NBNS - NetBIOS Name Service
What is NBNS?
NBNS stands for NetBIOS Name Service. It’s a protocol used to resolve NetBIOS names to IP addresses on a local network. It’s part of the NetBIOS over TCP/IP (NBT) suite and is commonly used in older Windows networks.
Why is NBNS useful?
Before DNS became widespread, NBNS allowed computers to find each other by name on a local network. It was especially useful in Windows peer-to-peer networks, where users could connect using computer names instead of IP address.
How it works?
Device wants to resolve a NetBIOS name – For example, a user tries to access \LAPTOP-01.
NBNS query broadcast – The device sends a broadcast or unicast NBNS query asking, Who is LAPTOP-01?.
Matching device responds – The device with that NetBIOS name replies with its IP address.
Connection established – The requesting device uses the IP to connect to the target.
Where is NBNS used?
Legacy Windows networks – Especially in Windows XP and earlier.
Small workgroup networks – Without DNS servers.
Mixed environments – Where older systems still rely on NetBIOS.
Fallback resolution – When DNS and LLMNR are unavailable.
Which OSI layer does this protocol belong to?
It provides name resolution services to applications and users.
It uses UDP port 137 to send and receive queries.
It’s part of the NetBIOS API, which is an application-level interface.
Topics in this section,
In this section, you are going to learn
Terminology
Version Info
NBNS |
RFC |
Year |
Core Idea / Contribution |
|---|---|---|---|
Version |
|||
NBNS |
|||
(NetBIOS |
|||
Name Service) |
|||
RFC 1001 & RFC 1002 |
1987 |
Defined the NetBIOS Name Service |
|
over TCP/UDP, enabling name |
|||
|
|||
IP networks. It allowed NetBIOS |
|||
applications to function over TCP/IP, |
|||
supporting both local and |
|||
internet-wide name services. |
setup
setup
Name Registration Request Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
1 |
Name Registration Request |
Sent by a host to register a NetBIOS name on the network |
~5070 |
Transaction ID |
Unique identifier for matching responses. |
2 |
|
Flags |
0x2900 (indicates registration request). |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 (contains the name being registered) |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Encoded NetBIOS name. |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
Time to live for the name. |
4 |
|
RDLENGTH |
Length of RDATA. |
2 |
|
RDATA |
Flags, IP address of the registering node. |
~6 |
|
Name Overwrite Request Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
2 |
Name Overwrite Request |
Sent to forcibly overwrite an existing name registration. |
~5070 |
Transaction ID |
Unique identifier |
2 |
|
Flags |
0x2D00 (overwrite request). |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 (contains the name being registered) |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Encoded NetBIOS name. |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
Time to live for the name. |
4 |
|
RDLENGTH |
Length of RDATA. |
2 |
|
RDATA |
Flags, overwrite IP address. |
~6 |
|
Name Refresh Request Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
3 |
Name Refresh Request |
Used to refresh the TTL of a registered name |
~5070 |
Transaction ID |
Unique identifier |
2 |
|
Flags |
0x2500 (refresh request) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 (contains the name being registered) |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Encoded NetBIOS name. |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
Time to live for the name. |
4 |
|
RDLENGTH |
Length of RDATA. |
2 |
|
RDATA |
Flags, IP address |
~6 |
|
Positive Name Registration Response Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
4 |
Positive Name Registration Response |
Sent by a name server to confirm successful name registration |
~4060 |
Transaction ID |
Matches the request. |
2 |
|
Flags |
0x8500 (indicates positive response). |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 (contains the name being registered) |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Encoded NetBIOS name. |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
Time to live for the name. |
4 |
|
RDLENGTH |
Length of RDATA. |
2 |
|
RDATA |
Flags, IP address |
~6 |
|
Negative Name Registration Response Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
5 |
Negative Name Registration Response |
Sent when a name registration fails (e.g., name conflict) |
~4060 |
Transaction ID |
Matches the request. |
2 |
|
Flags |
0x8503 (indicates negative response). |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-0 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
Error Code |
Indicates reason for failure (e.g., name in conflict). |
1 |
|
End-Node Challenge Registration Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
6 |
End-Node Challenge Registration |
Used in challenge-response name registration. |
~4060 |
Response |
|||
Transaction ID |
Matches the challenge. |
2 |
|
Flags |
0x850F (challenge response) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Encoded NetBIOS name. |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
Time to live for the name. |
4 |
|
RDLENGTH |
Length of RDATA. |
2 |
|
RDATA |
Flags, IP address |
~6 |
|
Name Conflict Demand Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
7 |
Name Conflict Demand |
