NetBIOS Name Resolution
NetBIOS is an API and name resolution system originally developed by IBM that is common on Microsoft Windows networks. The NetBIOS name is the computer name you assign to your Windows computer. The NetBIOS computer name is used to identify the computer in Explorer and My Computer. NetBIOS was developed for networks that don’t use TCP/IP. The NetBIOS name system is actually a little redundant on TCP/IP networks because the NetBIOS name serves a role that is similar to the role of the hostname. Microsoft de-emphasized NetBIOS in Windows 2000/XP, and Windows Vista continues the trend; however, Vista fully supports NetBIOS name resolution techniques, and the huge install base of NetBIOS-enabled computers means that no discussion of name resolution would be complete without some attention to NetBIOS.
From the user’s point of view, the distinction between NetBIOS and DNS name resolution has blurred in recent Windows versions. Windows essentially maintains the two systems in parallel. Depending on your configuration, the familiar Windows computer name can serve as either or both a DNS-style hostname and a NetBIOS name.
Because NetBIOS operates through broadcasts, a user on a small network doesn’t have to do anything to configure NetBIOS name resolution (other than setting up networking and assigning a computer name). On a larger network, though, NetBIOS is more complex. Large networks use NetBIOS name servers called WINS servers for resolving NetBIOS names to IP addresses. You can also configure a static LMHosts file (similar to the hosts file under DNS) for name resolution lookups. The following sections take a closer look at NetBIOS name resolution.
Methods for NetBIOS Name Resolution
On TCP/IP networks, the ultimate goal of NetBIOS name resolution is to provide an IP address for a given NetBIOS name.
NetBIOS names are single names up to 15 characters in length, such as Workstation1, HRServer, and CorpServer. NetBIOS does not allow for duplicate computer names on a network.
By the Way
Technically there are 16 characters in a NetBIOS name. However, the sixteenth character is used by the underlying application and in general is not directly configurable by the user. These characters are discussed later in this hour.
NetBIOS names, like hostnames, are said to be in a flat namespace, because there is no hierarchy or capability to qualify the names. In the following sections, you examine several ways to resolve NetBIOS names to their corresponding IP addresses:
Broadcast-based name resolution
LMHosts filename resolution
WINS name resolution
Broadcast-Based Name Resolution
One way for name resolution to take place is through broadcasts. A broadcast occurs when a computer announces to all the other machines on its network segment that it needs the address of a particular computer. All the computers on the segment hear the broadcast, but only the machine specified in the broadcast responds to the request.
This method of name resolution, also known as B-Node name resolution, works well in a LAN environment but does not work in networks that extend beyond the LAN, because routers block broadcasts by design.
By the Way
Broadcasts can produce a great deal of network traffic, which can be disruptive to the network. Routers limit this disruption by not forwarding broadcasts to the rest of the network.
The broadcast name resolution process is simple and requires no extra configuration to set up or use. Simply installing a network card and TCP/IP networking software onto a Windows operating system enables these systems to use broadcasts to locate other computers through NetBIOS name resolution.
LMHosts Files Name Resolution
Windows systems can also resolve NetBIOS names to IP addresses using the LMHosts file. The LMHosts file is similar to the hosts file (described earlier in this hour). An LMHosts file associates NetBIOS names to IP addresses. The IP address is listed in the left column of the file with the corresponding computer name to the right separated by at least one space; comments can be put in the file by placing them after a # character. LMHosts requires a static mapping of IP addresses to NetBIOS names. A separate LMHosts file resides on each computer. You have to manually configure the LMHosts file. If a new computer is added to the network, the other computer will not be able to find it through LMHosts until an entry for that computer is manually added to each LMHosts file.
On a network consisting of a single segment, an LMHosts file is usually not necessary, because computers on the network can resolve NetBIOS names through broadcast. (In some cases, LMHosts can be used for efficiency or for compatibility with older, nonbroadcasting systems.) On larger networks consisting of more than one segment, broadcast cannot be used to resolve names beyond the router. In that case, computers must perform NetBIOS name resolution using either LMHosts or a WINS server (described in the next section). In some cases, LMHosts is useful for pointing the way to a domain controller on a different network segment. (A domain controller is necessary for authentication in a domain-based Windows environment.)
By the Way
The LM in LMHosts is a holdover from Microsoft’s LAN Manager, a networking product that predates Windows NT.
The following is an example of what a basic LMHosts file looks like:
192.59.66.205 marketserv #file server for marketing department 192.59.66.206 marketapp #application server for marketing 192.59.66.207 bobscomputer #bob's workstation
Recently resolved NetBIOS names are stored in the NetBIOS name cache. Whenever a user attempts to locate a specific computer, the system always consults the NetBIOS name cache before searching the LMHosts file. If no match is found, the entries within the LMHosts file can then be scanned for the requested name. This can be a time-consuming process if there are many entries in the LMHosts file, so to speed up the process, you can designate certain high-use entries to be preloaded into the NetBIOS name cache by including the #PRE keyword (see Figure 11.9). The LMHosts file is scanned once in its entirety when networking starts, so for efficiency the lines that include #PRE keywords are usually placed toward the bottom of the LMHosts file. These lines need to be read only once, and placing them later in the file lessens the chance that they will be reread.
Figure 11.9. Contents of an LMHosts file.
By the Way
You can use the NBTStat utility to view and manipulate the NetBIOS name cache. To view the contents of the cache, type nbtstat –c at the command prompt.
Maintaining static files such as hosts and LMHosts is difficult because these files are located on each individual computer and, therefore, are not centralized. You can address that problem in the LMHosts file by using the keyword #INCLUDE followed by an entry for the path to the LMHosts files on other machines. With this keyword, the local LMHosts file can include the location of a server-based LMHosts file for use by the local machine. This enables edits to be performed on the server-based LMHosts file, but the changes are accessible from the user’s computer.
