon) is split into two pieces: the “Agent” and the “Client Application.’ The agent does the work of capturing packets, and the NetMon client provides the user interface. The advantage of this architecture is that agents and clients may run on separate machines. A single NetMon client can, therefore, have access to the capture services of multiple agents, scattered all around an intranet (or, in theory, the Internet). Putting aside the obvious security problems associated with having live capture agents on networks, this can be useful for testing and monitoring purposes. The Network Monitor Agent name is composed of the machine name padded with the value |
machine |
| Network Monitor Client Application The Network Monitor Client Application is the GUI front-end that is used to control, filter, and display NetMon captures. The Network Monitor Client name is composed of the machine name padded with the value The NetMon NetBIOS names may not be in use any longer. Newer versions of NetMon (starting with 2.0?) appear to use a different mechanism for communicating. |
| LAN Manager Browse Service This name is a remnant of an older Browse List distribution mechanism. There are still references to the older system in documents such as the Leach/Naik Internet Draft for Browsing ( | |
| Domain Master Browser This name identifies the Domain Master Browser (DMB). A Samba server can behave as a DMB without also being a Primary Domain Controller (PDC). The existence of a PDC promotes the Workgroup to the status of an NT Domain, in which case we write nt_domain Domain Controllers (both Primary and Backup) register the nt_domain | |
nt_domain |
| Domain Controller Every domain controller in the NT Domain will register this group name. The NBNS (WINS server) is expected to store all of the IP addresses associated with the name, though it will report at most 25 IP addresses in a The first entry in the list should be the IP address of the Primary Domain Controller (PDC). The rest of the IPs are ordered most recent first. This is atypical handling for group names under WINS. WINS (and, therefore, any NBNS which is WINS-compatible) will usually report only the limited broadcast address (255.255.255.255) when queried for a group name. |
| Local Master Browser This name identifies the Local Master Browser (LMB, sometimes called simply “Master Browser”) for a subnet. A WINS server (and an NBNS which is WINS-compatible) will accept registration for | |
| Browser Election Service Every node that is capable of acting as a browser registers this group name so that it can listen for election announcements. | |
| Local Master Browser This group name is registered by all Local Master Browsers (LMBs). It allows LMBs on a local LAN to find one another in order to exchange Browse Lists. This is how Browse Lists for multiple Workgroups and/or NT Domains are combined. | |
username |
| Messenger Service This name is used in the same way as machine Some Microsoft documentation lists this name as a group name, which would be nice. Unfortunately, in practice the name is a unique name which means that a single user logged on to multiple machines can only receive messages (sent to the username) on one of those machines. See also machine |
internetgroup |
| User Defined This name type was probably introduced with Windows 2000. Group names with a suffix byte value of |
|
| Wildcard Name The wildcard name is composed of an asterisk (’ |
| File Server Service This name is never registered (it begins with an asterisk and is, therefore, an illegal name under NBT). Many implementations, however, will accept it as a valid | |
|
| Internet Information Server This name is registered by IIS servers and handled as an Internet Group name. Note that the name is in mixed UPPER/lower case. It is, in fact, encoded that way, which is a little awkward.[1] |
| Internet Information Server This name is formed by adding the prefix “ The handling of NetBIOS names by IIS is a little... er... unusual. Nul bytes are not supposed to be used as padding except in the wildcard name. There is also a bug (verified in testing against a set of Windows 2000 systems running IIS) which causes the suffix byte to be overwritten if the name is longer than 15 bytes. For example, adding “ | |
|
| Lotus Notes |
|
| Lotus Notes |
|
| |
[1] As of this writing, Samba’s [2] I finally got to see this in the wild while trying to solve a browsing problem with Mike Langhus at the University of Minnesota. There were several IIS servers on the subnet, and roughly a third of them had names long enough to cause the suffix byte overwrite problem. I do not know which versions of IIS are affected, but it does not appear as though it causes any real trouble. It’s more of a curiousity than a bug. |
The Windows Internet Name Service (WINS) is Microsoft’s implementation of the NetBIOS Name Server (NBNS) described in the RFCs. WINS does not match the RFC specifications, however, and its behavior is somewhat quirky. Known quirks are listed below.
Unique names
Multi-homed host names
Multi-homed hosts register unique names by sending a special MULTI-HOMED NAME REGISTRATION REQUEST
packet to the NBNS. The procedure is described in Section 4.3.1.4 on page 81 of this book. WINS servers (and WINS-compatible NBNS implementations) keep track of the list of IP addresses registered by a multi-homed host, and will report up to 25 IP addresses when queried for the multi-homed host name.
Group names
Internet Group, Special Group, and Domain Group names
There are a few things to be said about these:
Thing 1
The terms “Internet Group” and “Special Group” are used interchangeably in much of the available documentation.
Thing 2
Older references use the terms “Internet Group” and “Special Group” when referring to group names with the <1C>
suffix. More recent sources add the term “Domain Group” specifically for the nt_domain<1C>
names, and expand the use of the other terms to include groups defined by adding a special static entry, with a suffix value of <20>
, to the WINS database.[3]
Thing 3
Internet (aka Special) and Domain Groups are defined by using the #SG
and #DOM
keywords in the LMHOSTS
file, or via WINS configuration dialogs on Windows systems.
As with multi-homed host entries, the WINS server should keep track of as many IP addresses per name as it can handle. When queried, the POSITIVE NAME QUERY RESPONSE
should list at most 25 IP addresses per Internet Group name.
Local Master Browser
The LMB registers the workgroup<1D>
unique name. A WINS server will accept all such registrations, ignoring any conflicts, and will reply with a NEGATIVE NAME QUERY RESPONSE
when queried for the name. This behavior forces M and H nodes to search for the LMB on the local IP subnet. If there is no LMB for the Workgroup on the local subnet, then the client that sent the request may call for a browser election. P nodes cannot talk to Local Master Browsers, so they communicate directly with the Domain Master Browser (if there is one).
Domain Master Browser
[3] It was difficult to find more than superficial documentation regarding the <20>
Internet Group names, which suggests that the feature is not widely used. If you want to dig deeper, search the web for information regarding the #SG
and #DOM
keywords used in the LMHOSTS
file.
3.145.173.112