how to discover the WINS server without using DHCP?

[David Wuertele]

My customer manually sets his windows boxes with his WINS server
address --- he doesn't use DHCP to distribute that information.

I have a product that needs to talk to his WINS server, but I don't
want to require that he hardcode his WINS server address on my box.

Is there a way to discover a WINS server automatically, without using
DHCP?

For example, I could:

1.  do a broadcast ping to get a list of all hosts on the subnet
2.  foreach host on the subnet, try to access port 137
3.  foreach host with an open port 137, talk magic words
4.  the host that replies in WINS-server speak must be the One True
    WINS server for his network

Obviously this couldn't find a WINS server on a different subnet, but
could it succeed if the WINS server was on the same subnet?  What are
the magic words I need to use in step 3?

Is there any way to automatically discover the location of the WINS
server if it is on a different subnet?

Thanks,
Dave