Connecting to NetBIOS Resources Using DNS Names or IP Addresses (161431)

SUMMARY

In Windows, you can use Domain Name System (DNS) to resolve a computer name to an IP address for Windows networking functions, or to connect directly to an IP address without knowing the NetBIOS name. Some examples are:

net use * \\ftp.microsoft.com\data net view \\10.57.8.191

When using this new functionality, it is still necessary for the calling computer to know one of the NetBIOS names that is registered on the remote computer. There are currently three ways of finding a valid NetBIOS name to connect to on the target computer:

If a Fully Qualified Domain Name (FQDN) was entered, try a NetBIOS session setup to the hostname portion. For example, if net use \\host1.domain1.com\share was entered, a NetBIOS session setup to the name "host1" can be tried.
Try a NetBIOS session setup to the new "*SMBSERVER" name that recent implementations support.
Issue a NetBIOS adapter status request (also called a NetBIOS node status request) to the destination IP address, and then parse the returned name table for the name registered by the server service (<computername>[0x20]).

Netmon displays an adapter status query as:

   NBT: NS: Query req. for *<00...(15)>

MORE INFORMATION

NetBIOS sessions are established between two NetBIOS names. A session setup involves the following phases:

NetBIOS name resolution (via a name server, broadcast, or static file)

   NetBIOS name query request -->
                              <--  NetBIOS name query response

A TCP connection is established:

   SYN  -->
        <--  SYN-ACK
   ACK  -->

A NetBIOS session is set up over that connection:

   NetBIOS session setup request -->
                                 <--  NetBIOS session setup response

When using a DNS to resolve names, or when connecting directly to an IP address, there is no assurance that the NetBIOS name for the called system is known.

The DNS (host) name is not necessarily the same as the NetBIOS name (and in many cases the DNS name is actually an alias for any number of different computers). This means that the NetBIOS name must be verified before a session can be set up.

If an IP address is specified, such as net use * \\10.1.1.1\share:

Attempt to setup a session to the newly supported "*SMBSERVER " NetBIOS name

-or, if that fails-
Send a NetBIOS adapter status request to the called IP address, and obtain the list of NetBIOS names registered for that adapter.

If only the hostname is specified, such as net use * \\host1\share:

Attempt to resolve and setup a session through standard NetBIOS name resolution methods (broadcast, lmhosts, WINS1, WINS2, etc.)

-or, if that fails-
If "Enable DNS for Windows Name Resolution" is checked, attempt to resolve the name using local hosts file or query DNS. If hosts file or DNS resolves the name, send a NetBIOS adapter status request to the called IP address, and obtain the list of NetBIOS names registered for that adapter.

If a Fully Qualified Domain Name was specified, such as net use \\host1.domain1.com\share: (see 137565 for more details)

Attempt to setup a NetBIOS session to the hostname (host1)

-or, if that fails-
Send a NetBIOS adapter status request to the called IP address, and obtain the list of NetBIOS names registered for that adapter.

For more information on this, please see the following article in the Microsoft Knowledge Base:

ARTICLE-ID: 137565
TITLE : System Error 53 When Connecting to a FQDN

The NetBIOS adapter status response contains the name table for the computer queried. It is parsed for the name registered by the server service (shown below), and then a TCP connection and NetBIOS session can be established.

RFC1002 states:

NBNS can (optionally) ensure that the node is actually down by sending a NODE STATUS REQUEST. If such a request is sent, and no response is received, it can be assumed that the node is down.

In order to establish a connection from a Windows computer to another computer using DNS name resolution, the remote computer must either support NetBIOS sessions to the special case *SMBSERVER name, or respond properly to an adapter status request. You can use the Windows nbtstat -A <ipaddr> command to test this. A sample is shown here:

D:\>nbtstat -A 10.57.9.147

       NetBIOS Remote Machine Name Table

   Name               Type         Status
-------------------------------------------
<ServerName>   <1F>  UNIQUE      Registered
<ServerName>   <00>  UNIQUE      Registered
<ServerName>   <00>  GROUP       Registered
<ServerName>   <03>  UNIQUE      Registered
<ServerName>   <20>  UNIQUE      Registered   <--- The server service name
<ServerName>   <1E>  GROUP       Registered

MAC Address = 00-80-5F-50-E3-CC