NetBIOS name resolution

1
NetBIOS name resolution
2
Name resolution

• NetBIOS name resolution
• mapping NetBIOS name to an IP address
• review of name syntax machine name \\mname lt
  15 digits, and share name \sname lt 12 digits
  (DOS 8)
• NetBIOS name can be seen in network dialog,
  registry and using nbtstat -n
• ARP - Address Resolution Protocol
• IP address to MAC address resolution
• ARP cache keeps table with IP and MAC addresses
• You can see it using arp -a
• ARP cache aging (2 minutes) can be setup

3
NetBIOS over TCP/IP node types

• b-node broadcast of the name asking for IP
• p-node peer-to-peer using NBNS such as WINS
• m-node mix of b and p, defaults to b-node, if
  fails uses p-node resolution
• h-node hybrid of b and p, defaults to p-node, if
  fails uses b-node resolution
• Microsoft enhanced b-node loads LMHOSTS in local
  cache when TCP/IP starts. If fails to resolve
  then starts broadcast query
• NetBIOS over TCP/IP in Windows is NetBT

4
B-node resolving names locally
A a command like NET USE K \\Al200\temp is
issued and the local address cache is
checked to see if the IP is already there B if
not found in cache a name query broadcast is sent
to the subnet asking for the destination
IP number C the broadcast is received by all
machines that start to check if their names
match the one broadcasted. The machine that
matches prepares a query response using the ARP
to obtain the MAC address of the machine
requesting the name resolu- tion. As soon as
this happens a NetBIOS connection exists.
5
Enhanced B-node resolving remote NetBIOS names
C
LMHOSTS
E
Local address cache
A
router
D
router
A a command like NET USE K \\Al200\temp is
issued and the local address cache is
checked to see if the IP is already there B if
not found in cache a name query broadcast is sent
to the subnet asking for the destination
IP number C if fails the LMHOSTS table is
searched and name is resolved D routing table
is checked for destination, or ARP issues
request for gateway address (normally in
the local cache) E response is sent as soon as
ARP resolves MAC address
6
Resolving NetBIOS names with NBNS
A a command like NET USE K \\Al200\temp is
issued and the local address cache is
checked to see if the IP is already there B if
not found in cache a name query broadcast is sent
or the NBNS is searched for the name and
name is resolved C as soon as name is resolved
ARP is used to determine the hardware
address
7
Name resolution order

• Depending of what is selected
• HOSTS
• DNS
• WINS (if selected)
• broadcast
• LMHOSTS (if checked in WINS, before broadcast)
• DNS again
• You can change this in the registry
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic
  es\TCPIP\Service Provider
• You will see HostsPriority , DNSPriority,
  NBTPriority
• the lowest values are checked first

8
Introduction to NET commands

• NET HELP and NET command /HELP (see)
• NET USER let you see, add, modify and delete
  users
• NET ACCOUNTS changes to the entire user database
• NET GROUP and NET LOCALGROUP (see WEBTEACH)
• NET COMPUTER let you add or delete a computer to
  domain
• NET CONFIG WORSKSTATION and SERVER (see AL200)
• NET STATISTICS WORSTATION and SERVER
• NET VIEW let you see shares (see AL200)
• NET USE to connect to a share (see lpt4 share)
• NET SHARE shares a resource
• NET START / STOP start /stop network services
  (example)
• NET SEND name message sends a message