Saturday, September 10, 2011

Name Resolution

There are six types of name to IP address translation technologies in use by Windows-based computers today:

LMHOSTS: A static file within a computer (located in: %SystemRoot%\System32\Drivers\Etc *or for 64-bit OSs systems: %SystemRoot%\SysWOW64\Drivers\Etc*) with IP addresses corresponding to NetBIOS names.  This is mainly used for LAN Manager NET utilities (i.e: "net view") and entries can be outside of the local subnet.
- LMHOSTS file must be manually created (Lmhosts.sam is a preexisting sample file).  When you create the file, leave it with no extension.
Reference: http://support.microsoft.com/kb/180094 for proper Lmhost file configuration.

HOSTS:  A static file within a computer (located in: %SystemRoot%\System32\Drivers\Etc or for 64-bit OSs systems: %SystemRoot%\SysWOW64\Drivers\Etc) used for TCP/IP utilities such as ping, telnet, FTP, etc.
- The hosts file should be named "hosts" without an extension.
- Entries are case sensitive and multiple entries are permissible to reach the host (i.e: host1.domain.com, HOST1.DOMAIN.COM)
Reference http://support.microsoft.com/kb/972034 to bring the hosts file to default.

- Microsoft TechNet states that entries of the Lmhosts file are not case sensitive in one entry but says that domain entries are in another.  The domain name will be referenced by NetBT, and NetBT needs capitalized letters to reference the host.  Other entries however may not need to be that way.

* More research is to be done regarding the HOSTS file

NetBIOS: Only IPv4 support, supported on all Windows OSs by utilizing broadcasts.
There are four classifications defined, distinguished as "modes," that describe how NetBIOS is executed on nodes which consists of variations of network broadcasts and WINS server querying.
1) Broadcast (B-node): Broadcast for NetBIOS name registration
2) Point-to-Point (P-node): Query WINS server for NetBIOS name resolution.
3) Mixed Mode (M-node): Broadcast before WINS server query
4) Hybrid (H-node) (Windows default mode): Query WINS server, use the LMHOSTS file, then use broadcasts

The modes that take a multi-layered approach, that is, modes that use combinations of broadcasts, WINS server querying, &/or the LMHOSTS file, use if/then logic to move to the next sequential step.  For example, a m-node will not move on to a WINS server query if the broadcast is successful.*

WINS: Utilizes NetBIOS to reference name-to-IP address (NTIP) translation through its own NTIP repository.  WINS can translate nodees outside of the local subnet.

Local Link Multicast Name Resolution (LLMNR):  IPv4 and IPv6 support.  All OSs Vista and after support LLMNR and operate on multicast.
- To find a host, LLMNR sends a multicast on IPv6 and IPv4 protocols.  The computer with the relevant name-to-IP address will respond with their answer.

Domain Name System (DNS):  Naming structure is hierarchical beginning with the root, defined as "" (null), with a TLD or top level domain name such as "com," "co.uk" "mil," and so forth.  I assume that this is for versatility purposes as domain names can be converted to different symbols while utilizing alphanumerics to define domain names.  For example, FQDNs can be transitioned to www-domain-domain. instead of www.domain.com..  Moving left within the structure from the period and TLD (".com"), you get into specific domains, child domains, etc with a limit of 127 entries per a given tree.  Names must be registered within the DNS server in order for names to be resolved.
The internet DNS infrastructure is centralized within specific repositories called root hint servers for host name resolution.  Within intranets, local DNS servers with name to IP address & vice versa repositories are standard.  Be aware that without root hint servers, it would be difficult to resolve a name to an IP address for hosts for domains w/TLDs as there are many computers and networks that need to be queried in order to find a specific host.
The DNS structure can be likened to a tree.  The root, or base of the naming structure is blank, and once the TLD and domain has been defined (the trunk), you can add hosts (leaves), subdomains/child domains (branches) and their corresponding hosts (leaves) can be defined within it.

No comments:

Post a Comment