Understanding NetBIOS Network Discovery: A Beginner's Guide
In Windows networking, NetBIOS is a protocol that allows computers to communicate with each other over a Local Area Network (LAN). It operates at the session layer of the OSI model and provides services such as name resolution and session establishment. However, as we will see, it is possible to ignore NetBIOS and still discover devices on a network.
NetBIOS Over TCP/IP
In modern Windows networks, NetBIOS is typically implemented over TCP/IP. This means that NetBIOS uses TCP/IP as its underlying transport protocol. When a computer joins a network, it is assigned a unique 16-character name, which is used to identify it on the network. This name is resolved to an IP address using a service called NetBIOS Name Service (NBNS).
// Example of NetBIOS name resolution
C:\>nbtstat -n
Local Area Connection:
Node IpAddress: [192.168.1.100] Scope Id: []
NetBIOS Remote Machine Name Table
Name Type Status
---------------------------------------------
WORKGROUP <1B> UNIQUE Registered
WORKGROUP <00> GROUP Registered
MY-COMPUTER <00> UNIQUE Registered
In the example above, we can see that the computer's NetBIOS name is MY-COMPUTER, and it is a member of the WORKGROUP group. The IP address of the computer is 192.168.1.100.
NetBIOS Name Query
When a computer wants to communicate with another computer on the network, it can use a NetBIOS name query to resolve the other computer's IP address. The query is sent to a NetBIOS Name Server (NBNS), which responds with the IP address of the requested computer. Here is an example of a NetBIOS name query:
// Example of NetBIOS name query
C:\>nbtstat -a 192.168.1.101
Local Area Connection:
Node IpAddress: [192.168.1.100] Scope Id: []
NetBIOS Remote Machine Name Table
Name Type Status
---------------------------------------------
WORKGROUP <00> GROUP Registered
MY-COMPUTER <00> UNIQUE Registered
WORKGROUP <1B> UNIQUE Registered
MY-OTHER-COMPUTER <00> UNIQUE Registered
MAC Address = 00-0C-29-28-5D-F1
In the example above, we can see that the IP address 192.168.1.101 belongs to a computer named MY-OTHER-COMPUTER. The MAC address of the computer is also displayed.
NetBIOS Name Service (NBNS) Implementation
In Windows networks, NBNS is typically implemented using the Windows Internet Name Service (WINS). WINS is a server-based service that maintains a database of NetBIOS names and their corresponding IP addresses. When a computer joins a network, it registers its NetBIOS name with the WINS server. When a computer wants to communicate with another computer, it queries the WINS server for the other computer's IP address.
NetBIOS Less Network Discovery
It is possible to discover devices on a network without using NetBIOS. One way to do this is to use the Link-Local Multicast Name Resolution (LLMNR) protocol. LLMNR is a protocol that allows devices to perform name resolution using IP addresses rather than NetBIOS names. Another way to discover devices on a network is to use the Domain Name System (DNS). DNS is a hierarchical naming system that allows devices to be identified by their fully-qualified domain names (FQDNs).
In this article, we have discussed the basics of NetBIOS network discovery in Windows networks. We have seen how NetBIOS uses TCP/IP as its underlying transport protocol and how it provides services such as name resolution and session establishment. We have also discussed how it is possible to discover devices on a network without using NetBIOS, using protocols such as LLMNR and DNS.
References
- Microsoft Docs: NetBIOS over TCP/IP
- Microsoft Docs: NetBIOS Name Service (NBNS)
- Microsoft Docs: Link-Local Multicast Name Resolution (LLMNR)
- Microsoft Docs: DNS Top-Level Domains