Introduction

The Windows Internet Name Service (WINS) provides a distributed database for registering and querying dynamic mappings of NetBIOS names for computers and groups used on your network. WINS maps NetBIOS names to IP addresses and was designed to solve the problems arising from NetBIOS name resolution in routed environments. The main benefit of a WINS server is that it avoids the need for broadcasts to resolve computer names to IP addresses.

Typically, WINS servers use UDP port 137. This port should be provided when you manually add a WINS server for monitoring. The steps below highlight how WINS works:

  • Name Registration: When a WINS client initializes, it registers its NetBIOS name by sending a name request to the configured WINS server. All services get registered as they are initialized in the WINS server database. If the WINS server is available and the name is not registered by another machine, the WINS server returns a successful registration message.

    If the NetBIOS name is already registered in the WINS database, the WINS server will send a challenge to the current registered owner. This request will be sent 3 times at 500ms intervals. If the current owner responds the WINS server will send a negative name resolution response to the WINS client attempting to register the name. If there is no response the registering client will receive a Name Registration response.

  • Name Renewal: To continue using the same NetBIOS name, a client must renew its lease before it expires. If the client does not renew the lease, the WINS server makes it available to another WINS client. A WINS client will first attempt to refresh its name registration request after 1/8 of the TTL is completed. If the client is successful subsequent name registration requests will occur when 1/2 the TTL is expired.

    If the client is unsuccessful with lease renewal on the initial attempt the client will try every 2 minutes until 1/2 TTL is remaining. At 1/2 of TTL the client will revert to the secondary WINS server if configured in 1/8 TTL intervals. At completion of TTL lease, the WINS client will revert back to the primary WINS server and start the process all over again.  

  • Name Release: Before the expiry of its lease, a client can send an explicit request to release the name assigned to it.

If even one of these steps experience latencies, it could cause a significant delay in the entire process of resolving an IP address to its corresponding NetBIOS name. This could be much worse in large environments where the WINS server might have to handle hundreds of concurrent ‘name resolution’ requests; here, even a seemingly insignificant drop in the processing rate of the WINS server can grow in severity within minutes, and can bring the whole environment to a virtual standstill! 

If such adverse consequences are to be prevented, it is recommended that you continuously monitor the processing ability of the WINS server, so that you are promptly alerted when there is any threat to its normal functioning.  The eG Enterprise helps administrators in this task.