Computer name to IP Address 1

[Accessdabbler]

I know that ARP finds a NIC's MAC address from the IP Address but how does a computer find another computer's IP Address?

For example, if I plug Computer B into a hub. On Computer A I type "\\ComputerBName\CDrive" into the address bar in Explorer. What steps does Computer A do to locate the share on Computer B? Originally I thought WINS, DNS, LMHOSTS or even HOSTS but that doesn't make sense when the systems are local.

Also, I read a piece on how NetBEUI keeps track of sessions by using the computer name (Home<00> and Home<20>). This makes sense if only 1 file is being copied between two computers. However, what if I tried to open 2 NetBEUI sessions between two computers (ie. ComputerA tries to copy 2 files to ComputerB simultaneously)?

 

[Morsing]

It's overly complicated:

On a local LAN the clients vote to be the browsemaster. The one that wins will maintain a list of clients that broadcasts themselves.

Every time there is a election all the clients will know who is browsemaster. Not sure how new clients find out but I suppose they broadcast a query.

Cheers Henrik Morsing
IBM Certified AIX 4.3 Systems Administration

 

[Accessdabbler]

Browsemaster... yes, I keep seeing this but I never seem to run across it in my networking books.

I have Ethereal which I run to learn stuff.

I typed &quot;\\computerB\c&quot; at the Run command while running Ethereal and discovered that something called NBNS tries to locate computerB. Curious, there were 4 NBNS entries. The first 3 used a truncated form of ComputerB's name (say &quot;Computer<20>&quot. The fourth entry referenced the full name (&quot;ComputerB<20>&quot.

Next, ComputerB did an ARP request looking for ComputerA's MAC address. ComputerA responded with an ARP reply.

ComputerB then did an NBNS name query response. Finally the SYN, ACK SYN and ACK procedure occured and the connection went on...

OK, so NBNS protocol was used to start this whole procedure which leaves me with 2 other questions:

1. Why NBNS? I don't have NetBEUI installed as a protocol...

2. Why the 3 NBNS requests using the truncated name &quot;Computer&quot; instead of &quot;ComputerB&quot;?


p.s. MORSING - I'm not ignoring your reply, hopefully the browsemaster and NBNS stuff will come together somehow...

 

[matttheknife]

Just to address some of the questions raised.

1) What you see is the address resolution of a Computer name (Netbios name, machine name) of an MS OS. This has nothing to do with any Browsing or Browsemasters. Browsing is just to locate resources on the network, NOT for name resolution.

2) When a machine tries to access a remote share via a UNC (&quot;\\Computer name\Share&quot you'll have the following &quot;Search Order&quot;.
a) Local NetBios Name Cache
b) WINS query, if WINS server entered, first to primary WINS, then to secondary if primary is not available. (3 queries each)
c) Broadcast, if WINS is not available (3 queries)
d) The lookup name in local &quot;lmhosts&quot;
e) Then try &quot;hosts&quot; if DNS lookup is enabled
f) Then try a DNS query.

3) For accessing a local share
the computer finds his own entry in the Netbios Name cache. The entries there get created, when the machine boots up and registers its name on the network. (WINS or Broadcast)

4) Netbios is generally a protocol
It is used for 3 different transports.
NBT: NetBios over TCP/IP
NwLink: Netbios over IPX
NetBEUI: Netbios over LLC (Link Layer, non routable)
So you will have Netbios for all implementations of WinNT and Win9x.

5) NBNS
is NetBios name service that is specified for NetBios over TCP/IP only. That's what you are probably runnung. This is where you have WINS services available.

5) NETBEUI
is the implementation of Netbios over LLC. No WINS, no routing, just flat networks. In the resolution part described above, steps b) e) and f) won't happen.

6) 2 simultaneuous sessions (file copy)
For NetBios over TCP, TCP will take care. You will have 2 separate TCP sessions.
For NetBEUI, Netbios layer will carry session numbers to differenciate the sessions.

7) Why multiple name resolution request, when trying to find computer B?
This has to be investigated.
Depends on, whether you have WINS server specified and WINS server is up. I also came across some hickups when using EtherReal for decoding. I use the Sniffer.

8) Good resources
Try Microsoft Technet online. That should give you more insight, what is going on. Or try Sniffer University.
Rgds

 

[svermill]

mattthekife,

Excellent!

Accessdabbler,

What happened to your Ethernet thread? I was away on business so I wasn't keeping up with it. When I logged on to get caught up, it was gone.

 

[svermill]

Accessdabbler,

Also, if you can capture a DHCP transaction, check out option 44 of the boot reply (there will only be an option 44 in the reply if it was requested by the client). It's entitled &quot;NetBIOS over TCP/IP Name Server.&quot; This is how a Windows box learns of the name server when DHCP is in use.