Sent to notify a node of a name conflict |
~4060 |
Transaction ID |
Unique identifier |
2 |
|
Flags |
0x8405 (conflict demand) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Conflicting NetBIOS name |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
0 (indicates immediate release) |
4 |
|
RDLENGTH |
Length of RDATA. |
2 |
|
RDATA |
Flags, IP address |
~6 |
|
Name Release Request Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
8 |
Name Release Request |
Sent by a node to release a previously registered name |
|
Transaction ID |
Unique identifier |
2 |
|
Flags |
0x2500 (release request) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Encoded NetBIOS name |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
0 (indicates release) |
4 |
|
RDLENGTH |
Length of RDATA. |
2 |
|
RDATA |
Flags, IP address |
~6 |
|
Positive Name Release Response Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
9 |
Positive Name Release Response |
Sent to confirm successful name release |
|
Transaction ID |
Matches the request |
2 |
|
Flags |
0x8500 (positive response) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-0 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
Negative Name Release Response Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
10 |
Negative Name Release Response |
Sent when a name release fails |
|
Transaction ID |
Matches the request |
2 |
|
Flags |
0x8503 (negative response) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-0 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
Error Code |
Indicates reason for failure |
1 |
|
Name Query Request Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
11 |
Name Query Request |
Sent to resolve a NetBIOS name to an IP address. |
|
Transaction ID |
Unique identifier |
2 |
|
Flags |
0x0000 (standard query) |
2 |
|
Questions |
Number of questions-1 |
2 |
|
Answer RRs |
Number of answer records-0 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Encoded NetBIOS name. |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
Name Query Response/ Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
12 |
Name Query Response/ |
Sent by a host that knows the IP address of the queried NetBIOS |
|
Positive Name Query Response |
name |
||
Transaction ID |
Must match the query’s ID |
2 |
|
Flags |
0x8500 (response, authoritative) |
2 |
|
Questions |
Echoed from query |
2 |
|
Answer RRs |
1 |
2 |
|
Authority RRs |
0 |
2 |
|
Additional RRs |
0 |
2 |
|
Question Name |
Echoed from query |
34 |
|
Question Type |
Echoed from query |
2 |
|
Question Class |
Echoed from query |
2 |
|
Name |
Echoed NetBIOS name |
34 |
|
Type |
0x0020 (NB) |
2 |
|
Class |
0x0001 (IN) |
2 |
|
TTL |
Time to live |
4 |
|
RDLENGTH |
Length of RDATA |
2 |
|
RDATA |
Flags + Number of IPs + IP address(es) |
~6 |
|
Negative Name Query Response Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
13 |
Negative Name Query Response |
Sent when a queried name is not found |
|
Transaction ID |
Matches the query |
2 |
|
Flags |
0x8503 (negative response) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-0 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
Error Code |
Indicates name not found |
1 |
|
Redirect Name Query Response Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
14 |
Redirect Name Query Response |
Instructs the requester to query a different name server |
|
Transaction ID |
Matches the query |
2 |
|
Flags |
0x850C (redirect response) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 (contains the name being registered) |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Queried NetBIOS name |
34 |
|
RR Type |
0x0020 (NB). |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
Time to live for the name. |
4 |
|
RDLENGTH |
Length of RDATA. |
2 |
|
RDATA |
Flags, redirect IP address. |
~6 |
|
Wait for Acknowledgement (WACK) Response Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
15 |
Wait for Acknowledgement (WACK) Response |
Sent to indicate that the server is processing the request |
|
Transaction ID |
Matches the request |
2 |
|
Flags |
0x850F (WACK response) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-0 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
Node Status Request Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
16 |
Node Status Request |
Sent to request status information from a node |
|
Transaction ID |
Unique identifier |
2 |
|
Flags |
0x0000 (standard query) |
2 |
|
Questions |
Number of questions-1 |
2 |
|
Answer RRs |
Number of answer records-0 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Encoded NetBIOS name (usually wildcard *) |
34 |
|
RR Type |
0x0021 (NBSTAT) |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
Node Status Response Packet
S.No |
Protocol Packets |
Description |
Size(bytes) |
|---|---|---|---|
17 |
Node Status Response |
Returns status information including name table and statistics |
|
Transaction ID |
Matches the request |
2 |
|
Flags |
0x8500 (positive response) |
2 |
|
Questions |
Number of questions-0 |
2 |
|
Answer RRs |
Number of answer records-1 |
2 |
|
Authority RRs |
Number of authority records-0 |
2 |
|
Additional RRs |
Number of additional records-0 |
2 |
|
RR Name |
Queried NetBIOS name |
34 |
|
RR Type |
0x0021 (NBSTAT) |
2 |
|
RR Class |
0x0001 (IN - Internet). |
2 |
|
TTL |
Time to live |
4 |
|
RDLENGTH |
Length of RDATA |
