Friday, June 17, 2005

Netbeui, NWlink, TCP/IP, NetBios

Windows NT supports several network protocols, and the protocol you use can affect your network performance significantly. To choose the best protocol for your network, you must understand the protocols NT supports, how each works, and where each protocol is most effective. Then, consider the resources that are necessary to implement your protocol choice.

NetBEUI
When Microsoft developed Windows for Workgroups (WFW), the NetBEUI protocol was a good choice, and many networks run it even after they convert to NT and Windows 95. The name NetBEUI comes from NetBIOS Extended User Interface, and this name has created confusion since NetBEUI's introduction. NetBIOS is a programming interface, and NetBEUI is a transport protocol. Most Microsoft software and many other packages that run on Windows platforms use the NetBIOS programming interface. Thus, many network administrators continue to use NetBEUI after they install other protocols, because they think the application software can't function without NetBEUI.

IBM developed NetBEUI in the mid-1980s for small workgroups with closely linked computers. NetBEUI was by far the fastest NT protocol available until Microsoft released NT 3.51. Microsoft concentrated its programming effort on speeding up TCP/IP in NT 3.51. TCP/IP has overtaken NetBEUI in popularity because of the computer industry's push to make TCP/IP the standard protocol for business applications.

NetBEUI's ideal users are small businesses or individual departments in larger corporations. NetBEUI is a reasonable choice for small networks. It requires relatively little memory; it's self-tuning, with no user-configurable parameters; and it's compatible with Microsoft networks. NetBEUI is a good choice for DOS clients, because it requires minimal system memory. (Remember, you must run it on the server and the clients.)

One of NetBEUI's disadvantages is that it lacks routing capability (which might be an advantage if you want to isolate traffic on a network segment). It does not scale well, because it uses broadcasts for many functions, including identifying other computers (through NetBIOS broadcasts). The broadcast approach works on small networks, but the network traffic it generates can overwhelm a large network. Although NetBEUI is compatible with Microsoft networks, you must have another protocol if your network includes Novell or UNIX servers.

Is NetBEUI for you? The answer may be yes, if you have a small network. However, be prepared to remove or disable NetBEUI when your network outgrows it.

NWLink
NWLink is Microsoft's version of Novell's IPX/SPX protocol. Networks with Windows clients that access Novell servers use NWLink: for example, a client/server application in which the client runs on NT Workstation or Win95 and the server component, such as a database, runs on a Novell server. Small networks can use NWLink, even without connectivity to a Novell server. NWLink requires less configuration than TCP/IP does. Like TCP/IP, NWLink is routable.

A common problem with NWLink is having the wrong frame type, especially in a mixed-frame environment. A frame is a package of information transmitted as a unit from one network device to another. An Institute of Electrical and Electronics Engineers (IEEE) frame-type specification outlines each option for formatting network data. NT attempts to detect the frame type through its Auto Frame Type Detection (which Screen 1, page 214, shows). However, NT will detect only one frame type, even though the network may be running several. Before version 3.3, NetWare's default was to use frame type 802.3; with version 3.3 and later, NetWare switched to 802.2 as the default. Recent versions of NT (3.5 and later) look first for 802.2 frames and accept this as the default frame type. NT does not continue to search for other frame types. Thus a computer on a mixed-frame network can talk to some but not all of the other computers on the network. You can solve this problem by telling NT to use multiple frame types, as Screen 2, page 214, shows.

TCP/IP
Microsoft is channeling its programming effort into TCP/IP. The corporate world prefers TCP/IP, and you must use it to connect to the Internet, so it's becoming the industry standard. TCP/IP uses more memory and system resources than NWLink or NetBEUI uses; thus it might not be the best choice for small networks. It certainly is not the best choice for DOS clients.

TCP/IP requires more configuration than NWLink or NetBEUI requires. With TCP/IP, network administrators must decide how to assign IP addresses­ and must worry about how to obtain them, because IP addresses are limited until IP6 comes out. The Internet Network Information Center (InterNIC) assigns IP addresses, which currently use 32 bits. This addressing scheme limits the number of available IP addresses (available at http://ds.internic.net). The IP6 specification will introduce 128-bit addresses to ease the availability problem. For now, InterNIC has assigned or reserved almost all of the available IP addresses, and obtaining a range of valid IP addresses is difficult for a small company. You can make up your own IP addresses, but when you connect to the outside world through the Internet, you need a valid InterNIC-assigned IP address. (For information about IP addressing, see Mark Minasi, "You Can't Spell 'Internet' Without 'NT,'" February 1996.)

