FeBI's WINS

WINS is a NetBIOS name service as described in RFC1001/RFC1002. When a Windows NT system is configured as an h-node (default for WINS clients), it attempts to use a WINS server for name registration and resolution first and, if that fails, it resorts to subnet broadcasts.
WINS Name Registration and Resolution

Example: a computer boots

The trace snippet below illustrates name registration and resolution traffic caused by booting a Windows NT 3.51 workstation.

Source IP Dest IP Prot Description
199.199.40.124 199.199.41.254 NBT NS: MultiHomed Name Registration req. for DAVEMAC4<00>
199.199.41.254 199.199.40.124 NBT NS: Registration resp. for DAVEMAC4<00>, Success
199.199.40.124 199.199.41.254 NBT NS: Registration req. for DAVEMACD<00>
199.199.41.254 199.199.40.124 NBT NS: Registration resp. for DAVEMACD<00>, Success
199.199.40.124 199.199.41.254 NBT NS: Query req. for DAVEMACD<1C>
199.199.41.254 199.199.40.124 NBT NS: Query resp. for DAVEMACD<1C>, Success
199.199.40.124 199.199.41.254 NBT NS: MultiHomed Name Registration req. for DAVEMAC4<03>
199.199.41.254 199.199.40.124 NBT NS: Registration resp. for DAVEMAC4<03>, Success

This trace shows that the booting client (199.199.40.124) sends a single name registration request to the WINS server, asking to register the computer name (DAVEMAC4<00>) as a unique name for a multi-homed host. The WINS server responds affirmatively. Next, the domain name (DAVEMACD<00>) is registered as a group name. Then a name query is sent to the WINS server, requesting a list of domain controllers (who all register the <domain>[1C] name) so that a logon server can be contacted. One more registration is shown, for DAVEMAC4<03>, which is the name registered by the messenger service.

WINS register

The fully parsed version of the domain name registration is shown below.

Source IP Dest IP Prot Description
199.199.40.124 199.199.41.254 NBT NS: Registration req. for DAVEMACD<00>

+ FRAME: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x300; Proto = UDP; Len: 96
+ UDP: Src Port: NETBIOS Name Service, (137); Dst Port: NETBIOS Name
       Service (137); Length = 76 (0x4C)
NBT: NS: Registration req. for DAVEMACD<00>
   NBT: Transaction ID = 32770 (0x8002)
   NBT: Flags Summary = 0x2900 - Req.; Registration; Success
     NBT: 0............... = Request
     NBT: .0101........... = Registration
     NBT: .....0.......... = Non-authoritative Answer
     NBT: ......0......... = Datagram not truncated
     NBT: .......1........ = Recursion desired
     NBT: ........0....... = Recursion not available
     NBT: .........0...... = Reserved
     NBT: ..........0..... = Reserved
     NBT: ...........0.... = Not a broadcast packet
     NBT: ............0000 = Success
   NBT: Question Count = 1 (0x1)
   NBT: Answer Count = 0 (0x0)
   NBT: Name Service Count = 0 (0x0)
   NBT: Additional Record Count = 1 (0x1)
   NBT: Question Name = DAVEMACD<00>
   NBT: Question Type = General Name Service
   NBT: Question Class = Internet Class
   NBT: Resource Record Name = DAVEMACD<00>
   NBT: Resource Record Type = NetBIOS General Name Service
   NBT: Resource Record Class = Internet Class
   NBT: Time To Live = 300000 (0x493E0)
   NBT: RDATA Length = 6 (0x6)
   NBT: Resource Record Flags = 57344 (0xE000)
     NBT: 1............... = Group NetBIOS Name
     NBT: .11............. = Reserved
     NBT: ...0000000000000 = Reserved
   NBT: Owner IP Address = 199.199.40.13

Since the domain name is a group name, any number of hosts are allowed to register it.

WINS in a DHCP Environment
WINS is especially helpful on DHCP-enabled networks. One of the DHCP-provided parameters can be the address of a WINS server, so as soon as the client is configured by DHCP, it registers its name(s) and address with the WINS server, and can then be easily located by the other computers on the network. This combination of DHCP and WINS is ideal for dynamic situations.

Hosted by www.Geocities.ws