Strange behavior of MacOS and netbios name

Christopher R. Hertel crh at
Wed Oct 29 05:50:35 GMT 2003

Klaus Ethgen wrote:
> Hello,
> I found the problem.
> The MacOS finder enumerates the list of netbiosnames of the server,
> sorts it alphabetic and take the last in the list for connection to the
> server.
> Who implement such a strange behavior?
> Gruss
>    Klaus
> - --

Well, actually, some of us know the guy who implemented that bit of code and
he's really quite cluefull.  I've BCC'd him.  :)

Here's the deal (I'll try to be brief, but it's complicated):

You are using a "trick" that Samba allows in order to register two NetBIOS
names on one server, each representing a different (virtual) service.  Most
SMB implementations don't allow for that.  They allow only *one* instance of
the SMB Server Service per server.  There is no reason that they need to do
this... they just do.

The SMB protocol was orginally written to run on top of the NetBIOS API, so
NetBIOS Names are the "addresses" of the services that run on a "NetBIOS
LAN" (whatever that is).  The point is, the "correct" way to find the SMB
Server Service is via the NetBIOS name it registered.

Many years ago, Microsoft introduced a kludge that allows you to find the
SMB Server Service knowing only its IP address (or DNS name).  The idea was
to "guess" the correct NetBIOS name.  This is done in one of three ways:

  - You can try the "*SMBSERVER" name, which is never registered but is
    accepted by some SMB servers.  Samba, WindowsNT, W2K, W2K3, etc. will
    allow this name.  W9x won't.  Not sure about W/Me.

    One problem with this approach is that it assumes that there is only one
    instance of the SMB Server Service running.  As you've discovered, that
    does not work with the NetBIOS Aliases trick you've employed.

  - The second way is to ask the server what names it has registered.  This
    is done by sending a Node Status query to the server's IP address, and
    then looking through the list for a name with a suffix value of <20>.
    The SMB Server Service *should* be the only service registering names
    with a suffix of <20>.

    Of course, if Samba is offering services under multiple names, then it
    will register multiple <20>'s.  Also, there are some applications out
    there that (incorrectly) register <20> names.

  - The third way is to try parsing the DNS hostname in hopes that it will
    match the NetBIOS name you're looking for.

So, what MacOS is doing is using these methods to find the correct NetBIOS
name for the server.

In your original message, you said:  "When a mac is connecting with

See?  In the example above, you are using a DNS name to connect.  If MacOS
uses either of the first two methods when trying to map the DNS name to the
correct NetBIOS name, then the aliases trick will fail.  There's no way
'round this and it's NOT MacOS's fault.  The problem lies with the
DNS-to-NetBIOS name mapping kludge.

The correct way to do this would be to use the following URL:


In which case the client *should* try to resolve the name as a NetBIOS name
first.  If it succeeds, then it *should* try connecting to that NetBIOS name
without going through any of the IP/DNS <--> NetBIOS name mapping mess.

Some implementations will *always* try to reverse an IP address to a
workable NetBIOS name no matter how the IP address was obtained (even if it
was resolved from a NetBIOS name in the first place).

So, the overall problem is that the trick you are using is not built on a
stable foundation.  Again, it's not really Apple's fault.  It goes back to
two assumptions:

- That the server will only offer a single service.
- That a DNS name or IP address can be mapped back to a valid NetBIOS name.

Kludge city.

Chris -)-----

"Implementing CIFS - the Common Internet FileSystem" ISBN: 013047116X
Samba Team --     -)-----   Christopher R. Hertel
jCIFS Team --   -)-----   ubiqx development, uninq.
ubiqx Team --     -)-----   crh at
OnLineBook --    -)-----   crh at

More information about the samba-technical mailing list