70-240 in 15 minutes a week: Windows 2000 WINS

Download the authoritative guide: Data Center Guide: Optimizing Your Data Center Strategy

Download the authoritative guide: Cloud Computing: Using the Cloud for Competitive Advantage

by Dan DiNicolo
http://www.2000trainers.com Article 21 in Dan DiNicolo's 70-240 in 15 minutes a week series covers the Windows Internet Naming Service (WINS) in Windows 2000. This includes a look at NetBIOS name resolution, node types, WINS replication settings, client configuration, as well as features and functions.

Welcome to article number 21 in my 70-240 in 15 minutes a week series. This week's article covers the Windows Internet Naming Service (WINS) in Windows 2000. This includes a look at NetBIOS name resolution, node types, WINS replication settings, client configuration, as well as features and functions. This article again falls into the Networking services portion of the series.

The material to be covered in this article includes:

- NetBIOS name resolution in Windows 2000.
- WINS Registration
- WINS replication
- Configuring WINS clients
- WINS features and functions

NetBIOS Name Resolution in Windows 2000

Many people assume that NetBIOS name resolution is no longer necessary in Windows 2000 due to the heightened importance of DNS as the primary name resolution facility in the OS. Although Microsoft is certainly moving away from a reliance on NetBIOS as a network protocol, you simply cannot ignore the fact that programs exist that rely on NetBIOS. Yes, Windows 2000 does support resolving NetBIOS names in a variety of ways, including the use of DNS and related hostname-resolution techniques, but this is not necessarily efficient. Since so many products still use NetBIOS as their primary protocol, and since so many networks now run TCP/IP, it is still a good idea to run WINS on the network. If nothing else, it is impractical not to have it for the purpose of supporting downlevel clients such as Windows NT and Windows 98, who complete many important processes (such as logon) via NetBIOS.

A NetBIOS name is a 16-byte address that uniquely identifies a host on the network. This address is 15 characters long, with a 16th character that uniquely identifies a service that the system is running, such as the Server or Workstation services. A NetBIOS name is often referred to as a Computer name, although the line is blurring as Windows 2000 moves to a more integrated support of TCP/IP and DNS naming. Don't forget that the purpose of WINS is mainly to resolve NetBIOS names to IP addresses. In the past, NetBIOS was the primary communication protocol used on Microsoft networks. The move to TCP/IP as the primary transport of choice has necessitated the ability to map NetBIOS names to IP addresses, and the ability to 'piggyback' NetBIOS over TCP/IP. However, WINS is not the only way to resolve these names to IP addresses. The official NetBIOS name resolution techniques in Windows 2000 include:

Local Broadcast - In this traditional method, a host will broadcast onto the local subnet trying to find the IP address associated with a given name. Obviously this method is restrictive, since it is limited in terms of reach on the network (as well as being inefficient)

NetBIOS Name Server - In most networks, a NetBIOS name server (such as WINS) is set up to handle name registration and queries directly. Clients systems (and servers) register their NetBIOS name to IP address mapping with WINS. When queried by a client, the NetBIOS name server replies with the requested IP address associated with the requested name. 

NetBIOS Name Cache - Upon resolving a NetBIOS name to an IP address, the client stores this information in its NetBIOS name cache. By default, entries remain in cache for 600 seconds, and the cache holds only 16 names (configurable via the Registry). This makes the network more efficient, in that a client does not need to contact the network for every name resolution request. The reason for the low timeout is the fact that IP addresses may change due to the use of DHCP on the network. To view the NetBIOS name cache, use the nbtstat -c command.

LMHOSTS - This text file products a static way of mappings host names to IP addresses. A deeper look at LMHOSTS files follows later in this section.

The method that a client system will use to resolve NetBIOS names to IP addresses relies on what is referred to as its node type. Microsoft supports 4 main node types, and these control the order in which resolution attempts will take place. By default, a system not configured with a WINS server address will be configured for B-node, and with a WINS server address will be configured for H-node. Most often, node type is configured as a DHCP option, but it can also be configured on individual systems via a Registry change. The 4 main node types are listed below. Note that a client system always checks the NetBIOS name cache first. The Hex values of the node types are listed for the purpose of registry modification. To find out which node type a client is using, run ipconfig /all

B-node (Broadcast) - this method uses a broadcast to resolve names. In Microsoft land, this is actually called 'enhanced B-node', since if the broadcast fails, the client will attempt resolution via the LMHOSTS file. Value is 0x1. 

H-node (Hybrid) - this method first tries resolving the name via a WINS server, and then attempts B-node methods if unsuccessful. Value is 0x8

M-node (Mixed) - this method first attempts to resolve names via broadcast, followed by an attempt at querying a WINS server should that fail. This is often used in environments where a WINS server is across a WAN link. Value is 0x4

P-node (Peer-to-peer) - this method uses a WINS server for resolution, and never broadcasts. Value is 0x2


The LMHOSTS file is far from the most efficient solution to NetBIOS name resolution, but is of use in environments without WINS. Created on the same principal as the hostname-resolving HOSTS file, the LMHOSTS file is a plain text file that contains NetBIOS names in one column, followed by IP addresses in the other. A client can consult this file in trying to resolve a name to an address. Because the use of this file is associated with Microsoft B-node, it only makes sense to put mappings for remote hosts in this file - local hosts will always be found by the broadcast that happens prior to LMHOSTS consultation. By default, the LMHOSTS file can be found in the %systemroot%\system32\drivers\etc directory. You should also have an awareness of the optional tags that can be used with the file, as these provide additional functionality, as outlined below. Also note that you should place the most commonly used entries at the top of the LMHOSTS file, since the file is parsed from top to bottom.

Useful LMHOSTS file tags

#PRE - Entries marked with the #PRE tag are pre-loaded into the NetBIOS name cache.
#DOM:<domainname> - these entries designate domain controllers
#INCLUDE <path> - this entry marks the path to a centralized LMHOSTS file on the network. This can be a useful alternative to WINS (though still a great deal of work), but remember that the NetBIOS name-to-address mapping of the host with the centralized file must also be included in this LMHOSTS file.
#MH - this entry designates that multiple entries exist for a name since the system is multihomed (has multiple network interfaces)

Note that Windows 2000 will use the LMHOSTS file by default, but this can be changed via the WINS tab in your Advanced TCP/IP settings. Consult the screen shot of the WINS tab later in the article to see the checkbox.

WINS Registration

Note that WINS is not installed on a Windows 2000 Server by default - you will need to add the service by accessing Windows Components via Add/Remove programs in Control Panel. As was the case in NT 4, systems configured to use WINS will register their NetBIOS name to IP address mapping when they start up. The actual process consists of a name registration, with a client renewing the registration once half the TTL (time to live assigned by the WINS server) for the registration has expired. If the name a client attempts to register is already in the database, the WINS server sends a challenge to the host who has the name registered to see whether the host is active. If not, the name registration will succeed. If the other client is active, the registration will fail since machine must have unique NetBIOS names. In the same way, a client will 'unregister' itself in WINS upon a proper shutdown. Note that when this happens, the entry is not immediately removed from the WINS database - instead, the entry is 'tombstoned' and marked for extinction, a process that allows the name release to be replicated to other WINS servers. Ultimately, the record is removed from WINS once the extinction timeout period has passed.

One of the more welcome features in Windows 2000 is the ability to change your IP address without a reboot. After doing so, you should ensure that you also reregister your name registration in WINS - a process accomplished by issuing the nbtstat -RR command.

This article was originally published on Aug 27, 2001
Page 1 of 3

Thanks for your registration, follow us on our social networks to keep up-to-date