[jcifs] RE: NetBIOS adapter status request

Sat Feb 1 10:06:01 EST 2003

On Fri, Jan 31, 2003 at 03:47:31PM -0500, Michael B. Allen wrote:
> On Fri, 31 Jan 2003 07:33:11 -0500
> "Glass, Eric" <eric.glass at capitalone.com> wrote:
:
:
> > > I was messing around with NbtAddress.getMacAddress() -- I 
> > > noticed that it seemed to work only in the case that the host 
> > > was running the "Server" service
> 
> Well the "Server" service is the SMB server which is also the NBT server
> so yes, that does need to be running.
>
> > (had a <20> entry, I think). 
> 
> I don't think it has anything to do with what the type is.

No, he's right.  The Server Service is specifically the SMB filesharing 
service.

NBT creates a virtual NetBIOS LAN and, under NetBIOS, addresses (NetBIOS
names) refer directly to services...sort of like combining the [IP, port]
into one reference.  The <host>#20 name is registered by the SMB
fileserver, the "Server Service".

> > >  Otherwise, I would get:
> > > 
> > > Exception in thread "main" java.net.UnknownHostException: no 
> > > name with type 0x00
> > >  with no scope for host 10.60.38.202
> > >         at 
> > > jcifs.netbios.NbtAddress.getAllByAddress(NbtAddress.java:523)
> > >         at nbttest.main(nbttest.java:10)
> 
> This is what you get when jCIFS just doesn't get an answer. There may
> be a host that will answer if you provided a different type (hex code,
> e.g. 0x20) or scope or a different IP but no one is answering with those
> parameters thus the UnknownHostException.

There are two ways to send an Adapter Status Query:

1)  Send it to a specific NetBIOS name.  jCIFS will use the NBT layer to 
    convert the name to an IP address and will send the query to that 
    address.  If the hostname is not found then you'd get an exception.
    + Note that if you do not specify a suffix jCIFS must make a guess.
      The best guess is the 0x00 suffix.  Almost all Windows systems 
      register the <host>00 name.  WindowsXP, annoyingly, is an exception.

2)  The more common way to send the Adapter Status Query is to specify 
    the IP address and query for the wildcard name (which is an asterisk
    followed by 15 nul bytes).  The Adapter Status is commonly used as a 
    reverse lookup tool.  If the target node is running NBT, it will reply 
    to a wildcard query.

Note that there is one more caveat:  Original W/95 systems reply to the
wrong port when sent an Adapter Status query.  They always reply to port
137/UDP.  As a result, some W/95 systems will (mysteriously) "not respond"
to an Adapter Status Query.

I should mention, though, that I am confused by the wording of the 
exception above:

  Exception in thread "main" java.net.UnknownHostException:
    no name with type 0x00 with no scope for host 10.60.38.202

It suggests that the host was specified by IP address.  If it was a W/XP 
machine, then it won't have an 0x00 name in the list.  It may have an 
0x20, but not necessarily.

The Adapter Status Query returns a list of names.  You can 'guess' the 
hostname of the remote host by looking for either the 0x00 or 0x20 unique 
names.  If either of these exist, then they are likely to be based on the 
NetBIOS machine name.

- The NetBIOS machine name is *not necessarily* the same as the DNS
  hostname of the machine.

- I have never seen a unique 0x00 name that was not based on the NetBIOS 
  machine name.  I *have* however seen 0x20 unique names that are 
  unrelated to the Server Service.  For example, the "DCA IrmaLan Gateway 
  Server Service" reportedly registers Forte_$ND800ZA#20.  (I think that 
  product is defunct, but I was told that Lotus Notes also sometimes uses
  the 0x20 suffix).

> > > running "nbtstat -a host"
> > > 
> > 
> > To continue, running "nbtstat -a host" shows two entries of type <00>, a
> > "unique" entry for the hostname and a "group" entry for the domain.

The unique <host>#00 name is commonly called the "Machine Name" or the
"Client Service" name.  It used to be used for some mailslot services.  
All DOS, Windows, and OS/2 clients were supposed to register this name.
With WindowsXP the name disappeared.

> > I can
> > connect to several other boxes just fine, and the common thread seems to be
> > that all working hosts have a <20> entry (running the file sharing service).
> > Is this a jCIFS limitation?  Is nbtstat doing something different to
> > successfully connect to the hosts without sharing enabled?
> 
> I'd need a packet capture to be able to tell. Capture a nbtstat -a
> working and jCIFS failing and look at the difference. I've never had a
> problem stating NT 4.0. Maybe it's a W2K or XP thing?

>From the information available I can't tell if the problem is that the 
target node isn't responding properly or that jCIFS is expecting an 0x00 
and/or 0x20 name.

Chris -)-----

-- 
Samba Team -- http://www.samba.org/     -)-----   Christopher R. Hertel
jCIFS Team -- http://jcifs.samba.org/   -)-----   ubiqx development, uninq.
ubiqx Team -- http://www.ubiqx.org/     -)-----   crh at ubiqx.mn.org
OnLineBook -- http://ubiqx.org/cifs/    -)-----   crh at ubiqx.org