2 |
|
RDATA |
Name table, MAC address, statistics |
Variable |
|
(~50100+) |
|||
S.no |
Use Case |
Description |
|---|---|---|
1 |
Name Resolution in LANs |
Resolves NetBIOS names to IP addresses within local networks, |
allowing devices to communicate using human-readable names. |
||
2 |
Legacy Windows Networking |
Supports older Windows systems and applications that rely on |
NetBIOS for file and printer sharing. |
||
3 |
WINS Integration |
Works with Windows Internet Name Service (WINS) to provide |
centralized name resolution in larger or routed networks. |
||
4 |
Peer-to-Peer File Sharing |
Enables name-based communication between computers in |
peer-to-peer environments without DNS. |
||
5 |
Network Browsing |
Facilitates the display of computers and shared resources in the |
Windows Network Neighborhood or My Network Places. |
||
6 |
Printer and Resource Discovery |
Helps locate shared printers and other network resources by |
name in small office/home office (SOHO) setups. |
||
7 |
Fallback Name Resolution |
Acts as a backup when DNS is unavailable or not configured, |
especially in legacy or isolated networks. |
S.no |
Feature |
Description |
|---|---|---|
1 |
Name-to-IP Resolution |
Resolves NetBIOS names to IP addresses, enabling name-based communication in local networks. |
2 |
Broadcast-Based Queries |
Uses broadcast messages to resolve names in small, flat networks without a central server. |
3 |
WINS Server Support |
Can work with a WINS server for centralized name registration |
and resolution across subnets |
||
4 |
Name Registration |
Allows devices to register their NetBIOS names on the network, |
preventing name conflicts. |
||
5 |
Name Conflict Detection |
Detects and prevents duplicate NetBIOS names on the same network. |
6 |
Legacy Compatibility |
Supports older Windows and DOS-based systems that rely on |
NetBIOS for networking. |
||
7 |
Session Layer Integration |
Works with NetBIOS Session Service to establish and manage |
between applications. |
||
8 |
Limited Scope |
Primarily designed for small to medium-sized LANs; not 4 |
scalable for large or internet-wide use. |
NAME-to-IP Resolution - Testcases
# |
Test Case |
Description |
Expected Result |
|---|---|---|---|
1 |
Resolve valid NetBIOS name |
Query known name |
Correct IP returned |
2 |
Resolve unknown name |
Query unknown name |
No IP returned |
3 |
Resolve name with broadcast |
Use broadcast query |
IP returned if name exists |
4 |
Resolve name with WINS |
Use WINS server |
IP returned from WINS |
5 |
Resolve name with cache |
Use local cache |
IP returned from cache |
6 |
Resolve name with timeout |
Server delay |
Query times out |
7 |
Resolve name with retry |
Retry after timeout |
IP returned on retry |
8 |
Resolve name with duplicate entries |
Same name on two devices |
Conflict detected |
9 |
Resolve name with invalid format |
Malformed name |
Query rejected |
10 |
Resolve name with special characters |
Name with symbols |
Query fails |
11 |
Resolve name with max length |
15-character name |
IP resolved |
12 |
Resolve name with short length |
1-character name |
IP resolved |
13 |
Resolve name with mixed case |
Upper/lowercase |
Case-insensitive match |
14 |
Resolve name with whitespace |
Name with spaces |
Query fails |
15 |
Resolve name with numeric only |
Digits only |
IP resolved |
16 |
Resolve name with non-ASCII |
Unicode characters |
Query fails |
17 |
Resolve name with broadcast disabled |
No broadcast allowed |
Query fails |
18 |
Resolve name with WINS disabled |
No WINS server |
Query fails |
19 |
Resolve name with firewall |
Port blocked |
Query fails |
20 |
Resolve name with antivirus |
Security software active |
Query allowed |
21 |
Resolve name with VPN |
Over VPN tunnel |
IP resolved |
22 |
Resolve name with subnet change |
Different subnet |
Query fails without WINS |
23 |
Resolve name with DNS fallback |
DNS enabled |
DNS not used |
24 |
Resolve name with static mapping |
Hosts file entry |
IP resolved locally |
25 |
Resolve name with dynamic IP |
DHCP-assigned IP |
IP resolved correctly |
26 |
Resolve name with expired lease |
DHCP lease expired |
IP may be outdated |
27 |
Resolve name with NetBIOS disabled |
Client disabled NetBIOS |
Query fails |
28 |
Resolve name with NetBIOS over TCP/IP |
Enabled |
IP resolved |
29 |
Resolve name with IPv6 |
IPv6 only |
Query fails (IPv4 only) |
30 |
Resolve name with IPv4 |
IPv4 enabled |
IP resolved |
31 |
Resolve name with multiple NICs |
Multiple interfaces |
Correct IP resolved |
32 |
Resolve name with loopback |
Localhost name |
IP resolved as 127.0.0.1 |
33 |
Resolve name with virtual machine |
VM hostname |
IP resolved |
34 |
Resolve name with container |
Docker container |
IP resolved if exposed |
35 |
Resolve name with mobile device |
Smartphone on LAN |
IP resolved |
36 |
Resolve name with legacy OS |
Windows XP |
IP resolved |
37 |
Resolve name with modern OS |
Windows 11 |
IP resolved |
38 |
Resolve name with Linux client |
Samba installed |
IP resolved |
39 |
Resolve name with macOS client |
NetBIOS enabled |
IP resolved |
40 |
Resolve name with name conflict |
Two devices same name |
Conflict detected |
41 |
Resolve name with name release |
Name released |
Query fails |
42 |
Resolve name with name refresh |
Name re-registered |
IP updated |
43 |
Resolve name with name cache flush |
Cache cleared |
