NetBIOS over TCP/IP Name Resolution and WINS

This article was previously published under Q119493
This article has been archived. It is offered "as is" and will no longer be updated.
NetBIOS over TCP/IP is the network component that performs computer name toIP address mapping, name resolution (NETBT.SYS in Windows NT and VNBT.VXDin Windows for Worgroups and Windows 95). There are currently four NetBIOSover TCP/IP name resolution methods: b-node, p-node, m-nodeand h-node.


When using b-node, broadcasts are used for both name registration and nameresolution. On a TCP/IP network, if the IP router is not configured toforward the name registration and name query broadcasts, systems ondifferent subnets will not be able to see each other since they will notreceive the broadcasts. B-node name resolution is not the best option onlarger networks because its reliance on broadcasts can load the networkwith broadcasts.

Microsoft Modified B-Node

The TCP/IP used in Microsoft Windows NT uses a modified version of b-nodename resolution. Microsoft modified b-node name resolution works in thefollowing manner:

  • The workstation first checks the LMHOSTS cache and, if it finds the NetBIOS name, returns the IP address.
  • Next, the workstation tries broadcasting to resolve the name (this works in the same manner as b-node resolution) and, if the destination system is active, it returns its IP address.
  • Finally, the workstation (if it is a Windows NT system) will check the LMHOSTS file in the \<winnt_root>\system32\drivers\etc directory

P-Node (or Point to Point Node)

When using p-node name resolution, broadcasts are NOT used for nameregistration or name resolution. Instead, all systems register themselveswith a NetBIOS Name Server (NBNS) upon start up. The NBNS is responsiblefor mapping computer names to IP addresses and making sure that noduplicate names are registered on the network. All systems must know the IPaddress of the NBNS, which is equivalent to a WINS Server. If the systemsare not configured with the correct IP address for the NBNS, p-node nameresolution will not work.

The p-node name resolution method uses directed User Datagram Protocol(UDP) datagrams and TCP sessions for its communication to and from theNBNS.

The main drawback of p-node name resolution is that if the NBNS cannot beaccessed, there will be no way to resolve names and thus no way to accessother systems on the network.

M-Node (or Mixed Node)

M-node uses a combination of b-node and p-node for name resolution. Thismethod first uses b-node and then p-node, which in theory should increaselocal area network (LAN) performance. M-Node has the advantage over p-nodein that if the NBNS is unavailable, systems on the local subnet can stillbe accessed through b-node resolution.

M-node is typically not the best choice for larger networks because it usesb-node and thus results in broadcasts. However, when you have a largenetwork that consists of smaller subnetworks connected via slow Wide AreaNetwork (WAN) links, M-node is a preferred method since it will reduce theamount of communication across the slow links.

H-Node (or Hybrid node)

H-node name resolution, which is currently in RFC draft form, also usesboth b-node and p-node, however it only uses b-node as a last resort. Whenconfigured to use h-node, a system will always first try to use p-node andthen use b-node ONLY if p-node fails. In addition, a system can beconfigured to use the LMHOSTS file after p-node fails and before tryingb-node.

H-node resolution does not require successful p-node registration for asystem to initialize, however the system will use strictly b-node untilp-node registration succeeds. If the NBNS is unavailable and the systemresorts to using b-node resolution, it will continue to attempt to contactthe NBNS so that it can return to using p-node if the NBNS becomesavailable.

How WINS Works

By default, when a system is configured to use WINS for its nameresolution, it adheres to h-node for name registration. For nameresolution, it will also adhere to h-node but with a few differences. Itwill:

  • Check to see if it is the local machine name.
  • Check its cache of remote names. Any name that is resolved is placed in a cache where it will remain for 10 minutes.
  • Try the WINS Server.
  • Try broadcasting.
  • Check the LMHOSTS file, if the system is configured to use the LMHOSTS file.
  • Try the HOSTS file and then a DNS, if so configured.

Article ID: 119493 - Last Review: 12/04/2015 10:25:47 - Revision: 3.0

Microsoft Windows NT Workstation 3.5, Microsoft Windows NT Workstation 3.51, Microsoft Windows NT Workstation 4.0 Developer Edition, Microsoft Windows NT Server 3.5, Microsoft Windows NT Server 3.51, Microsoft Windows NT Server 4.0 Standard Edition, Microsoft Windows 95, Microsoft TCP/IP for Windows for Workgroups 3.11, Microsoft TCP/IP for Windows for Workgroups 3.11a, Microsoft TCP/IP for Windows for Workgroups 3.11b

  • kbnosurvey kbarchive KB119493