Windows Internet Name Service
Windows Internet Name Service (WINS) is a NetBIOS name service as described in RFC 1001 and RFC 1002. When a Windows NT computer is configured as h-node (default for WINS clients), it attempts to use a WINS server for name registration and resolution first and, if that fails, it resorts to subnet broadcasts.
WINS Name Registration and Resolution
Using WINS for name services dramatically reduces the number of IP broadcasts used by Microsoft network clients. The following portion of a trace illustrates name registration and resolution traffic caused by starting a Windows NT workstation.
Source IP Destination IP Prot Description
- 172.16.112.124 172.16.113.254 NBT NS: MultiHomed Name Registration req. for DAVEMAC4<00>
- 172.16.113.254 172.16.112.124 NBT NS: Registration resp. for DAVEMAC4<00>, Success
- 172.16.112.124 172.16.113.254 NBT NS: Registration req. for DAVEMACD<00>
- 172.16.113.254 172.16.112.124 NBT NS: Registration resp. for DAVEMACD<00>, Success
- 172.16.112.124 172.16.113.254 NBT NS: Query req. for DAVEMACD<1C>
- 172.16.113.254 172.16.112.124 NBT NS: Query resp. for DAVEMACD<1C>, Success
- 172.16.112.124 172.16.113.254 NBT NS: MultiHomed Name Registration req. for DAVEMAC4<03>
- 172.16.113.254 172.16.112.124 NBT NS: Registration resp. for DAVEMAC4<03>, Success
This trace shows that the starting client (172.16.112.124) sends a single name registration request to the WINS server, asking to register the computer name (DAVEMAC4<00>) as a unique name for a multihomed host. The WINS server responds affirmatively. Next, the domain name (DAVEMACD<00>) is registered as a group name. Then a name query is sent to the WINS server, requesting a list of domain controllers (who all register the <domain>[1C] name) so that a logon server can be contacted. One more registration is shown, for DAVEMAC4<03>, which is the name registered by the Messenger service. The fully parsed version of the domain name registration follows:
Source IP Destination IP Prot Description
172.16.112.124 172.16.113.254 NBT NS: Registration req. for DAVEMACD<00>
+ FRAME: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x300; Proto = UDP; Len: 96
+ UDP: Src Port: NETBIOS Name Service, (137); Dst Port: NETBIOS Name
Service (137); Length = 76 (0x4C)
NBT: NS: Registration req. for DAVEMACD<00>
NBT: Transaction ID = 32770 (0x8002)
NBT: Flags Summary = 0x2900 - Req.; Registration; Success
NBT: 0............... = Request
NBT: .0101........... = Registration
NBT: .....0.......... = Non-authoritative Answer
NBT: ......0......... = Datagram not truncated
NBT: .......1........ = Recursion desired
NBT: ........0....... = Recursion not available
NBT: .........0...... = Reserved
NBT: ..........0..... = Reserved
NBT: ...........0.... = Not a broadcast packet
NBT: ............0000 = Success
NBT: Question Count = 1 (0x1)
NBT: Answer Count = 0 (0x0)
NBT: Name Service Count = 0 (0x0)
NBT: Additional Record Count = 1 (0x1)
NBT: Question Name = DAVEMACD<00>
NBT: Question Type = General Name Service
NBT: Question Class = Internet Class
NBT: Resource Record Name = DAVEMACD<00>
NBT: Resource Record Type = NetBIOS General Name Service
NBT: Resource Record Class = Internet Class
NBT: Time To Live = 300000 (0x493E0)
NBT: RDATA Length = 6 (0x6)
NBT: Resource Record Flags = 57344 (0xE000)
NBT: 1............... = Group NetBIOS Name
NBT: .11............. = Reserved
NBT: ...0000000000000 = Reserved
NBT: Owner IP Address = 172.16.112.13
Because the domain name is a group name, any number of hosts are allowed to register it.
WINS in a DHCP Environment
WINS is especially helpful on DHCP-enabled networks. One of the DHCP-provided parameters can be the address of a WINS server, and so as soon as the client is configured by DHCP, it registers its name(s) and address with the WINS server, and can then be easily located by the other computers on the network. This combination of DHCP and WINS is ideal for dynamic situations.
For additional information on WINS, see Chapter 8, "Managing Microsoft WINS Servers."