NetBIOS Name Service (NBNS)
The NetBIOS Name Service is part of the NetBIOS-over-TCP protocol suite, see the ["NetBIOS"] page for further information.
This protocol is often called WINS in ["CIFS"] documentation.
XXX - add a brief description of NBNS history
- ["UDP"]: Typically, NBNS uses ["UDP"] as its transport protocol. The wellknown UDP port for NBNS traffic is 137.
- ["TCP"]: NBNS can also use ["TCP"] as its transport protocol for some operations, although this might never be done in practice. The wellknown TCP port for NBNS traffic is 137.
XXX - Add example traffic here (as plain text or Ethereal screenshot).
The NBNS dissector is partially functional; it dissects NBNS-over-UDP, but not NBNS-over-TCP (I'm not sure we've ever seen any NBNS-over-TCP traffic).
(XXX add links to preference settings affecting how NBNS is dissected).
Example capture file
XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.
A complete list of NBNS display filter fields can be found in the [http://www.ethereal.com/docs/dfref/n/nbns.html display filter reference]
Show only the NBNS based traffic:
You cannot directly filter NBNS while capturing. However, as it runs atop ["UDP"] or ["TCP"] port 137, you can filter on those ports.
Capture NBNS traffic:
[http://www.ietf.org/rfc/rfc1001.txt RFC1001] Protocol Standard For a NetBIOS Service on a TCP/UDP Transport: Concepts and Methods
[http://www.ietf.org/rfc/rfc1002.txt RFC1002] Protocol Standard For a NetBIOS Service on a TCP/UDP Transport: Detailed Specifications