how to discover the WINS server without using DHCP?

Christopher R. Hertel crh at
Wed Oct 22 04:22:20 GMT 2003

On Tue, Oct 21, 2003 at 05:50:09PM -0700, David Wuertele wrote:
> Christopher> Thing 3:  Send a unicast query for workgroup<00> (and
> Christopher>           Recursion Desired set).  If the node responds
> Christopher>           with its own IP address then it's not an NBNS.
> Christopher>           If it replies with (and
> Christopher>           Recursion Available set) then it's an NBNS.
> This thing looks like it is working for me, at least in my testing
> with Samba WINS servers.  Do you know if it is also true for MS WINS
> servers?

Should be the same.

> Why does this work?

Because Microsoft's implementation is broken, and Samba is bug-compatible.  

> What does the mean?

[Warning:  Long-winded explanation.]

The workgroup<00> name is a group name.  If you send a broadcast query
(without Recursion Desired) for that name, you should get individual
replies from all nodes on the local subnet that have registered that name.  
Each reply will have the IP address of the node that responded.  That's 
the way the RFCs have it, and that is what actually happens.  (That's 

On the other hand, the RFCs state that the NBNS should store all of the
IPs associated with a group name, and return as many of them as will fit
in a *single* reply when the query is sent to the NBNS (Unicast &
Recursion Desired).

WINS, which is Microsoft's NBNS implementation, doesn't do this.  In 
*most* cases, when queried for a group name WINS will return a single IP 
address:  (I whine about this in detail in my book.)  
This is broken behavior, but that's what they do.  It means that any 
datagram message sent to a group name will be limited in scope to the 
local IP subnet, which is wrong.  NetBIOS datagrams should reach all 
members of the named group.  ...but I digress.

There are specific exceptions.  WINS will return a list of up to 25 IPs in
response to a query for workgroup<1C> (which is a name registered by
domain controllers).  Samba, in order to be bug-compatible with WINS, also
returns in response to most queries for group names, with
the same exceptions.

With regard to the workgroup<00> name...  I suggest querying for that name
because *most*, but not all, memebers of a Workgroup or NT Domain will
register a groupname composed of the Workgroup (or NT Domain) name with a
type byte of <00>.  You only need one such registration in the WINS
database to make this trick work.

The workgroup<00> name is registered for compatibility with an old form of
the Browse Service (the LAN Manager Browse Service).  Note that there is
no guarantee that this name will will be registered.  It's just a good
guess that one or two nodes will register it.  Another one to try is
workgroup<1E>.  A list of common NetBIOS names and their meanings is
available here:

> Christopher> Details on the workings of NBT (including the workings of
> Christopher> the NBNS) are here:
> Christopher>
> This is an EXCELLENT reference.  Thanks.

Most kind.  Glad you find it useful.

It's out in dead-tree book form too.
Needs a review on Slashdot, if anyone's interested.  ;)

Chris -)-----

"Implementing CIFS - the Common Internet FileSystem" ISBN: 013047116X
Samba Team --     -)-----   Christopher R. Hertel
jCIFS Team --   -)-----   ubiqx development, uninq.
ubiqx Team --     -)-----   crh at
OnLineBook --    -)-----   crh at

More information about the samba-technical mailing list