Port Numbers for NetBIOS Support

There are three TCP/IP port numbers that support NetBIOS functionality: Port 137 supports the NetBIOS name service; Port 138 supports the NetBIOS datagram service; and Port 139 supports the NetBIOS session service.

Port 137, NetBIOS Name Service

If you followed Exercise 7-1you discovered that the nbname service, which is an abbreviation for NetBIOS name service, accepts information from and sends information to port 137 of the UDP protocol. It is important to note that a port numbered 137 can exist for the TCP protocol too, as you will see for other ports that accept both UDP and TCP packets. We already know that UDP is a connectionless protocol that does not guarantee delivery of information. Why does the NetBIOS name service use UDP and not TCP? To answer this question you need to know specifically what the NetBIOS name server does.

The first thing NetBIOS does when Windows NT boots up is announce the computer’s names to other computers on the network through the NetBIOS Name Service. If the computer is configured to use a NetBIOS name server (such as WINS), the computer gives its NetBIOS names (such as the computer name, domain name, or named services offered) to the name server. If the name server can identify that the names are already in use on the network, then it sends a negative name registration response back to the computer, and NetBIOS fails to initialize. Only the NetBIOS names in conflict will not be registered.

If there is not a name server then the computer broadcasts its NetBIOS names to all computers on the network. Now we will see why the NetBIOS name service uses UDP. The information is broadcast to all computers but it is not known whether any computers will receive the information or not. Computers that are currently turned on will receive the information, but computers that are turned off will not. Any computer that receives the name announcement broadcast with conflicting names that it has already successfully registered with the network will also generate a negative name registration response that informs the announcing computer that it cannot use those names.

Besides name registration the NetBIOS name service also handles and responds to name query requests. Before two computers can communicate over NBT, they need to know each other’s IP address. . TCP/IP will then take the IP address and use the address resolution protocol (ARP) to find out the hardware address encoded on the network interface card (NIC). The NetBIOS name service either sends a broadcast to all computers on the network or queries the name server for the IP address of the computer associated with the name.

In the working world, broadcasting can be a significant detriment to performance of Microsoft networks. Network degradation will increase exponentially if NetBIOS is also running over protocols other than TCP/IP. Suppose COMP1 wants to talk to COMP2 and there is no name server. COMP1 broadcasts a question, "Who is COMP2?" Every computer that uses NetBIOS receives the question on port 137 and passes it to the NetBIOS name service. The computer decides whether it is COMP2 or not. If the computer is COMP2, it responds by telling COMP1 its IP address.

NetBIOS will send three broadcasts trying to find out who COMP2 is. Each broadcast uses some processing power on every computer on the network. If TCP/IP, NWLink IPX/SPX, and NetBEUI are all installed, the broadcast happens one to three times for each protocol for each name query. Multiple protocols greatly increase broadcasting and can be the bane of an uninformed network administrator. The ideal situation is to use TCP/IP and lmhosts or WINS to reduce name query broadcasts.

Port 138, Datagram Service

The NetBIOS datagram service exists on port 138 and as you saw in Exercise 7-1, it uses UDP for communication. Since the datagram service is a connectionless service without guaranteed delivery, we can understand why it uses UDP. The datagram service can send information to one computer name or a group of computers, such as a domain. The most important thing to remember about the datagram service is that the source computer cannot be sure that the destination computer received the message, unless the application program itself checks for delivery.

Port 139, Session Service

The NetBIOS session service exists on port 139. From Exercise 7-1 we know that the session service uses TCP for inter-computer communication. The session service is connection-oriented which means that two-way communication can occur that is guaranteed to have arrived or else an error message is returned. The net use command is an example of an application that uses the session service. This command connects a local drive letter to another computer’s shared network drive.

