WINS Replication

WINS-Replication (WINSRepl)

Multiple WINS servers can replicate the content with the WINS-Replication protocol.

WINS (Windows Internet Name Service) uses the same protocol as NBNS, but it uses unicast messages to a WINS-Servers, instead of broadcast messages


XXX - add a brief description of WINS-Replication history

Protocol dependencies

Example traffic

No.     Time        Source                Destination           Protocol Info
     30 151.458700          WINS-Replication WREPL_REPL_INFORM

Frame 30 (154 bytes on wire, 154 bytes captured)
Ethernet II, Src: Vmware_3b:ec:aa (00:0c:29:3b:ec:aa), Dst: Vmware_15:2c:37 (00:0c:29:15:2c:37)
Internet Protocol, Src: (, Dst: (
Transmission Control Protocol, Src Port: 1749 (1749), Dst Port: 42 (42), Seq: 46, Ack: 46, Len: 100
WINS (Windows Internet Name Service) Replication, WREPL_REPL_INFORM
    Packet Size: 96
    Opcode: 0x00007800
    Assoc_Ctx: 0x05371e90
    Message_Type: WREPL_REPLICATION (3)
        Replication Command: WREPL_REPL_INFORM (0x00000008)
            Partner Count: 3
            WINS Owner [0]
            WINS Owner [1]
            WINS Owner [2]
            Initiator: (


The WINS-Replication dissector is fully functional and also supports TCP reassembly.

Preference Settings

The preferences for WINS-Replication contains a setting to allow reassembly of PDUs spanning multiple segments.

Example capture file

Display Filter

A complete list of WINS-Replication display filter fields can be found in the display filter reference

Show only the WINS-Replication based traffic:


Capture Filter

You cannot directly filter the WINS-Replication protocol while capturing. However, if you know the TCP port used (see above), you can filter on that one.

Capture only the WINS-Replication traffic over the default port (42):

 tcp port 42

External links


Imported from on 2020-08-11 23:27:31 UTC