If there is more than one #INCLUDE entry, they need to be placed between the keywords #BEGIN ALTERNATE and #END ALTERNATE, as shown in Figure 11.9.
As mentioned previously, LMHosts can be used to locate a Windows domain controller on a different network segment. The #DOM keyword identifies an LMHosts entry that represents a domain controller.
Windows Internet Name Service (WINS) Name Resolution
Windows Internet Name Service (WINS) was created to address the same types of shortcomings in LMHosts that DNS was created to address regarding hosts files. When a client needs to get the IP address for a computer, it can query the WINS server for the information.
By the Way
WINS is the name assigned to Microsoft’s implementation of what is generically known as a NetBIOS name server or NBNS. NetBIOS name servers are described in RFCs 1001 and 1002.
WINS maintains a database of registered NetBIOS names for a variety of objects, including users, computers, services running on those computers, and workgroups. However, instead of the entries in this database coming from manually edited text files, as in most DNS implementations, a client computer registers its name and IP address with the WINS server dynamically when it starts up.
The WINS server receives and responds to NetBIOS name resolution requests (see Figure 11.10). If the WINS server in Figure 11.10 looks similar to the DNS server in Figure 11.2, that’s because it is. A WINS server does for NetBIOS name resolution what the DNS server does for domain name resolution. However, the flat NetBIOS namespace provides no equivalent to the hierarchical name resolution techniques available through DNS.
Figure 11.10. WINS NetBIOS name resolution.
Windows offers a number of methods for configuring a client system to use WINS. If the computer receives a dynamic TCP/IP configuration through DHCP (see Hour 12), the WINS configuration can be delivered to the client automatically through DHCP. You can also manually enter WINS server addresses and manage other settings related to NetBIOS name resolution through the TCP/IP configuration dialog box.
The precise steps for configuring WINS vary depending on the Windows version. In Windows Vista, you can manage the WINS configuration through the WINS tab of the Advanced TCP/IP Settings dialog box (see Figure 11.11). Follow these steps to access the Advanced TCP/IP Settings dialog box:
1. | Select Network in the Start menu. |
2. | Go to the Network Sharing Center. |
3. | Select Manage Network Connections. |
4. | Right-click on the network connection you want to configure and select Properties. (You’ll need the authorization of an administrator account.) |
5. | Select Internet Protocol Version 4 (TCP/IPv4) and click on Properties. |
6. | In the TCP/IPv4 Properties dialog box, click the Advanced button. |
7. | Select the WINS tab. |
Figure 11.11. Configuring WINS in Windows Vista.
As shown in Figure 11.11, the WINS tab lets you manually add the addresses of WINS servers. You can also enable LMHosts lookup and import an existing LMHosts file. Note that, by default, the system receives a NetBIOS setting from the DHCP server, but you can also elect to override the DHCP setting by enabling or disabling NetBIOS over TCP/IP.
When a WINS client computer boots after being configured to use WINS, the following process occurs:
Service startup— As the computer boots, various services are started, some of which need to be made known to other computers.
Registration request— To be known to other computers on the network, the service must register. A WINS client computer packages the NetBIOS name and the computer’s IP address inside a name registration request, and the registration request is sent to the WINS server. Upon receiving the registration request, WINS checks its database to see whether the name is already registered.
If the name does not exist, WINS adds the NetBIOS name and IP address pair to its database and sends a name registration response indicating the name was successfully registered. If the requested NetBIOS name already exists in the WINS database, WINS challenges the computer currently registered by sending a message to the registered IP address. If the currently registered computer responds, a negative acknowledgment is sent to the computer attempting to register the name. If the computer being challenged doesn’t respond, WINS allows the registration to occur and overwrites the previous registration.
Lease— Assuming the computer is successful in registering its NetBIOS names and services with WINS, these names are considered leased. In essence, the computer is allowed to use the NetBIOS name for a specified period of time—for instance six days—but the client can renew the lease before it expires. The client typically renews the lease at 50% of the total lease time or in this case every three days.
Earlier I noted that the 16th character of a NetBIOS name is not configurable by the user. During the WINS registration process, the 16th character is appended to the name by the WINS server based on what type of service the computer is trying to register before it is placed in the database. Between computer names, workgroup names, and a number of services, it is not unusual for a single computer to have 5 to 10 registration entries in the WINS database.
As another example of the WINS name resolution process, suppose a user on a computer uses a utility such as Network Neighborhood to connect to another computer on the network. A name query request, which includes the desired NetBIOS name, is constructed by the application and sent to the WINS server. When WINS receives the request, it queries its database for a matching registration. If the requested name is found, WINS returns the corresponding IP address in the response packet. After the client computer has the IP address for the requested computer, the client can then communicate directly.
Testing NetBIOS Name Resolution
You can test NetBIOS name resolution using NetBIOS-based utilities. One typical test of name resolution is using the net view command, which enables you to view the share point names on a server. (Remember that a share point is a directory where client computers can connect with another computer to view or exchange files.) To perform this test, choose a computer that has one or more share points. At a command prompt, type
net view \computernamewhere computername is the name of the computer you selected. If net view is capable of resolving the computer name to an IP address, you should see the names of share points listed in the first command and response.
You can also use the ubiquitous Ping utility to test NetBIOS name resolution. On most Windows systems, if NetBIOS name resolution is working properly, you should be able to ping a computer by its NetBIOS computer name. For instance, if a computer has the computer name Shirley, you should be able to type
ping Shirley
and receive a response.