Inside a NetBIOS Name Resolution

A step-by-step look at the process

If you've been following the past few columns, you know that all the basicWindows NT client tools--Network Neighborhood, NET USE, NET VIEW, and thelike--use name resolution to convert a server name, such as SNOOPY, to an IPaddress, such as 201.33.19.31. You also know that NT (and, for that matter,Windows 95 and Windows for Workgroups--WFW) does NetBIOS name resolution in oneof several ways: It can broadcast, use an LMHOSTS file, or look up a name inWindows Internet Name Service (WINS).

But is that the whole story? If information between, say, LMHOSTS and WINSconflicts, who wins (no pun intended)? This month, I'll discuss the sequence ofevents in a NetBIOS name resolution.

You can approach NetBIOS name resolution in one of four ways: Clientsoftware can be B (broadcast) node, P (point-to-point) node, M (mixed) node, orH (hybrid) node. A computer doing B-node name resolution relies on broadcasts toconvert names into IP addresses. A computer doing P-node name resolution uses aNetBIOS name server to look up NetBIOS names and get IP addresses. An M-nodecomputer first tries a broadcast to resolve a name; if that attempt fails, thecomputer looks up the name in a NetBIOS name server. In other words, an M-nodecomputer first acts as a B-node, and if that fails, tries to act as a P node.Finally, an H-node computer first does a P-node lookup, if that fails, thecomputer does broadcasts.

Are your PCs in B, P, M, or H node? You control how your PC does NetBIOSname resolution with three settings: First, specify a WINS server; second,enable or disable Enable DNS for Windows Resolution; and finally, enable ordisable Enable LMHOSTS Lookup. If you use WINS on your network (if you don't,start using WINS today), your client computers are probably set up as H-nodecomputers. If you do not specify a WINS server in TCP/IP setup, your computeracts as a simple B-node computer. You can force a PC to be B, P, M, or H viaDynamic Host Configuration Protocol (DHCP), if the computer gets its IP addressfrom a DHCP server. One of the TCP/IP settings that you can control via DHCP isWINS/NetBT node type, which can have values 1, 2, 4, or 8. To set the computerto be a B-node machine, set the value to 1. Values 2 and 4 set the computer to Pand M node, respectively, and 8 (the correct value for most of us) sets the nodeto H.

Suppose, however, that you've specified a WINS server and told TCP/IP touse LMHOSTS and DNS for name resolutions. To resolve a name, your PC will followthis sequence: NetBIOS name cache, WINS, broadcast, LMHOSTS, HOSTS, and DomainName System (DNS).

The first place your PC looks to resolve a name is the preloaded NetBIOSname cache. These names come from entries in your LMHOSTS file (assuming you'veenabled LMHOSTS) that include the metacommand #PRE. For example, if

201.33.19.31 snoopy #PRE

is in LMHOSTS, the PC will identify SNOOPY as 201.33.19.31, without lookingat any other source of information. That'll drive you crazy if you're notcareful, believe me. One day, you put an entry into LMHOSTS just to patch aproblem, and then you forget that you've done it. Months later, you can't get toserver SNOOPY from one computer, but all the other computers can access itwithout trouble. They all point to the same WINS server, so what could be wrong?After an hour or two of banging your head against the wall, you remember theLMHOSTS file.

If you specify WINS, your PC will try that next. You can specify a primaryand a secondary WINS server, so your PC tries the primary first, and if itdoesn't respond or can't satisfy the request, the PC tries the secondary WINSserver. If either one of those name resolution attempts succeeds, the nameresolution process stops--the next steps never occur.

If WINS fails, the PC will broadcast, "Does anyone within shoutingdistance have NetBIOS name SNOOPY?" which is standard B-node behavior.Interestingly, though the PC does three broadcasts, each about 0.7 secondsapart.

Next, the PC looks at the setting for Enable LMHOSTS Lookup. If the settingis selected, the PC looks in the LMHOSTS file. The PC already knows about the#PRE entries, but this file is where the PC uses standard entries. If LMHOSTShas the answer, the PC stops trying to resolve the name. By the way, LMHOSTSappears to be enabled for Win95; I haven't found a setting to disable LMHOSTS.On WFW or Win95, the LMHOSTS file goes in the c:windows directory; on an NTWorkstation or NT Server, it goes in the improbable location ofwinntsystem32driversetc. And to make LMHOSTS work more quickly, do not putany comments in the file because doing so slows the resolution downsignificantly.

Of course, the name resolution system for most of the Internet is DNS.DNS's job is to resolve names for Winsock-based applications; for example, ifyou point your Web browser to http://www.mmco.com, the browser, which is aWinsock-based application, will rely on DNS to convert the name www.mmco.com tothe IP address 199.34.57.50. To also use DNS as a NetBIOS name resolver, selectthe check box, Use DNS for Windows Resolution.

The Microsoft TCP/IP code that activates DNS apparently also activates theold-style HOSTS files. I say apparently because the HOSTS file is the next placeyour PC will search to resolve a NetBIOS name. The HOSTS file must be in thesame place as the LMHOSTS file, and it, too, is a source of occasionalconfusion. Include "Check for HOSTS and LMHOSTS" on yourtroubleshooting checklist.

If you've made it this far (the NetBIOS name cache, WINS, three broadcasts,the LMHOSTS file, and the HOSTS file have not been able to resolve the name)your computer will do a DNS lookup (again, only if you've selected the check boxin the TCP/IP settings). Actually, your PC will do two DNS lookups. First, itlooks up the name--SNOOPY, but in general, DNS stores names in fully-qualifiednames, like snoopy.mmco.com. So DNS first looks for an entry SNOOPY and, if thatfails, tacks the domain name onto the end of the NetBIOS name and does a DNSlookup on that name--snoopy.mmco.com, in this example.

What if all these procedures fail to resolve the NetBIOS name? Then, oddlyenough, the machine goes back and does the whole routine all over again. Yoursystem compensates for temporary failures. Maybe the WINS server was down for afew minutes or a network connection was unavailable at the time. Have you everwondered why Microsoft networking software takes so long to timeout? Assumingyou don't have a server named SNOOPY on your system, try typing

net view \snoopy

and see how long it takes to timeout and give you "The network name wasnot found," error message. And for even longer waiting times, try thatcommand on a system with TCP/IP, IPX, NetBEUI, and Data Link Control (DLC)loaded.

Clarification Note
In November, I said that you can use DNS names in the same places you useNetBIOS names, meaning that with NT 4.0, you can type netview\orion01.mmco.com a NetBIOS command, but a DNS name. I also said that you can do thatwith NT 4.0 and Win95, if you have Win95 Service Pack 2 (SP2). Some of you wroteasking where to find SP2. I didn't mean to imply that Win95 SP2 exists, onlythat Microsoft has said they'll include this feature with SP2 when they ship it.

The MCSE review project I mentioned in February is perking along nicely.Check my Web site http://www.mmco.com for new databases, and add aquestion of your own!