NetBIOS Host Names

Applications use NetBIOS host names to tell the NetBIOS interface which computer they want to connect to. NetBIOS host names must be unique within an organization. This is a big irritation for many systems administrators who are used to the hierarchical DNS name space. For example, a NetBIOS name could be SERVER1 but a DNS name could be www.companyname.com. NetBIOS will be fully supported in Windows NT 5.0 for legacy systems, but the good news is that Windows NT 5.0 will no longer be dependent on NetBIOS naming. Coming from many generations of NetBIOS-dependent operating systems, this is a huge change in direction for Microsoft and it is being cheered by many systems administrators who had problems with the NetBIOS flat name space.

Please don’t think that NetBIOS names will be gone soon though. There are countless installations of Windows for Workgroups, Windows 95, and Windows NT that still depend on NetBIOS names for file and printer sharing and other domain level activities. Being able to accurately and correctly identify problems with NetBIOS host name resolution is an important skill for systems administrators.

16-Byte Address

NetBIOS names are always 16 bytes. They consist of 15 bytes followed by a special byte that is simply a control character in hexadecimal. For example, when you enter a 10-character computer name, the NetBIOS name registered will be the 10-character computer name suffixed with 5 spaces and the hexadecimal control character. Windows NT will not allow you to enter a computer name that is longer than 15 characters.

15 Characters

The limit for a computer name, domain name, or any other NetBIOS name is 15 characters. What happens to the extra byte in the 16-byte address? The 16^th character is part of the NetBIOS host name and is used by Microsoft to identify which service or application the name belongs to.

1 Hexadecimal Control Character

The 16^th character is actually a one-digit hexadecimal control character. The values can range from <00> to <FF> so the characters are indeed not printable. Exercise 7-2 will give you a detailed look at NetBIOS names that your own computer has registered.

1. First click on Start® Programs® Command Prompt.
2. Run NBTSTAT -a IP address, where the IP address is assigned to the machine you are working on or some other Windows NT machine on the network. You can use NBTSTAT -n to view the local names of the machine you are working at.
3. Note the 15 characters of each NetBIOS host name in printable text and the 16^th character in a hexadecimal format, <00> to <FF>. Also note the type of name registration for each name.
4. You will also see a status entry for each name. If you received no errors during startup, all the names’ status should be registered.
5. The last entry you will see is the MAC or hardware address of your network interface card. This is what TCP/IP uses to communicate with hardware on the local subnet. The hardware address information can also be found with the ipconfig /all command.

Be sure to complete the exercise and feel free to NBTSTAT -a as many different computers as you can. You can’t hurt anything with this command. The following is sample output from running an NBSTAT -a command:

You should at least recognize your computer name, user name, and domain name (if you belong to a domain). Your computer name will probably be associated with at least three NetBIOS names depending on what you have installed with Windows NT. If you are running the Workstation service, you will see a <00> UNIQUE entry beside your computer name and a <00> GROUP by your domain name. GROUP names can be used by many computers but registered UNIQUE names will exist only on your computer within the scope of your network. If you are running the server service, you will see a <20> UNIQUE beside your computer name. If the Messenger service is running, you should see a <03> UNIQUE entry for your computer name and a <03> UNIQUE entry for your username. The net send command appends the hexadecimal character <03> to user and computer names that you are sending messages to.

From the Classroom

Unique Names and Group Names

There are two kinds of NetBIOS names: unique names and group names.

The following chart defines the 16-byte character value for NetBIOS names:

I. Group Names

<1C> Domain Group Name

_MSBROWSE_Domain Master Browser

II. Unique Names

<00> Workstation service name

<03> Messenger service name

<06>RAS server service name

<21>RAS client name

<20>Server service name

<1B>Domain Master Browser

<BE>Network Monitor Agent

<BF>Network Monitor Utility

Another common hexadecimal character is <1C> GROUP, which is appended to the name of the domain or workgroup you belong to, and is used for Master Browser Elections. . If you are running the NBTSTAT -a command in a domain, you will probably see the _MSBROWSE_ <01> GROUP name on a Windows NT Server machine indicating that the server is a master browser. Many of the most common NetBIOS name have to do with browsing. . If you have other applications running that use NetBIOS, you will also see other entries in the name table. Table 7-1 lists all the common NetBIOS names used by Windows NT.