Query sent to network |
44 |
Resolve name with name suffix |
Name with suffix (e.g., WORKGROUP) |
IP resolved |
45 |
Resolve name with group name |
NetBIOS group name |
No IP returned |
46 |
Resolve name with session service |
Session active |
IP resolved |
47 |
Resolve name with datagram service |
Datagram active |
IP resolved |
48 |
Resolve name with name query tool |
Use nbtstat |
IP displayed |
49 |
Resolve name with packet capture |
Monitor traffic |
NBNS query visible |
50 |
Resolve name with spoofed response |
Malicious reply |
IP may be incorrect |
Broadcast-Based Queries - Testcases
# |
Test Case |
Description |
Expected Result |
|---|---|---|---|
1 |
Standard broadcast query |
Send NBNS broadcast |
Name resolved if present |
2 |
No name on network |
Query unknown name |
No response |
3 |
Multiple devices respond |
Same name on two devices |
Conflict detected |
4 |
Broadcast disabled |
Network blocks broadcast |
Query fails |
5 |
Broadcast with firewall |
Firewall blocks UDP 137 |
Query fails |
6 |
Broadcast with VLAN |
Same VLAN |
Query succeeds |
7 |
Broadcast across VLANs |
Different VLANs |
Query fails |
8 |
Broadcast with subnet mask |
Proper subnet config |
Query succeeds |
9 |
Broadcast with incorrect mask |
Misconfigured subnet |
Query fails |
10 |
Broadcast with Wi-Fi |
Wireless client sends NBNS |
Query succeeds |
11 |
Broadcast with Ethernet |
Wired client sends NBNS |
Query succeeds |
12 |
Broadcast with loopback |
Localhost sends NBNS |
No response |
13 |
Broadcast with VPN |
VPN tunnel active |
Query may fail |
14 |
Broadcast with NAT |
Behind NAT |
Query fails |
15 |
Broadcast with proxy |
Proxy in path |
No effect |
16 |
Broadcast with packet sniffer |
Monitor NBNS traffic |
Broadcast visible |
17 |
Broadcast with spoofed name |
Fake name sent |
May cause conflict |
18 |
Broadcast with invalid format |
Malformed packet |
Dropped |
19 |
Broadcast with valid format |
Proper NBNS structure |
Query processed |
20 |
Broadcast with delay |
Network latency |
Delayed response |
21 |
Broadcast with retry |
No response initially |
Retry sent |
22 |
Broadcast with timeout |
No reply in time |
Query fails |
23 |
Broadcast with name cache |
Name cached locally |
No broadcast sent |
24 |
Broadcast with cache flush |
Cache cleared |
Broadcast sent |
25 |
Broadcast with name suffix |
Name with suffix |
Query processed |
26 |
Broadcast with group name |
NetBIOS group name |
No IP returned |
27 |
Broadcast with session service |
Session active |
Broadcast still used |
28 |
Broadcast with datagram service |
Datagram active |
Broadcast still used |
29 |
Broadcast with legacy OS |
Windows 98 |
Broadcast supported |
30 |
Broadcast with modern OS |
Windows 11 |
Broadcast supported |
31 |
Broadcast with Linux |
Samba installed |
Broadcast supported |
32 |
Broadcast with macOS |
NetBIOS enabled |
Broadcast supported |
33 |
Broadcast with mobile device |
Android/iOS |
May not support NBNS |
34 |
Broadcast with virtual machine |
VM sends NBNS |
Query succeeds |
35 |
Broadcast with container |
Docker container |
Query succeeds if bridged |
36 |
Broadcast with embedded device |
IoT device sends NBNS |
Query succeeds |
37 |
Broadcast with name conflict |
Two devices respond |
Conflict detected |
38 |
Broadcast with name release |
Device releases name |
No response |
39 |
Broadcast with name refresh |
Device re-registers |
Query succeeds |
40 |
Broadcast with name registration |
Device registers name |
Query succeeds |
41 |
Broadcast with name deregistration |
Name removed |
Query fails |
42 |
Broadcast with WINS enabled |
WINS server present |
Broadcast still used |
43 |
Broadcast with WINS disabled |
No WINS server |
Broadcast required |
44 |
Broadcast with DNS fallback |
DNS enabled |
NBNS used first |
45 |
Broadcast with IPv6 |
IPv6-only network |
NBNS fails |
46 |
Broadcast with IPv4 |
IPv4 enabled |
NBNS works |
47 |
Broadcast with UDP port 137 |
Correct port used |
Query succeeds |
48 |
Broadcast with TCP port 137 |
Wrong protocol |
Query fails |
49 |
Broadcast with name resolution tool |
Use nbtstat |
Broadcast visible |
50 |
Broadcast with network congestion |
Heavy traffic |
Query may be delayed |
WINS Server Support - Testcases
# |
Test Case |
Description |
Expected Result |
|---|---|---|---|
1 |
WINS server available |
Client queries WINS |
Name resolved |
2 |
WINS server unreachable |
Network issue |
Query fails |
3 |
WINS server disabled |
Service stopped |
Query fails |
4 |
WINS server on different subnet |
Cross-subnet query |
Name resolved |
5 |
WINS server with static entry |
Name pre-registered |
IP returned |
6 |
WINS server with dynamic entry |
Name registered by client |
IP returned |
7 |
WINS server with duplicate names |
Conflict in database |
Conflict detected |
8 |
WINS server with name release |
Name removed |
Query fails |
9 |
WINS server with name refresh |
Name updated |
New IP returned |
10 |
WINS server with name conflict |
Two clients register same name |
Conflict logged |
11 |
WINS server with replication |
Secondary server syncs |
Name resolved from replica |
12 |
WINS server with backup |
Failover server active |
Query succeeds |
13 |
WINS server with firewall |
Port 137 blocked |
Query fails |
14 |
WINS server with DNS integration |
DNS fallback enabled |
NBNS used first |
15 |
WINS server with IPv6 |
IPv6-only network |
Query fails |
