NetBIOS Name Resolution

The method that a client system will use to resolve NetBIOS names to IP addresses relies on what is referred to as its node type. Microsoft supports 4 main node types, and these control the order in which resolution attempts will take place. By default, a system not configured with a WINS server address will be configured for B-node, and with a WINS server address will be configured for H-node. Most often, node type is configured as a DHCP option, but it can also be configured on individual systems via a Registry change. The 4 main node types are listed below. Note that a client system always checks the NetBIOS name cache first. The Hex values of the node types are listed for the purpose of registry modification. To find out which node type a client is using, run ipconfig /all

B-node (Broadcast) – this method uses a broadcast to resolve names. In Microsoft land, this is actually called ‘enhanced B-node’, since if the broadcast fails, the client will attempt resolution via the LMHOSTS file. Value is 0x1.

H-node (Hybrid) – this method first tries resolving the name via a WINS server, and then attempts B-node methods if unsuccessful. Value is 0x8

M-node (Mixed) – this method first attempts to resolve names via broadcast, followed by an attempt at querying a WINS server should that fail. This is often used in environments where a WINS server is across a WAN link. Value is 0x4

P-node (Peer-to-peer) – this method uses a WINS server for resolution, and never broadcasts. Value is 0x2

Author: Dan DiNicolo

Dan DiNicolo is a freelance author, consultant, trainer, and the managing editor of He is the author of the CCNA Study Guide found on this site, as well as many books including the PC Magazine titles Windows XP Security Solutions and Windows Vista Security Solutions. Click here to contact Dan.