NetBIOS

NetBIOS controls the sessions between computers and maintains connections.

There are three methods of mapping NetBIOS names to IP addresses on small networks that don't perform routing:

  1. IP broadcasting - A data packet with the NetBIOS computer name is broadcast when an associated address is not in the local cache. The host who has that name returns its address.
  2. The lmhosts file - This is a file that maps IP addresses and NetBIOS computer names.
  3. NBNS - NetBIOS Name Server. A server that maps NetBIOS names to IP addresses. This service is provided by the nmbd daemon on Linux.

System wide methods of resolving NetBIOS names to IP addresses are:

  • b-node - Broadcast node
  • p-node - Point-to-point node queries an NBNS name server to resolve addresses.
  • m-node - First uses broadcasts, then falls back to querying an NBNS name server.
  • h-node - The system first attempts to query an NBNS name server, then falls back to broadcasts if the nameserver fails. As a last resort, it will look for the lmhosts file locally.

NetBIOS name services use port 137 and NetBIOS session services use port 139. NetBIOS datagram service uses port 138.

To resolve addresses from names, a computer on a Microsoft network will check its cache to see if the address of the computer it wants to connect to is listed there. If not it sends a NetBIOS broadcast requesting the computer with the name to respond with its hardware address. When the address is received, NetBIOS will start a session between the computers. On larger networks that use routers, this is a problem since routers do not forward broadcasts, nor is NetBEUI a routable protocol. Therefore Microsoft implemented another method of resolving names with the Windows Internet Name Service (WINS). The following steps are taken to resolve NetBIOS names to IP addresses for H-node resolution on larger networks using TCP/IP (NBT):

  1. NetBIOS name cache
  2. WINS Server
  3. NetBIOS broadcast
  4. lmhosts file
  5. hosts file
  6. DNS server