NETBIOS names

NetBIOS names are used to identify resources on a network. Applications use these
names to start and end sessions. You can configure a single machine with multiple
applications, each of which has a unique NetBIOS name. Each PC that supports an
application also has a NetBIOS station name that is user defined or that NetBIOS derives
by internal means.
NetBIOS can consist of up to 16 alphanumeric characters. The combination of characters
must be unique within the entire source routing network. Before a PC that uses NetBIOS
can fully function on a network, that PC must register their NetBIOS name.
When a client becomes active, the client advertises their name. A client is considered to
be registered when it can successfully advertise itself without any other client claiming it
has the same name. The steps of the registration process is as follows:
1. Upon boot up, the client broadcasts itself and its NetBIOS information anywhere from
6 to 10 to ensure every other client on the network receives the information.
2. If another client on the network already has the name, that NetBIOS client issues its
own broadcast to indicate that the name is in use. The client who is trying to register the
already in use name, stop all attempts to register that name.
 
3. If no other client on the network objects to the name registration, the client will finish
the registration process.
There are two types of names in a NetBIOS enviroment: Unique and Group. A unique
name must be unique across the network. A group name does not have to be unique and
all processes that have a given group name belong to the group. Each NetBIOS node
maintains a table of all names currently owned by that node.
The NetBIOS naming convention allows for 16 characters in a NetBIOS name.
Microsoft, however, limits these names to 15 characters and uses the 16th character as a
NetBIOS suffix. A NetBIOS suffix is used by Microsoft Networking software to
indentify the functionality installed or the registered device or service.
[QuickNote: SMB and NBT (NetBIOS over TCP/IP work very closely together and both
use ports 137, 138, 139. Port 137 is NetBIOS name UDP. Port 138 is NetBIOS datagram
UDP. Port 139 is NetBIOS session TCP. For further information on NetBIOS, read the
paper at the rhino9 website listed above]
The following is a table of NetBIOS suffixes currently used by Microsoft WindowsNT.
These suffixes are displayed in hexadecimal format.



Unique (U): The name may have only one IP address assigned to it. On a network device,
multiple occurences of a single name may appear to be registered, but the suffix will be
unique, making the entire name unique.
Group (G): A normal group; the single name may exist with many IP addresses.
Multihomed (M): The name is unique, but due to multiple network interfaces on the same
computer, this configuration is necessary to permit the registration. Maximum number of
addresses is 25.
Internet Group (I): This is a special configuration of the group name used to manage
WinNT domain names.
Domain Name (D): New in NT 4.0
For a quick and dirty look at a servers registered NetBIOS names and services, issue the
following NBTSTAT command:
 
nbtstat -A [ipaddress]
nbtstat -a [host]