You must decide whether to assign IP addresses automatically or manually. If you choose automatic assignment, NT can help with the Dynamic Host Configuration Protocol. DHCP is available on NT Server and uses additional system resources. Your Backup Domain Controller (BDC) can run DHCP and perform user validation. When you configure the DHCP server, it automatically handles IP addressing. Screen 3 shows an example DHCP server configuration, including addresses reserved for printers, routers, and other system devices.

If you don't use DHCP, you must manually assign and track IP addresses, making sure the addresses are typed in correctly and troubleshooting problems that occur when people move computers around the network. These tasks are overwhelming in a large organization and can be equally daunting in a small company. Screen 4 shows manually assigning an IP address in the TCP/IP Properties window.

Other Considerations
If you use TCP/IP as your network protocol, you might discover that your computers cannot communicate with one another. If they are on different subnets­that is, they have different IP addresses and are separated by a router­they will not be able to find one another. This problem occurs because applications and the operating system refer to a computer by name (e.g., SERVER1, Accounting2), but TCP/IP requires a network card address rather than a name.

A computer running NetBEUI can find the address for another computer by broadcasting the name of the target computer and then waiting for a response, which will include the target computer's address. Connecting to a computer on another part of the network is not an issue for NetBEUI, because NetBEUI is not routable. A router divides a network into segments, each with its own set of addresses.

Because TCP/IP is routable, you need a way to find addresses for computers on different parts of your network. Broadcast messages don't pass through the routers, so you must know the target computer's address to send a message directly to it. One solution is to keep a list of your network computer names and IP addresses. TCP/IP can use this list, in the form of an LMHOSTS file, to convert a computer name to an IP address and then send a message to the IP address to ask for the network card address. (For more information about LMHOSTS files, see Mark Minasi, "Inside a NetBIOS Name Resolution," March 1997.) However, keeping LMHOSTS files up-to-date is tedious and difficult in a rapidly changing environment, especially if you use DHCP.

Another solution is to install Windows Internet Naming Service. WINS is an automated database of computer names and IP addresses. After you configure the WINS server, your client computers register with the server by giving their names and addresses to the WINS database when they start up. When a client computer needs another computer's address, it asks the WINS server. (For more information about WINS, see David Lafferty, "Setting Your WINS Strategy," October 1997.) An NT server such as a BDC might be a good candidate to function as a WINS server. A WINS server must have a fixed IP address that the DHCP server can automatically pass to clients when they receive their IP addresses from the DHCP server. Think of this process as dialing 411 on the telephone to find other phone numbers through directory assistance.

The More the Merrier?
More is not necessarily better with protocols. A company often starts with a small peer-to-peer network and perhaps uses WFW or Win95. Then, as more users come online, the company adds a server. Thus a company might add NWLink to its network to communicate with a NetWare server. When the Internet becomes important to business, the company adds TCP/IP. But how often does the company's network administrator go back and make sure that only the necessary protocols are running? To many administrators, leaving older protocols in place seems safer, in case users have not converted to TCP/IP.

Running multiple protocols on an NT-based network is a bad idea. Many NT system functions, such as browsing, depend on broadcasts. Each computer announces its presence on the network when it first comes online and every 15 minutes thereafter. Because a computer does not know which protocol the server is listening to, every computer sends out a broadcast on each of its protocols. If your network is running NetBEUI, NWLink, and TCP/IP, your browser service initiates three times as much network traffic. Although the broadcasts stop at the routers, they generate excessive local traffic.

If you want to reduce network traffic, consider disabling older protocols that you no longer use. On NT computers, go to Control Panel, Services, Network; select the Bindings tab. In the Bindings tab window, you can disable any protocols (rather than remove them), as Screen 5 shows. Thus, if one of your users needs a protocol, you can reenable it.

If disabling protocols worries you, run the Network Monitor utility that comes with NT, or run the full version of the utility, which is part of Systems Management Server (SMS). The Network Monitor utility will show you which protocols on your network are generating the most traffic. You can then make an informed decision to eliminate some of them. Your choice will affect your network's productivity, and the decision depends not only on the protocols you need but also on the protocols you can live without.

If you are having trouble getting File and Printer sharing to work and have multiple IP addresses from your ISP

The easiest way to fix this is to add the NetBeui or IPX/SPX protocol (make sure you enable NetBIOS over IPX/SPX) to all your computers and make sure it is bound to Client for Microsoft Networks and File and Printer Sharing for Microsoft Networks. This will set up File and Printer sharing independently from TCP/IP, so it won't matter what the TCP/IP settings are! Make sure you unbind these from TCP/IP.

