NetBIOS Names

[Sw0rdFish]

NetBIOS names are used to identify resources on a network. Applications use these names to

start and end sessions. You can configure a single machine with multiple applications, each of

which has a unique NetBIOS name. Each PC that supports an application also has a NetBIOS

station name that is user defined or that NetBIOS derives by internal means.

NetBIOS can consist of up to 16 alphanumeric characters. The combination of characters must

be unique within the entire source routing network. Before a PC that uses NetBIOS can fully

function on a network, that PC must register their NetBIOS name.

When a client becomes active, the client advertises their name. A client is considered to be

registered when it can successfully advertise itself without any other client claiming it has the

same name. The steps of the registration process is as follows:

1. Upon boot up, the client broadcasts itself and its NetBIOS information anywhere from 6 to 10 to

ensure every other client on the network receives the information.

2. If another client on the network already has the name, that NetBIOS client issues its own

broadcast to indicate that the name is in use. The client who is trying to register the already in use

name, stop all attempts to register that name.

3. If no other client on the network objects to the name registration, the client will finish the

registration process.

There are two types of names in a NetBIOS enviroment: Unique and Group. A unique name must

be unique across the network. A group name does not have to be unique and all processes that

have a given group name belong to the group. Each NetBIOS node maintains a table of all

names currently owned by that node.

The NetBIOS naming convention allows for 16 characters in a NetBIOS name. Microsoft,

however, limits these names to 15 characters and uses the 16th character as a NetBIOS suffix. A

NetBIOS suffix is used by Microsoft Networking software to indentify the functionality installed or

the registered device or service.

[QuickNote: SMB and NBT (NetBIOS over TCP/IP work very closely together and both use ports

137, 138, 139. Port 137 is NetBIOS name UDP. Port 138 is NetBIOS datagram UDP. Port 139 is

NetBIOS session TCP. For further information on NetBIOS, read the paper at the rhino9 website

listed above]

The following is a table of NetBIOS suffixes currently used by Microsoft WindowsNT. These

suffixes are displayed in hexadecimal format.

Name Number Type Usage

=========================================================================

=

<computername> 00 U Workstation Service

<computername> 01 U Messenger Service

<_MSBROWSE_> 01 G Master Browser

<computername> 03 U Messenger Service

<computername> 06 U RAS Server Service

<computername> 1F U NetDDE Service

<computername> 20 U File Server Service

<computername> 21 U RAS Client Service

<computername> 22 U Exchange Interchange

<computername> 23 U Exchange Store

<computername> 24 U Exchange Directory

<computername> 30 U Modem Sharing Server Service

<computername> 31 U Modem Sharing Client Service

<computername> 43 U SMS Client Remote Control

<computername> 44 U SMS Admin Remote Control Tool

<computername> 45 U SMS Client Remote Chat

<computername> 46 U SMS Client Remote Transfer

<computername> 4C U DEC Pathworks TCPIP Service

<computername> 52 U DEC Pathworks TCPIP Service

<computername> 87 U Exchange MTA

<computername> 6A U Exchange IMC

<computername> BE U Network Monitor Agent

<computername> BF U Network Monitor Apps

<username> 03 U Messenger Service

<domain> 00 G Domain Name

<domain> 1B U Domain Master Browser

<domain> 1C G Domain Controllers

<domain> 1D U Master Browser

<domain> 1E G Browser Service Elections

<INet~Services> 1C G Internet Information Server

<IS~Computer_name> 00 U Internet Information Server

<computername> [2B] U Lotus Notes Server

IRISMULTICAST [2F] G Lotus Notes

IRISNAMESERVER [33] G Lotus Notes

Forte_$ND800ZA [20] U DCA Irmalan Gateway Service

Unique (U): The name may have only one IP address assigned to it. On a network device,

multiple occurences of a single name may appear to be registered, but the suffix will be unique,

making the entire name unique.

Group (G): A normal group; the single name may exist with many IP addresses.

Multihomed (M): The name is unique, but due to multiple network interfaces on the same

computer, this configuration is necessary to permit the registration. Maximum number of

addresses is 25.

Internet Group (I): This is a special configuration of the group name used to manage WinNT

domain names.

Domain Name (D): New in NT 4.0

For a quick and dirty look at a servers registered NetBIOS names and services, issue the

following NBTSTAT command:

nbtstat -A [ipaddress]

nbtstat –a [host]

Enj0y!