Used by Net Commands

NetBIOS host names are used by all the net commands to carry information from one computer to another. . The commands use the Universal Naming Convention (UNC) syntax to specify which computer and resource to access. The syntax for UNC names is \\Servername\Sharename where Servername is the computer name of the server to connect to and Sharename is the name assigned to the shared resource on the server. . UNC names can also include directories and file paths in the following format: \\Servername\Sharename\Directoryname\Filename. . The Servername used is a NetBIOS host name to which the net commands append the appropriate hex character, in this case <20> to connect to the Server service. For a list of Net commands, enter NET HELP at a command prompt. . For further help on any command enter NET COMMAND HELP at a command prompt where COMMAND is the name of the command you want more information on. Figure 7-2 shows part of the indexed lst available on Windows NT commands. It can be found in Start® Help® Contents® Windows NT Commands® Windows NT Commands.

Net Use

Net Use is by far the most useful net command, pun intended. . You can use it to connect drive letters and printer ports to remote shares and printers. You can even use it to establish permission in the same way you use the Connect As textbox when using My Computer® Map Network Drive. . When you want to write a login script, you can employ net use to delete some or all of your clients’ manual drive mappings and replace them with standard drive mappings for your organization. No more getting confused as to whose S drive is someone else’s N drive.

Sample output from a net use command follows this paragraph. Notice that drive J: is connected to a file share and LPT3 is connected to a shared printer. A disconnected status simply means that the connection has not been used recently and is in a disconnected state. . Windows NT will automatically reconnect the remote share whenever the share is accessed. The IPC$ is one of the Windows NT default shares. . This one in particular is for interprocess communication. You can map to it using the net use command with a username and password to establish a Connect As connection.

Net

The other net commands are listed in Table 7-2. They all use UNC to access remote computer resources. The server name in the UNC syntax is always a NetBIOS name, so the net commands that work remotely all use the 16-byte NetBIOS host name to communicate with other computers.

Used by NetBIOS Commands

The 16-byte NetBIOS host names are used by any application that uses NetBIOS communication. Whether the application is a database, game, or chat, they all have to use 16-byte NetBIOS host names to communicate.

NetBIOS Functional Processes

In this section we discuss the three NetBIOS functional processes: Name Registration, Name Discovery, and Name Release. These functional processes are run for NetBIOS no matter which transport protocol it is running over. However, we will focus only on the functional processes from a NetBIOS over TCP/IP standpoint because that’s what is on the exam..

Name Registration

When you first boot up a Windows NT computer from a powered-off state, you see the familiar message, "Press Ctrl + Alt + Delete to log on," which means the network services are still starting in the background. The first functional process NetBIOS runs is Name Registration. To accomplish this process the computer sends a message, called a NetBIOS name registration request, to the network. If the computer is set up to register with a NetBIOS name server (NBNS), the message is sent directly to the name server. This is called a directed packet; it is not a broadcast, and therefore only one receiving computer, the name server, needs to process the information. All other computers discard the message as soon as it hits the network card and they recognize that the hardware address does not belong to them. If the computer is not set up to register with a name server then it broadcasts the message to all computers on the local subnet using the UDP protocol.

For group names, like a domain or workgroup name that multiple computers belong to, the NetBIOS name registration request is never challenged. NetBIOS name registration requests will be challenged if requested unique names, like a computer name, are already being used somewhere on the network.

If the name registration request is broadcast to the network and another computer is already using the NetBIOS name, then a negative name registration response message will be returned to the source computer informing it that it cannot register those NetBIOS names. Depending on which names are unusable, the computer may not initialize NetBIOS, start the Messenger service, or some other functionality or application may be inhibited. Always check Start® Programs® Administrative Tools® Event Viewer to check out any error messages you receive during logon. Positive name registration responses are not returned to the source computer during broadcast registration requests since no one computer is acting as a keeper of all the addresses.