16 |
WINS server with IPv4 |
IPv4 network |
Query succeeds |
17 |
WINS server with name cache |
Cached name used |
No query sent |
18 |
WINS server with cache flush |
Cache cleared |
Query sent |
19 |
WINS server with packet capture |
Monitor traffic |
WINS query visible |
20 |
WINS server with spoofed response |
Malicious reply |
IP may be incorrect |
21 |
WINS server with logging |
Logs all queries |
Entry recorded |
22 |
WINS server with monitoring |
SNMP enabled |
Query tracked |
23 |
WINS server with load balancing |
Multiple servers |
Query distributed |
24 |
WINS server with high latency |
Slow response |
Query delayed |
25 |
WINS server with retry logic |
No response initially |
Retry sent |
26 |
WINS server with timeout |
No reply in time |
Query fails |
27 |
WINS server with name suffix |
Name with suffix |
IP resolved |
28 |
WINS server with group name |
Group name queried |
No IP returned |
29 |
WINS server with session service |
Session active |
Name resolved |
30 |
WINS server with datagram service |
Datagram active |
Name resolved |
31 |
WINS server with legacy OS |
Windows NT client |
Query succeeds |
32 |
WINS server with modern OS |
Windows 11 client |
Query succeeds |
33 |
WINS server with Linux client |
Samba configured |
Query succeeds |
34 |
WINS server with macOS client |
NetBIOS enabled |
Query succeeds |
35 |
WINS server with mobile device |
Android/iOS |
Query unsupported |
36 |
WINS server with virtual machine |
VM queries WINS |
IP resolved |
37 |
WINS server with container |
Docker container |
IP resolved if bridged |
38 |
WINS server with embedded device |
IoT device |
Query succeeds |
39 |
WINS server with name registration tool |
Use nbtstat -RR |
Name refreshed |
40 |
WINS server with name query tool |
Use nbtstat -a |
IP displayed |
41 |
WINS server with DNS disabled |
No DNS fallback |
WINS used |
42 |
WINS server with DNS enabled |
DNS fallback active |
NBNS used first |
43 |
WINS server with DHCP |
IP assigned dynamically |
Name registered |
44 |
WINS server with static IP |
Fixed IP |
Name registered |
45 |
WINS server with name deregistration |
Name removed |
Query fails |
46 |
WINS server with name conflict resolution |
Conflict resolved |
Correct IP returned |
47 |
WINS server with replication delay |
Sync lag |
Old IP returned |
48 |
WINS server with audit log |
Query logged |
Entry recorded |
49 |
WINS server with compliance scan |
Security audit |
WINS detected |
50 |
WINS server with performance test |
High query volume |
Server handles load |
Name Registration - Testcases
# |
Test Case |
Description |
Expected Result |
|---|---|---|---|
1 |
Register unique name |
Device registers new name |
Registration successful |
2 |
Register duplicate name |
Name already in use |
Conflict detected |
3 |
Register name on boot |
Device boots up |
Name registered |
4 |
Register name manually |
Use nbtstat -RR |
Name refreshed |
5 |
Register name with WINS |
WINS server available |
Name registered centrally |
6 |
Register name without WINS |
No WINS server |
Name registered via broadcast |
7 |
Register name with invalid format |
Malformed name |
Registration fails |
8 |
Register name with max length |
15 characters |
Registration successful |
9 |
Register name with special characters |
Symbols in name |
Registration fails |
10 |
Register name with whitespace |
Spaces in name |
Registration fails |
11 |
Register name with numeric only |
Digits only |
Registration successful |
12 |
Register name with mixed case |
Upper/lowercase |
Case-insensitive match |
13 |
Register name with suffix |
Name with <03> suffix |
Registered with service type |
14 |
Register group name |
NetBIOS group name |
Registered as group |
15 |
Register name with session service |
Session active |
Name registered |
16 |
Register name with datagram service |
Datagram active |
Name registered |
17 |
Register name with legacy OS |
Windows 98 |
Name registered |
18 |
Register name with modern OS |
Windows 11 |
Name registered |
19 |
Register name with Linux |
Samba client |
Name registered |
20 |
Register name with macOS |
NetBIOS enabled |
Name registered |
21 |
Register name with mobile device |
Android/iOS |
Not supported |
22 |
Register name with virtual machine |
VM boots |
Name registered |
23 |
Register name with container |
Docker container |
Name registered if bridged |
24 |
Register name with embedded device |
IoT device |
Name registered |
25 |
Register name with DHCP |
IP assigned dynamically |
Name registered |
26 |
Register name with static IP |
Fixed IP |
Name registered |
27 |
Register name with name conflict |
Same name on two devices |
Conflict detected |
28 |
Register name with name release |
Name released |
Available for reuse |
29 |
Register name with name refresh |
Name re-registered |
Updated successfully |
30 |
Register name with cache flush |
Clear name cache |
Name re-registered |
31 |
Register name with firewall |
Port 137 blocked |
Registration fails |
32 |
Register name with antivirus |
Security software active |
Registration allowed |
33 |
Register name with VPN |
Over VPN tunnel |
May fail |
34 |
Register name with subnet change |
New subnet |
Name re-registered |
35 |
Register name with packet capture |
Monitor traffic |
Registration visible |
36 |
Register name with spoofed MAC |
Fake MAC address |
Name may be registered |
37 |