The Need For Name Resolution

To ensure successful communication on a network, your systems need to be able to associate a name with an IP (or other relevant network number) so that users do not need to memorize the numeric identifier, such as a TCP/IP address. Proper name resolution is essential for fast network communication, and if it is not configured correctly, your network will be slow, and your network users will be unhappy.

On Windows networks running TCP/IP, the following options exist for name resolution:
Host Name Resolution

*

HOSTS ............... Static
*

DNS ................... Dynamic

NetBIOS Name Resolution

*

LMHOSTS ........... Static
*

WINS ................. Dynamic
*

DNS ................... Dynamic (not the default for NT4 or earlier)
*

HOSTS ............... Static (with NT/2000/XP/2003)

Although commonly advocated, there is no need to run NETBEUI on your Windows network. It is a chatty, non-routable broadcast protocol, and only useful on very small networks, or if you don't want to connect to the Internet at all. Instead, you can rely on NetBIOS support, tunneled over another protocol such as TCP/IP. All versions of 32-bit Windows support NetBIOS over TCP/IP.

If you want to use DNS for resolving NetBIOS names on versions of Windows prior to Windows 2000, you must go into the TCP/IP properties in the Control Panel and enable "Use DNS for Windows Resolution". With 2000, XP and 2003, Windows has an increased reliance on DNS, whether on a peer network or through Active Directory.
If you are unable to get Windows 95/98/ME machines to talk to systems in the Windows NT-family without installing NetBEUI, then it is very likely that you have not setup NetBIOS Name Resolution for your client systems. Also, remember that NetBIOS traffic should always be confined to your internal network ONLY. There is no need to allow NetBIOS traffic to traverse the Internet or another public network without the benefit of a VPN.
NETBIOS vs. NETBEUI

Many folks confuse NETBIOS and NETBEUI. The former, is a program (API) developed by IBM which allows applications on a LAN to communicate. The latter is a chatty, non-routable protocol originally used by LAN Manager, and subsequently by Windows, to provide the frame and data format for NetBIOS traffic.

NetBEUI = NetBIOS Extended User Interface

Under Windows, NetBIOS can be transported over other protocols such as IPX and TCP/IP. Starting with Windows 2000, Microsoft networks are no longer dependent on NetBIOS for communication, although you still need it for browsing Network Neighborhood and for using certain utilities such as the Windows Messenger Service (NET SEND).
Where Are My HOSTS/LMHOSTS Files?

Both the HOSTS and LMHOSTS files can be found in the same location. Neither of these files has a file extension. The .SAM files found in the same location are sample files, and must be renamed to be used by Windows.

*

Win9x/ME ................. %windir% (usually C:\WINDOWS)
*

NT/2000/XP .............. %SystemRoot%\System32\Drivers\ETC

If creating or editing these files in NOTEPAD, be sure to place the name in quotes so that NOTEPAD does not add a .TXT extension to the saved file. Or just use Textpad to edit all your files.

To speed up name resolution on a peer-to-peer network, add the name and IP of each machine on your network to the HOSTS file on each machine. This will make it easier for the systems to find each other without waiting for broadcast messages.

Example:

127.0.0.1 localhost
172.30.50.11 workstation1
172.30.50.12 workstation2
172.30.50.13 workstation3

http://www.rxn.com/services/faq/smb/using_samba/html/ch01_03.htm


Name Resolutions Summary

MS provides many options for NetBIOS name resolution such as local cache lookup, WINS server query, broadcast, DNS server query, and LMHOSTS and HOSTS lookup. Microsoft TCP/IP uses NetBIOS over TCP/IP (NetBT) to support the NetBIOS client and server programs in the LAN and WAN environments. In the most cases, NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses in workgroup network and WINS resolves NetBIOS names to IP addresses in domain network.

Common NetBIOS name problem

NetBIOS names must be between 1 and 15 characters long (the names are up to 16 characters, but the last character is reserved as a special characters). For that reason, you should not give a computer name longer than 15 characters.