If the name registration request is sent to a WINS server that already has the NetBIOS name in its database, the WINS server will not automatically send back a negative response. First, the WINS server will check to see if the IP address registered in the database is the same as the one in the request. If the IP addresses are the same, then it is just the same computer having been powered off without shutting down. If the IP addresses are not the same then the WINS server must check to see whether the computer associated with the conflicting names is still on. The WINS server challenges the registered host to defend its right to keep the conflicting names. If the registered host responds, it wins the challenge and WINS sends a negative name registration response back to the requesting computer. If the registered host does not respond, then WINS sends back a positive name registration response and the original computer will keep on trucking.

Broadcast or WINS

If you leave Windows NT set at its defaults, it will choose WINS over broadcasting if you have WINS enabled. If WINS is unable to register an address, NT will use broadcast registration. As far as performance for the Name Registration functional process goes, there is not a big difference, although it is generally better to use WINS, especially on larger networks. Once all the computers have registered their names on the network for the day, the broadcast traffic is over. During rush hours, like morning or after lunch, you may see some network degradation from broadcasts but it will be slight. The same applies to a WINS server trying to handle name registrations. You need to make sure that the server has enough horsepower during the rush hours, but once the rush hours are over name registration traffic should be minimal. If I had to pick one method, I would favor WINS for performance since broadcasts steal processing power from every computer on the network. Chapter 8 covers WINS in more detail.

Name Discovery

Name Discovery is actually very similar to Name Registration.. NetBIOS host name resolution for NetBIOS over TCP/IP simply means translating a given name into an IP address. Name Discovery is really only part of the puzzle since everything will fall apart if Name Registration or Name Release go haywire. .

First, NetBIOS will consult the NetBIOS name cache to see if the name has been resolved recently. This saves the network from a whole lot of useless broadcasts. If the name needed is not in the name cache, the computer, if registered with WINS, will send a directed packet to the WINS server trying to resolve the name. If the name is not found in the WINS server database, the computer will broadcast to the local network up to three times trying to get the destination computer to respond. If the broadcasts fail, it will scan the lmhosts database text file line by line looking for a match. If the lmhosts file does not contain the name, it will try the hosts file and finally a DNS query. You can easily configure the computer to query or not query WINS, lmhosts, hosts, and DNS through the Network Control Panel applet. Go to Start® Settings® Control Panel® Network® Protocols® TCP/IP Protocol® Properties® WINS Address and you should see a dialog box like the one shown in Figure 7-3.

Figure 7-3 shows the dialog box to register a client computer with WINS. If the primary WINS server does not respond during name registration, the computer will try using the secondary WINS server. If the secondary WINS server also fails to respond, the computer will then broadcast name registration.

If you enable DNS for Windows Resolution, the Name Discovery functional process will also try to look in the hosts file and DNS server to find the NetBIOS name. I suggest not enabling DNS for Windows Resolution because it will slow down the Name Discovery process and NetBIOS names should not be stored in the hosts file or DNS anyway. If you enter a name like www.server.com, NT automatically recognizes the Fully Qualified Domain Name (FQDN) syntax and runs a DNS and host file query first.

If you enable LMHOSTS Lookup, the Name Registration will first scan the lmhosts files for entries to preload into the NetBIOS name cache. During the Name Discovery phase, the lmhosts file will be scanned after everything else has failed but before any host file or DNS lookup. The Enable LMHOSTS Lookup box needs to be checked even if all you have in you lmhosts file are name mappings to be loaded into the NetBIOS name cache.

The Scope ID box should always remain blank. Only computers that have the same word for their Scope ID can communicate with each other. It is one way to establish weak security and also cause yourself a lot of connectivity problems. If you need security, it’s better to use username, passwords, and NTFS.

Broadcast or WINS

Broadcasting for Name Discovery is good only if you have a small computer network. NetBIOS was originally designed for small networks. Networks of 25 or fewer users would not want the hassles of setting up and maintaining a name server since broadcasting is automatic. For larger networks, broadcasting will multiply the network and processing load with each computer that is added to the network. Take some good advice and use WINS if at all possible. If your computers are also using DHCP for dynamic configuration, you can set the scope options to automatically point every DHCP client to your WINS server.