Register name with spoofed name |
Fake name |
May cause conflict |
38 |
Register name with invalid suffix |
Unknown suffix |
Registration fails |
39 |
Register name with name conflict resolution |
Conflict resolved |
Name registered |
40 |
Register name with retry |
Initial failure |
Retry succeeds |
41 |
Register name with timeout |
No response |
Registration fails |
42 |
Register name with logging |
Server logs registration |
Entry recorded |
43 |
Register name with monitoring |
SNMP or audit tool |
Registration tracked |
44 |
Register name with compliance scan |
Security audit |
Name registration detected |
45 |
Register name with DNS integration |
DNS enabled |
NBNS used for NetBIOS |
46 |
Register name with IPv6 |
IPv6-only network |
Registration fails |
47 |
Register name with IPv4 |
IPv4 network |
Registration succeeds |
48 |
Register name with name query tool |
Use nbtstat -n |
Name listed |
49 |
Register name with name release tool |
Use nbtstat -R |
Name removed |
50 |
Register name with performance test |
High volume of registrations |
Server handles load |
Name Conflict Detection - Testcases
# |
Test Case |
Description |
Expected Result |
|---|---|---|---|
1 |
Register duplicate name |
Two devices use same name |
Conflict detected |
2 |
Register same name on boot |
Both devices boot simultaneously |
Conflict detected |
3 |
Register same name manually |
Manual name config |
Conflict detected |
4 |
Register same name via WINS |
WINS server detects conflict |
Conflict logged |
5 |
Register same name via broadcast |
Broadcast registration |
Conflict detected |
6 |
Conflict with different IPs |
Same name, different IPs |
Conflict detected |
7 |
Conflict with same IP |
Same name and IP |
No conflict |
8 |
Conflict with different MACs |
Same name, different MACs |
Conflict detected |
9 |
Conflict with virtual machine |
VM uses duplicate name |
Conflict detected |
10 |
Conflict with container |
Docker container uses same name |
Conflict detected |
11 |
Conflict with legacy OS |
Windows 98 uses duplicate name |
Conflict detected |
12 |
Conflict with modern OS |
Windows 11 uses duplicate name |
Conflict detected |
13 |
Conflict with Linux |
Samba client uses duplicate name |
Conflict detected |
14 |
Conflict with macOS |
NetBIOS name conflict |
Conflict detected |
15 |
Conflict with mobile device |
Android/iOS uses same name |
Conflict detected |
16 |
Conflict with embedded device |
IoT device uses same name |
Conflict detected |
17 |
Conflict with DHCP |
DHCP assigns same name |
Conflict detected |
18 |
Conflict with static IP |
Static IP, duplicate name |
Conflict detected |
19 |
Conflict with name suffix |
Same base name, different suffix |
No conflict |
20 |
Conflict with group name |
Group name reused |
Conflict detected |
21 |
Conflict with session service |
Session fails to start |
Conflict detected |
22 |
Conflict with datagram service |
Datagram fails |
Conflict detected |
23 |
Conflict with name refresh |
Re-register same name |
Conflict detected |
24 |
Conflict with name release |
Name not released |
Conflict persists |
25 |
Conflict with name cache |
Cached name reused |
Conflict detected |
26 |
Conflict with spoofed name |
Malicious name used |
Conflict detected |
27 |
Conflict with spoofed MAC |
Same name, fake MAC |
Conflict detected |
28 |
Conflict with WINS replication |
Conflict across servers |
Detected and logged |
29 |
Conflict with WINS failover |
Secondary server detects conflict |
Conflict handled |
30 |
Conflict with firewall |
Port 137 blocked |
Conflict not detected |
31 |
Conflict with antivirus |
Security software active |
Conflict detected |
32 |
Conflict with VPN |
Same name over VPN |
Conflict detected |
33 |
Conflict with subnet change |
Same name on new subnet |
Conflict detected |
34 |
Conflict with VLAN |
Same name across VLANs |
Conflict detected |
35 |
Conflict with loopback |
Localhost uses duplicate name |
Conflict detected |
36 |
Conflict with name registration tool |
Use nbtstat -RR |
Conflict detected |
37 |
Conflict with name query tool |
Use nbtstat -a |
Conflicting IPs shown |
38 |
Conflict with packet capture |
Monitor NBNS traffic |
Conflict visible |
39 |
Conflict with logging |
Server logs conflict |
Entry recorded |
40 |
Conflict with monitoring |
SNMP or audit tool |
Conflict tracked |
41 |
Conflict with compliance scan |
Security audit |
Conflict flagged |
42 |
Conflict with DNS integration |
DNS not affected |
NBNS conflict detected |
43 |
Conflict with IPv6 |
IPv6-only network |
NBNS not used |
44 |
Conflict with IPv4 |
IPv4 network |
Conflict detected |
45 |
Conflict with name deregistration |
Name not removed |
Conflict persists |
46 |
Conflict with name suffix collision |
Same suffix used |
Conflict detected |
47 |
Conflict with name expiration |
Name not expired |
Conflict detected |
48 |
Conflict with name reservation |
Reserved name reused |
Conflict detected |
49 |
Conflict with performance test |
High volume of names |
Conflicts detected |
50 |
Conflict with audit log |
Review logs |
Conflicts documented |
Legacy Compatiblity - Testcases
# |
Test Case |
Description |
Expected Result |
|---|---|---|---|
1 |
Windows 95 name resolution |
Use NBNS on Windows 95 |
Name resolved |
2 |
Windows 98 name registration |
Register name on boot |
Name registered |
3 |
Windows ME name conflict detection |
