1. NetBIOS name resolution

2. Name resolution  NetBIOS name resolution: mapping NetBIOS name to an IP address review of name syntax: machine name: \\mname <= 15 digits, and share name: \sname <= 12 digits (DOS 8) NetBIOS name can be seen in network dialog, registry and using nbtstat -nseen  ARP - Address Resolution Protocol IP address to MAC address resolutionMAC address ARP cache keeps table with IP and MAC addresses You can see it using arp -asee it ARP cache aging (2 minutes) can be setup

3. NetBIOS over TCP/IP node types b-node: broadcast of the name asking for IP p-node: peer-to-peer using NBNS such as WINS m-node: mix of b and p, defaults to b-node, if fails uses p-node resolution h-node: hybrid of b and p, defaults to p- node, if fails uses b-node resolution Microsoft enhanced b-node: loads LMHOSTS in local cache when TCP/IP starts. If fails to resolve then starts broadcast query NetBIOS over TCP/IP in Windows is NetBT

4. B-node: resolving names locally ARP Local address cache A B-node broadcast BC A: a command like NET USE K: \\Al200\temp is issued and the local address cache is checked to see if the IP is already there B: if not found in cache a name query broadcast is sent to the subnet asking for the destination IP number C: the broadcast is received by all machines that start to check if their names match the one broadcasted. The machine that matches prepares a query response using the ARP to obtain the MAC address of the machine requesting the name resolu- tion. As soon as this happens a NetBIOS connection exists.

5. Enhanced B-node: resolving remote NetBIOS names Local address cache A router B-node broadcast B ARP LMHOSTS C D A: a command like NET USE K: \\Al200\temp is issued and the local address cache is checked to see if the IP is already there B: if not found in cache a name query broadcast is sent to the subnet asking for the destination IP number C: if fails the LMHOSTS table is searched and name is resolved D: routing table is checked for destination, or ARP issues request for gateway address (normally in the local cache) E: response is sent as soon as ARP resolves MAC address E

6. Resolving NetBIOS names with NBNS Local address cache A B-node broadcast B ARP C A: a command like NET USE K: \\Al200\temp is issued and the local address cache is checked to see if the IP is already there B: if not found in cache a name query broadcast is sent or the NBNS is searched for the name and name is resolved C: as soon as name is resolved ARP is used to determine the hardware address

7. Name resolution order  Depending of what is selected HOSTS DNS WINS (if selected) broadcast LMHOSTS (if checked in WINS, before broadcast) DNS again  You can change this in the registry HKEY_LOCAL_MACHINE\System\CurrentControlS et\Services\TCPIP\Service Provider You will see: HostsPriority, DNSPriority, NBTPriority see the lowest values are checked first

8. Introduction to NET commands NET HELP and NET command /HELP (see)see NET USER let you see, add, modify and delete users NET ACCOUNTS changes to the entire user database NET GROUP and NET LOCALGROUP (see WEBTEACH) WEBTEACH NET COMPUTER let you add or delete a computer to domain NET CONFIG WORSKSTATION and SERVER (see AL200) AL200 NET STATISTICS WORSTATION and SERVER NET VIEW let you see shares (see AL200)AL200 NET USE to connect to a share (see lpt4 share)lpt4 share NET SHARE shares a resource NET START / STOP start /stop network services (example)example NET SEND name message sends a messagemessage