Name Release

The last NetBIOS functional process is Name Release, and it really is very simple. If the computer is registered with WINS, it informs WINS while shutting down that it will no longer need the names it registered. If the computer it not registered with WINS, it sends a broadcast to inform the network of the released names.

Broadcast or WINS

One of the challenges WINS faces is maintaining the database when users turn off the power switch instead of properly shutting down. If the power switch is hit, then the Name Release process does not happen and the names are still registered with WINS. This is why WINS has to challenge the registered name owner when a name request turns up conflicting names in the database. If this challenge did not occur, the WINS database would fill up with names and names could never be reused. This is not a problem since Name Release plays such a small part in the overall network load generated by NetBIOS. For large networks WINS is still far better than broadcasting even in the Name Release process simply because it involves only a few computers communicating. You have to use WINS if your network spans different subnets because broadcasts will not be forwarded by routers.

NetBIOS Over TCP/IP

We’ve talked a lot about NetBIOS over TCP/IP (NBT) and hopefully you now have a good idea of what it is all about. This section will cover even more technical details and specifications about NBT.

To define NetBIOS over TCP/IP, you could say that it is a network component that performs computer name to IP mapping. Or you could say it is the quarterback that takes a NetBIOS name, turns it into an IP address, and hands it off to TCP/IP to run with it. That is the primary function of NBT. NetBIOS is the interface to the applications; TCP/IP is the transport protocol that carries the information from one computer to another; and NBT is the glue in between. NetBIOS uses 16-byte names; TCP/IP uses 32-bit addresses; and NBT is the translator.

Node Types

RFC1001 and RFC1002 define three ways NBT can work: b-node, p-node, and m-node. It took me a while to figure out that node was not actually mode, so I’ll just give you that little piece of information. A node is basically a computer, and b-node, p-node, and m-node describe how the NBT functional processes work for that computer (node). Microsoft has added a few more methods into the list, namely, enhanced b-node and h-node. A Windows NT computer will use enhanced b-node by default unless it is configured to register with a WINS server, in which case it uses h-node. All these methods determine whether the computer uses, and in which order, the NetBIOS name cache, WINS, broadcasts, lmhosts, hosts, and DNS for NetBIOS host name resolution.

b-Node (The Broadcast Method)

The b-node method uses NetBIOS name registration request broadcasts for Name Registration and NetBIOS name query broadcasts for Name Discovery. To enable this method starting from a Microsoft default installation that is not WINS enabled, simply disable LMHOSTS Lookup.

Broadcast

The NetBIOS name cache helps reduce repetitious broadcasting by caching resolved names and their associated IP addresses for a certain small length of time. A name is by default placed on the NetBIOS name cache for ten minutes if it is used again within two minutes after being placed in cache. If not used a second time within two minutes it is removed at the end of two minutes.

Of course by now you know that this method is not recommended for large networks. Relying solely on broadcasts for name resolution and registration on networks with a large amount of nodes (computers) can cause significant network traffic congestion for all computers. The b-node method also limits name resolution and registration to one subnet unless you have special routers that are configured to pass along the b-node NetBIOS broadcasts to the next subnet.

Microsoft Modified b-Node

If Windows NT is not configured to register with WINS, then the modified b-node method is the default configuration when networking is set up. This method is similar to the b-node method except it uses the lmhosts file to preload name to IP address mappings into the NetBIOS name cache and also as a database for looking up names that could not be resolved by broadcasting.

NetBIOS Name Cache

You will see the lmhosts file syntax in the next section. What you need to know about the modified b-node method is that it searches the lmhosts file when the computer starts up for entries marked with #PRE. These entries are then loaded into the NetBIOS name cache and will never expire. The NetBIOS name cache is the first place NBT will look when resolving names. Putting commonly used computer names (like the servers) into the NetBIOS name cache can speed up network responsiveness. You can force NBT to reload the name cache with the NBTSTAT -R command. The -R command switch is case sensitive.