Duplicate name test |
Conflict detected |
4 |
Windows NT 4.0 WINS support |
Query via WINS |
Name resolved |
5 |
Windows 2000 NBNS broadcast |
Send broadcast query |
Name resolved |
6 |
DOS with NetBIOS stack |
Use NetBIOS over TCP/IP |
Name resolved |
7 |
Windows 3.11 with TCP/IP |
Use NBNS |
Name resolved |
8 |
Legacy OS with static IP |
Register name |
Name registered |
9 |
Legacy OS with DHCP |
Dynamic IP assigned |
Name registered |
10 |
Legacy OS with WINS server |
Centralized resolution |
Name resolved |
11 |
Legacy OS with no WINS |
Broadcast used |
Name resolved |
12 |
Legacy OS with name conflict |
Duplicate name |
Conflict detected |
13 |
Legacy OS with name release |
Release name |
Name removed |
14 |
Legacy OS with name refresh |
Re-register name |
Name updated |
15 |
Legacy OS with group name |
Register group name |
Group name registered |
16 |
Legacy OS with session service |
Start NetBIOS session |
Session established |
17 |
Legacy OS with datagram service |
Send datagram |
Datagram delivered |
18 |
Legacy OS with firewall |
Port 137 blocked |
NBNS fails |
19 |
Legacy OS with antivirus |
Security software active |
NBNS allowed |
20 |
Legacy OS with packet capture |
Monitor NBNS traffic |
Visible in capture |
21 |
Legacy OS with spoofed name |
Fake name used |
Conflict detected |
22 |
Legacy OS with spoofed MAC |
Fake MAC used |
Name registered |
23 |
Legacy OS with modern WINS |
Query modern WINS server |
Name resolved |
24 |
Legacy OS with modern OS |
Communicate with Windows 11 |
Name resolved |
25 |
Legacy OS with Linux Samba |
Query Samba NBNS |
Name resolved |
26 |
Legacy OS with macOS |
NetBIOS name resolution |
Name resolved |
27 |
Legacy OS with mobile device |
Android/iOS on LAN |
No NBNS support |
28 |
Legacy OS with VM |
Legacy OS in VM |
NBNS works |
29 |
Legacy OS with container |
Legacy app in container |
NBNS fails |
30 |
Legacy OS with embedded device |
IoT device on LAN |
NBNS works |
31 |
Legacy OS with VLAN |
Same VLAN |
NBNS works |
32 |
Legacy OS with subnet change |
Move to new subnet |
WINS needed |
33 |
Legacy OS with DNS fallback |
DNS enabled |
NBNS used first |
34 |
Legacy OS with IPv6 |
IPv6-only network |
NBNS fails |
35 |
Legacy OS with IPv4 |
IPv4 network |
NBNS works |
36 |
Legacy OS with name cache |
Cached name used |
No query sent |
37 |
Legacy OS with cache flush |
Clear cache |
Query sent |
38 |
Legacy OS with name suffix |
Register with suffix |
Name registered |
39 |
Legacy OS with name deregistration |
Remove name |
Name removed |
40 |
Legacy OS with name conflict resolution |
Conflict resolved |
Name registered |
41 |
Legacy OS with logging |
Log NBNS activity |
Entries recorded |
42 |
Legacy OS with monitoring |
SNMP or audit tool |
NBNS tracked |
43 |
Legacy OS with compliance scan |
Security audit |
NBNS detected |
44 |
Legacy OS with performance test |
High volume of queries |
NBNS handles load |
45 |
Legacy OS with reboot |
Reboot system |
Name re-registered |
46 |
Legacy OS with sleep/wake |
Resume from sleep |
Name re-registered |
47 |
Legacy OS with network disconnect |
Reconnect to LAN |
Name re-registered |
48 |
Legacy OS with NetBIOS disabled |
Disable NetBIOS |
NBNS fails |
49 |
Legacy OS with NetBIOS enabled |
Enable NetBIOS |
NBNS works |
50 |
Legacy OS with modern switch |
Connected to gigabit switch |
NBNS works |
Session Layer Integration - Testcases
# |
Test Case |
Description |
Expected Result |
|---|---|---|---|
1 |
Start NetBIOS session |
Initiate session between two hosts |
Session established |
2 |
End NetBIOS session |
Close active session |
Session terminated |
3 |
Session with valid name |
Use registered NetBIOS name |
Session succeeds |
4 |
Session with unregistered name |
Name not found |
Session fails |
5 |
Session with duplicate name |
Conflict in name |
Session fails |
6 |
Session with WINS resolution |
Name resolved via WINS |
Session succeeds |
7 |
Session with broadcast resolution |
Name resolved via broadcast |
Session succeeds |
8 |
Session with timeout |
No response from peer |
Session fails |
9 |
Session with retry |
Retry after failure |
Session established |
10 |
Session with firewall |
Port 139 blocked |
Session fails |
11 |
Session with antivirus |
Security software active |
Session allowed |
12 |
Session with legacy OS |
Windows 98 |
Session established |
13 |
Session with modern OS |
Windows 11 |
Session established |
14 |
Session with Linux |
Samba client |
Session established |
15 |
Session with macOS |
NetBIOS enabled |
Session established |
16 |
Session with mobile device |
Android/iOS |
Session not supported |
17 |
Session with virtual machine |
VM initiates session |
Session succeeds |
18 |
Session with container |
Docker container |
Session succeeds if bridged |
19 |
Session with embedded device |
IoT device |
Session established |
20 |
Session with group name |
Group name used |
Session fails |
21 |
Session with name suffix |
Name with <20> suffix |
Session succeeds |
22 |
Session with datagram service |
Datagram active |
Session unaffected |
23 |
Session with name refresh |
Name re-registered |
Session re-established |
24 |
Session with name release |
Name released |
Session fails |
25 |
Session with name conflict |
Duplicate name |
Session fails |
26 |
Session with packet capture |
Monitor traffic |
Session packets visible |
27 |
Session with spoofed name |
