{
	"id": "b019e917-624f-42a1-b9fa-e69fbb954de7",
	"created_at": "2026-04-06T02:12:00.429867Z",
	"updated_at": "2026-04-10T03:20:24.934989Z",
	"deleted_at": null,
	"sha1_hash": "c1291bd4b059de45d69a0fc3dd5c6c71faca0f9f",
	"title": "NetBIOS Name Resolution",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45125,
	"plain_text": "NetBIOS Name Resolution\r\nBy Archiveddocs\r\nArchived: 2026-04-06 01:36:49 UTC\r\nNetBIOS name resolution is the process of successfully mapping a NetBIOS name to an IP address. A NetBIOS\r\nname is a 16-byte address used to identify a NetBIOS resource on the network. A NetBIOS name is either a\r\nunique (exclusive) or group (nonexclusive) name. When a NetBIOS process communicates with a specific process\r\non a specific computer, a unique name is used. When a NetBIOS process communicates with multiple processes\r\non multiple computers, a group name is used.\r\nThe NetBIOS name acts as a session layer application identifier. For example, the NetBIOS Session service\r\noperates over TCP port 139. All NetBIOS over TCP/IP session requests are addressed to TCP destination port 139.\r\nWhen identifying a NetBIOS application with which to establish a NetBIOS session, the NetBIOS name is used.\r\nAn example of a process using a NetBIOS name is the file and print sharing server service on a Windows 2000–\r\nbased computer. When your computer starts up, the server service registers a unique NetBIOS name based on your\r\ncomputer's name. The exact name used by the server service is the 15 character computer name plus a 16th\r\ncharacter of 0x20. If the computer name is not 15 characters long, it is padded with spaces up to 15 characters\r\nlong. Other network services also use the computer name to build their NetBIOS names so the 16th character is\r\nused to uniquely identify each service, such as the redirector, server, or messenger services. Figure 1.13 shows the\r\nNetBIOS names associated with the server, redirector, and messenger services.\r\nCc958811.CNBB14(en-us,TechNet.10).gif\r\nFigure 1.13 NetBIOS Names and Services\r\nWhen you attempt to make a file-sharing connection to a Windows 2000–based computer by name, the server\r\nservice on the file server you specify corresponds to a specific NetBIOS name. For example, when you attempt to\r\nconnect to the computer called CORPSERVER, the NetBIOS name corresponding to the server service is\r\n\"CORPSERVER     \u003c20\u003e\" (note the padding using the space character). Before a file and print sharing connection\r\ncan be established, a TCP connection must be created. In order for a TCP connection to be established, the\r\nNetBIOS name \"CORPSERVER     \u003c20\u003e\" must be resolved to an IP address.\r\nTo view the NetBIOS names registered by NetBIOS processes running on a Windows 2000 computer, type\r\nnbtstat -n at the Windows 2000 command prompt.\r\nThe exact mechanism by which NetBIOS names are resolved to IP addresses depends on the node's configured\r\nNetBIOS Node Type . RFC 1001 define the NetBIOS Node Types, as listed in Table 1.27.\r\nTable 1.27 NetBIOS Node Types\r\nhttps://technet.microsoft.com/library/cc958811.aspx\r\nPage 1 of 2\n\nNode Type Description\r\nB-node\r\n(broadcast)\r\nB-node uses broadcasted NetBIOS Name Queries for name registration and resolution. B-node has two major problems: (1) In a large internetwork, broadcasts can increase the\r\nnetwork load, and (2) Routers typically do not forward broadcasts, so only NetBIOS name on\r\nthe local network can be resolved.\r\nP-node\r\n(peer-peer)\r\nP-node uses a NetBIOS name server (NBNS) , such as Windows Internet Name Service\r\n(WINS), to resolve NetBIOS name . P-node does not use broadcasts; instead, it queries the\r\nname server directly. The most significant problem with P-node is that all computers must be\r\nconfigured with the IP address of the NBNS, and if the NBNS is down, computers are not\r\nable to communicate even on the local network.\r\nM-node\r\n(mixed)\r\nM-node is a combination of B-node and P-node. By default, an M-node functions as a B-node. If it is unable to resolve a name by broadcast, it uses the NBNS of P-node.\r\nH-node\r\n(hybrid)\r\nH-node is a combination of P-node and B-node. By default, an H-node functions as a P-node.\r\nIf it is unable to resolve a name through the NetBIOS name server, it uses a broadcast to\r\nresolve the name.\r\nWindows 2000–based computers are B-node by default and become H-node when configured for a WINS server.\r\nWindows 2000 also uses a local database file called Lmhosts to resolve remote NetBIOS names.\r\nFor more information about WINS, see \"Windows Internet Name Service\" in this book. For more information\r\nabout the Lmhosts file, see \"LMHOSTS File\" in this book.\r\nSource: https://technet.microsoft.com/library/cc958811.aspx\r\nhttps://technet.microsoft.com/library/cc958811.aspx\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://technet.microsoft.com/library/cc958811.aspx"
	],
	"report_names": [
		"cc958811.aspx"
	],
	"threat_actors": [],
	"ts_created_at": 1775441520,
	"ts_updated_at": 1775791224,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c1291bd4b059de45d69a0fc3dd5c6c71faca0f9f.pdf",
		"text": "https://archive.orkl.eu/c1291bd4b059de45d69a0fc3dd5c6c71faca0f9f.txt",
		"img": "https://archive.orkl.eu/c1291bd4b059de45d69a0fc3dd5c6c71faca0f9f.jpg"
	}
}