Broadcasting

Like the b-node method, the primary method for resolving names is to do a NetBIOS name query broadcast and hope the computer responds. The enhanced b-node method is no more efficient than b-node if you do not use name cache preloading.

LMHOSTS file

The lmhosts database file is found in the %SystemRoot%\system32\drivers\etc directory. You should not just add lines to the sample file Microsoft provides; instead start with a blank file since NT scans the file line by line each time resolving a name by broadcasting fails. Maintaining the lmhosts file can become an administrative chore because the static entries need to be changed with every new computer added or removed from the network. Also, it is a lot of trouble distributing and maintaining the files on every machine on the network.

1. On a Windows NT computer start notepad by going to Start® Programs® Accessories® Notepad.
2. Type the following line. Feel free to change the IP address or server name.

3. Now save the file in %SystemRoot\system32\drivers\etc as lmhosts.
4. Now start a command prompt by going to Start® Programs® Command Prompt.
5. Enter the command ping SERVER1.
6. You should see NT trying to ping the IP address you entered in the LMHOSTS file for SERVER1. For the purposes of this exercise it does not matter whether the ping is successful or not. Once you see NT trying to ping, you know that NetBIOS successfully resolved the name into an IP address.

p-Node (The Peer to Peer Method)

The p-node method can be enabled only by editing the registry or setting the scope option dynamically from DHCP enabled computers. When Microsoft makes you edit the registry, it’s a big hint that it is usually not preferable to use this method. In the p-node method broadcasts are never sent. Only a NetBIOS name server is used, or in other words, a WINS server. This works fine until there is a problem with the name server, then no names can be resolved. The h-node method has a better level of fault tolerance since it falls back on broadcasts if WINS resolution fails.

Name Server Registration Only

This method could potentially speed up an h-node network somewhat, especially for Name Resolution failures. Since broadcasts are never sent, the error message would return quicker. If we expected more failures than success we would want to use this method, but of course we expect most name queries to succeed one way or another. That is why the h-node method is better because names can also be resolved by trying broadcasts (which adds some fault tolerance) instead of just quickly returning the error message.

m-Node (The Mixed Node Method)

The m-node method first tries to use broadcasts for name resolution; then once the broadcasts time out, it will send the query directly to the NetBIOS name server (WINS). You would think the RFC documents would have defined this method to reduce broadcasts but unfortunately they did not.

Mixed Node

The m-node method really stands for mixed node method. This is because it combines both the b-node and p-node methods into one. What is important here is the order in which the RFC documents define which method happens first.

Uses b-Node, Then p-Node

The m-node method is called the mixed node method because it first tries to use the b-node method (broadcasts), then uses the p-node method (directed name server query) for name resolution. This is exactly opposite of the way it should be for reducing broadcasts for performance reasons. That is why Microsoft invented the h-node method, which is really just the exact opposite of the m-node method.

h-Node (The Hybrid Node Method)

The h-node method is a combination of the p-node and b-node methods. The h-node method specifies that the p-node method (directed name server query) be used first and if that fails the b-node method (broadcasts) will be tried. If every computer on your network registers with the WINS name server, then this method will never produce a single NetBIOS broadcast (wow!). It is better than the p-node method because it will try broadcasts as a backup pending the failure of the name server to resolve the name.

Hybrid Node

The h-node method is called the hybrid node method but. . I might have named it something like "Name Server, then Broadcast method" since that is the most important point to remember. Broadcast is used only if the name server query fails.

Name Resolution Methods

Well, now that you have made it past nodes, modes, and methods, you can get into what is really important: what you need to know for the exam and also for the real world. In the next two sections, we discuss the standard name resolution method used by other NetBIOS equipped operating systems and applications and the default Microsoft name resolution method. Some of the Microsoft specific steps may be enabled or disabled by configuring TCP/IP with the Network Control Panel applet.