Fake name used |
Session may be hijacked |
28 |
Session with spoofed IP |
Fake IP used |
Session fails |
29 |
Session with DNS fallback |
DNS used instead |
Session fails (NetBIOS required) |
30 |
Session with IPv6 |
IPv6-only network |
Session fails |
31 |
Session with IPv4 |
IPv4 network |
Session succeeds |
32 |
Session with subnet change |
Peer on different subnet |
Session fails without WINS |
33 |
Session with VLAN |
Same VLAN |
Session succeeds |
34 |
Session with NAT |
Behind NAT |
Session may fail |
35 |
Session with VPN |
Over VPN tunnel |
Session succeeds |
36 |
Session with loopback |
Localhost session |
Session established |
37 |
Session with name cache |
Cached name used |
Session succeeds |
38 |
Session with cache flush |
Cache cleared |
Session re-established |
39 |
Session with logging |
Log session activity |
Entries recorded |
40 |
Session with monitoring |
SNMP or audit tool |
Session tracked |
41 |
Session with compliance scan |
Security audit |
Session detected |
42 |
Session with performance test |
High session volume |
Server handles load |
43 |
Session with reboot |
Peer reboots |
Session terminated |
44 |
Session with sleep/wake |
Peer resumes |
Session re-established |
45 |
Session with disconnect |
Network cable unplugged |
Session lost |
46 |
Session with reconnect |
Reconnect to LAN |
Session re-established |
47 |
Session with NetBIOS disabled |
NetBIOS off |
Session fails |
48 |
Session with NetBIOS enabled |
NetBIOS on |
Session succeeds |
49 |
Session with SMB over NetBIOS |
File sharing session |
Session succeeds |
50 |
Session with remote login |
Remote NetBIOS login |
Session succeeds |
Limited Scope - Testcases
# |
Test Case |
Description |
Expected Result |
|---|---|---|---|
1 |
NBNS in small LAN |
10 devices on same subnet |
Name resolution succeeds |
2 |
NBNS in medium LAN |
100 devices |
Name resolution succeeds |
3 |
NBNS in large LAN |
500+ devices |
Performance degrades |
4 |
NBNS across subnets |
No WINS server |
Name resolution fails |
5 |
NBNS with WINS across subnets |
WINS enabled |
Name resolution succeeds |
6 |
NBNS over internet |
Public network |
Name resolution fails |
7 |
NBNS with NAT |
Devices behind NAT |
Name resolution fails |
8 |
NBNS with VPN |
Remote access via VPN |
Name resolution may fail |
9 |
NBNS with VLANs |
Multiple VLANs |
Name resolution fails without WINS |
10 |
NBNS with broadcast domain |
Single broadcast domain |
Name resolution succeeds |
11 |
NBNS with segmented network |
Broadcasts restricted |
Name resolution fails |
12 |
NBNS with cloud-hosted devices |
Devices in cloud |
Name resolution fails |
13 |
NBNS with mobile clients |
Roaming devices |
Name resolution fails |
14 |
NBNS with IPv6-only network |
No IPv4 |
NBNS unsupported |
15 |
NBNS with IPv4 network |
IPv4 enabled |
NBNS works |
16 |
NBNS with DNS fallback |
DNS used instead |
NBNS bypassed |
17 |
NBNS with high latency |
WAN environment |
Name resolution delayed |
18 |
NBNS with packet loss |
Unreliable network |
Name resolution fails |
19 |
NBNS with firewall |
Port 137 blocked |
NBNS fails |
20 |
NBNS with proxy |
Proxy in path |
NBNS unsupported |
21 |
NBNS with multicast routing |
Multicast enabled |
NBNS still fails across subnets |
22 |
NBNS with broadcast suppression |
Switch blocks broadcast |
NBNS fails |
23 |
NBNS with wireless mesh |
Multi-hop Wi-Fi |
NBNS unreliable |
24 |
NBNS with satellite link |
High-latency link |
NBNS fails |
25 |
NBNS with SD-WAN |
Software-defined WAN |
NBNS unsupported |
26 |
NBNS with cloud VPN |
Cloud-hosted VPN |
NBNS fails |
27 |
NBNS with container networks |
Docker bridge |
NBNS works locally |
28 |
NBNS with Kubernetes |
Pod-to-pod communication |
NBNS unsupported |
29 |
NBNS with IoT mesh |
IoT devices on mesh |
NBNS unsupported |
30 |
NBNS with hybrid cloud |
On-prem + cloud |
NBNS fails in cloud |
31 |
NBNS with remote office |
No WINS, different subnet |
NBNS fails |
32 |
NBNS with branch router |
Router blocks broadcast |
NBNS fails |
33 |
NBNS with split tunnel VPN |
Local LAN access only |
NBNS may work |
34 |
NBNS with full tunnel VPN |
All traffic routed |
NBNS fails |
35 |
NBNS with mobile hotspot |
Devices on hotspot |
NBNS may work locally |
36 |
NBNS with public Wi-Fi |
Hotel or caf network |
NBNS fails |
37 |
NBNS with enterprise Wi-Fi |
WPA2-Enterprise |
NBNS works within subnet |
38 |
NBNS with cloud DNS |
DNS-only resolution |
NBNS not used |
39 |
NBNS with dynamic routing |
OSPF/BGP |
NBNS not routed |
40 |
NBNS with static routing |
Manual routes |
NBNS still fails across subnets |
41 |
NBNS with IPv6 tunneling |
IPv6-over-IPv4 |
NBNS unsupported |
42 |
NBNS with IPv4 tunneling |
IPv4-over-IPv6 |
NBNS may work locally |
43 |
NBNS with broadcast relay |
Broadcast forwarded |
NBNS may work |
44 |
NBNS with name caching |
Cached names used |
NBNS not needed |
45 |
NBNS with name registration |
Registered locally |
NBNS works in scope |
46 |
NBNS with name conflict |
Same name in different subnets |
Conflict undetected |
47 |
NBNS with name resolution tool |
Use nbtstat |
Works only in local subnet |
48 |
NBNS with packet capture |
Monitor traffic |
Broadcasts visible only locally |
49 |
NBNS with compliance audit |
Network audit |
NBNS flagged as limited |
50 |
NBNS with scalability test |
Simulate large network |
NBNS performance degrades |
Reference links