Inside a NetBIOS Name Resolution

If you've been following the past few columns, you know that all the basic Windows NT client tools--Network Neighborhood, NET USE, NET VIEW, and the like--use name resolution to convert a server name, such as SNOOPY, to an IP address, such as 201.33.19.31. You also know that NT (and, for that matter, Windows 95 and Windows for Workgroups--WFW) does NetBIOS name resolution in one of several ways: It can broadcast, use an LMHOSTS file, or look up a name in Windows Internet Name Service (WINS).

But is that the whole story? If information between, say, LMHOSTS and WINS conflicts, who wins (no pun intended)? This month, I'll discuss the sequence of events in a NetBIOS name resolution.

You can approach NetBIOS name resolution in one of four ways: Client software can be B (broadcast) node, P (point-to-point) node, M (mixed) node, or H (hybrid) node. A computer doing B-node name resolution relies on broadcasts to convert names into IP addresses. A computer doing P-node name resolution uses a NetBIOS name server to look up NetBIOS names and get IP addresses. An M-node computer first tries a broadcast to resolve a name; if that attempt fails, the computer looks up the name in a NetBIOS name server. In other words, an M-node computer first acts as a B-node, and if that fails, tries to act as a P node. Finally, an H-node computer first does a P-node lookup, if that fails, the computer does broadcasts.

Are your PCs in B, P, M, or H node? You control how your PC does NetBIOS name resolution with three settings: First, specify a WINS server; second, enable or disable Enable DNS for Windows Resolution; and finally, enable or disable Enable LMHOSTS Lookup. If you use WINS on your network (if you don't, start using WINS today), your client computers are probably set up as H-node computers. If you do not specify a WINS server in TCP/IP setup, your computer acts as a simple B-node computer. You can force a PC to be B, P, M, or H via Dynamic Host Configuration Protocol (DHCP), if the computer gets its IP address from a DHCP server. One of the TCP/IP settings that you can control via DHCP is WINS/NetBT node type, which can have values 1, 2, 4, or 8. To set the computer to be a B-node machine, set the value to 1. Values 2 and 4 set the computer to P and M node, respectively, and 8 (the correct value for most of us) sets the node to H.

Suppose, however, that you've specified a WINS server and told TCP/IP to use LMHOSTS and DNS for name resolutions. To resolve a name, your PC will follow this sequence: NetBIOS name cache, WINS, broadcast, LMHOSTS, HOSTS, and Domain Name System (DNS).

The first place your PC looks to resolve a name is the preloaded NetBIOS name cache. These names come from entries in your LMHOSTS file (assuming you've enabled LMHOSTS) that include the metacommand #PRE. For example, if

201.33.19.31 snoopy #PRE

is in LMHOSTS, the PC will identify SNOOPY as 201.33.19.31, without looking at any other source of information. That'll drive you crazy if you're not careful, believe me. One day, you put an entry into LMHOSTS just to patch a problem, and then you forget that you've done it. Months later, you can't get to server SNOOPY from one computer, but all the other computers can access it without trouble. They all point to the same WINS server, so what could be wrong? After an hour or two of banging your head against the wall, you remember the LMHOSTS file.

If you specify WINS, your PC will try that next. You can specify a primary and a secondary WINS server, so your PC tries the primary first, and if it doesn't respond or can't satisfy the request, the PC tries the secondary WINS server. If either one of those name resolution attempts succeeds, the name resolution process stops--the next steps never occur.

If WINS fails, the PC will broadcast, "Does anyone within shouting distance have NetBIOS name SNOOPY?" which is standard B-node behavior. Interestingly, though the PC does three broadcasts, each about 0.7 seconds apart.

Next, the PC looks at the setting for Enable LMHOSTS Lookup. If the setting is selected, the PC looks in the LMHOSTS file. The PC already knows about the #PRE entries, but this file is where the PC uses standard entries. If LMHOSTS has the answer, the PC stops trying to resolve the name. By the way, LMHOSTS appears to be enabled for Win95; I haven't found a setting to disable LMHOSTS. On WFW or Win95, the LMHOSTS file goes in the c:\windows directory; on an NT Workstation or NT Server, it goes in the improbable location of \winnt\system32\drivers\etc. And to make LMHOSTS work more quickly, do not put any comments in the file because doing so slows the resolution down significantly.

Of course, the name resolution system for most of the Internet is DNS. DNS's job is to resolve names for Winsock-based applications; for example, if you point your Web browser to http://www.mmco.com, the browser, which is a Winsock-based application, will rely on DNS to convert the name www.mmco.com to the IP address 199.34.57.50. To also use DNS as a NetBIOS name resolver, select the check box, Use DNS for Windows Resolution.

The Microsoft TCP/IP code that activates DNS apparently also activates the old-style HOSTS files. I say apparently because the HOSTS file is the next place your PC will search to resolve a NetBIOS name. The HOSTS file must be in the same place as the LMHOSTS file, and it, too, is a source of occasional confusion. Include "Check for HOSTS and LMHOSTS" on your troubleshooting checklist.

If you've made it this far (the NetBIOS name cache, WINS, three broadcasts, the LMHOSTS file, and the HOSTS file have not been able to resolve the name) your computer will do a DNS lookup (again, only if you've selected the check box in the TCP/IP settings). Actually, your PC will do two DNS lookups. First, it looks up the name--SNOOPY, but in general, DNS stores names in fully-qualified names, like snoopy.mmco.com. So DNS first looks for an entry SNOOPY and, if that fails, tacks the domain name onto the end of the NetBIOS name and does a DNS lookup on that name--snoopy.mmco.com, in this example.

What if all these procedures fail to resolve the NetBIOS name? Then, oddly enough, the machine goes back and does the whole routine all over again. Your system compensates for temporary failures. Maybe the WINS server was down for a few minutes or a network connection was unavailable at the time. Have you ever wondered why Microsoft networking software takes so long to timeout? Assuming you don't have a server named SNOOPY on your system, try typing

net view \\snoopy

and see how long it takes to timeout and give you "The network name was not found," error message. And for even longer waiting times, try that command on a system with TCP/IP, IPX, NetBEUI, and Data Link Control (DLC) loaded.

Clarification Note
In November, I said that you can use DNS names in the same places you use NetBIOS names, meaning that with NT 4.0, you can type netview\\orion01.mmco.com a NetBIOS command, but a DNS name. I also said that you can do that with NT 4.0 and Win95, if you have Win95 Service Pack 2 (SP2). Some of you wrote asking where to find SP2. I didn't mean to imply that Win95 SP2 exists, only that Microsoft has said they'll include this feature with SP2 when they ship it.

The MCSE review project I mentioned in February is perking along nicely. Check my Web site http://www.mmco.com for new databases, and add a question of your own!