NetBIOS name resolution is the process of successfully mapping a NetBIOS name to an IP address. A NetBIOS name is a 16-byte address used to identify a NetBIOS resource on the network. A NetBIOS name is either a unique (exclusive) or group (non-exclusive) name. When a NetBIOS process is communicating with a specific process on a specific computer, a unique name is used. When a NetBIOS process is communicating with multiple processes on multiple computers, a group name is used.

The NetBIOS name acts as a session layer application identifier. For example, the NetBIOS Session service operates over TCP port 139. All NetBIOS over TCP/IP session requests will be addressed to TCP destination port 139. To identify which NetBIOS application to establish a NetBIOS session with, the NetBIOS name is used.

An example of a process using a NetBIOS name is the Server service on a Windows NT–based computer which provides file and printer sharing. When your computer starts up, the Server service registers a unique NetBIOS name based on your computer's name. The exact name used by the Server service is the 15 character computer name plus a 16th character of 0x20. If the computer name is not 15 characters long, it is padded with spaces up to 15 characters long. Other network services also use the computer name to build their NetBIOS names so the 16th character is used to uniquely identify each service, such as the redirector, server, or messenger services. Figure 13 shows the NetBIOS names associated with the server, redirector, and messenger services.

Figure 13 NetBIOS names and services

To view the NetBIOS names registered by NetBIOS processes running on a Windows NT-based computer, type "nbtstat –n" at the Windows NT command prompt.

The exact mechanism by which NetBIOS names are resolved to IP addresses depends on the node's configured NetBIOS Node Type. RFC 1001 define the NetBIOS Node Types.

B-node (broadcast) B-node uses broadcasted NetBIOS Name Queries for name registration and resolution. B-node has two major problems: (1) In a large internetwork, broadcasts can increase the network load, and (2) Routers typically do not forward broadcasts, so only NetBIOS names on the local network can be resolved.

P-node (peer-peer) P-node uses a NetBIOS name server (NBNS), such as Windows Internet Name Service (WINS), to resolve NetBIOS names. P-node does not use broadcasts; instead, it queries the name server directly. The most significant problems with P-node are that all computers must be configured with the IP address of the NBNS, and if the NBNS is down, computers will not be able to communicate even on the local network.

M-node (mixed) M-node is a combination of B-node and P-node. By default, an M-node functions as a B-node. If it is unable to resolve a name by broadcast, it uses the NBNS of P-node.

H-node (hybrid) H-node is a combination of P-node and B-node. By default, an H-node functions as a P-node. If it is unable to resolve a name through the NetBIOS name server, it uses a broadcast to resolve the name.

Windows NT–based computers are B-node by default and become H-node when configured for a WINS server. Windows NT also utilizes a local database file called LMHOSTS to resolve remote NetBIOS names.