Duplicate name issue
Symptoms: Event viewer may show Event ID 4320, Event ID: 4319. You may get system error 52 and a duplicate name has been detected on the TCP network.
Resolutions:
1. If two computers on the Network with the same name, use the nbtstat -n command to find out these two computers, for example, using nbtstat -n to check the name and ip of the local computer, and then using nbtstat -a command with the IP address to get the another computer name.
2. If identical username is logging on to multiple computers, the usernames will register with a <03h>, and that may cause the name conflict in the network. Ask the user to log off of all computers and log back on to just one computer.
3. This may be occurred because of inactive or duplicate names in the WINS Database. Go to the WINS server, check the database and delete the inactive or duplicated names.
4. This my be occurred because of a possibly corrupted DHCP database. To clear DHCP related entries or clean out old settings in the registry, delete any .mib files, and then reinstall DHCP.
5. This may be occurred because of conflicting NICs in a Multihomed Computer. To fix this problem, you may want to stop Computer Browser service or uncheck one of Client for MS Network.
6. This may be ocurred because IPCONFIG /ALL returns incorrect host name. To change computer name in the TCP/IP parameters section, run regedit.exe, and locate the HOSTNAME value in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip \Parameters, and then edit the string data.

Still need help, contact consultant Your feedback and contributions to this web site
Failed to access NetBT driver -- NetBT may not be loaded

causes: 1. No rights to run NBTSTAT.
2. Missing NetBT parameters in registry.
3. NetBIOS is not enabled.

How can I install NetBEUI on WinXP?
A: NetBEUI is not included on XP by default. To install NetBEUI, 1) Copy Nbf.sys to the %SYSTEMROOT%\System32\Drivers
directory from Windows XP CD - Valueadd\MSFT\Net\NetBEUI folder. 2) Copy Netnbf.inf to the %SYSTEMROOT%\Inf hidden
directory. 3) Go to Control Panel>Network Connections, right-click the adapter you want to add NetBEUI to, and then click Properties>General>Install>Protocol>Add>NetBEUI Protocol.

How to configure WINS for a non-WINS client

If your have non-WINS machines on a subnet and want to them to be visible browsing participants, you may have two options to setup WINS for non-WINS machines. 1) Enable WINS Agent. To setup a machine as proxy agent in NT 4, run regedit and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters. Double-click on the EnableProxy and set vale to 1. 2) add static entries on WINS Manager. To do this, run WINS Manager>Mappings>Static Mappings and add information.

How to check NetBIOS status

To check if the computer has registered a 00, a 03, and a 20 entry, and these correspond to the Workstation service, the Messenger service, and the Server service, respectively, use nbtstat -n. That will list local NetBIOS names. To list remote computer name table, use nbtstat -a computer name or nbtstat -A IP.

How to disable WINS Proxy

To disable wins proxy, go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\Parameters, change the value to 0.

Value Name: EnableProxy
Value Type: REG_DWORD
Values: Boolean (0 or 1)
Default: 0

How to modify Node Type

1. For W2K/XP, go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\Parameters to make change:
Name: DhcpNodeType
Value Type: REG_DWORD - Number
Valid Range: 1,2,4,8 (b-node, p-node, m-node, h-node)
Default: 1 or 8 based on the WINS server configuration

If this key is present, it will override the DhcpNodeType key. If neither key is present, the system defaults to b-node if there are no WINS servers configured for the client. The system defaults to h-node if there is at least one WINS server configured.
2. Windows 95, go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP
Name: NodeType
Value type: DWORD
Valid range: 1, 2, 4, or 8
Default: 1 (b-node) if no value is specified or no WINS servers are configured on the network; 8 (h-node) if WINS servers are specified and NodeType is not otherwise defined in the Registry.

If DNS is enabled (which also enabled LMHOSTS in Windows 95), name resolution will also follow the mode defined by this parameter. This value can also be configured using DHCP.

How to re-cache the NetBIOS name

If you can ping a remote computer IP but not the name, and you have WINS or enable NetBIOS over TCP/IP, this may be an outdated NetBIOS name resolution in the local NetBIOS name cache. You may want to run NBTSTAT -r to reset the cache and force the computer to retrieve remote computer name.

How to fix name resolution issue on a standard DNS network

Some w2k/xp computer have a difficulty to connect to a laptop and your company has standardized on DNS for name resolution (no WINS and NetBIOS enabled). you also find that you can ping the laptop ip but not name. You may want to run ipconfig /registerdns to renew the ip configuration and register the laptop's DNS name with the DNS.



NetBios vs NetBeui

I see a lot of confusion between NetBeui and NetBios. The differences are simple, but possibly misleading. In NT (and Win9x) terms, NetBeui is a transport protocol, at the same level in the network stack as TCP/IP and IPX/SPX. It is a simpler transport protocol than TCP/IP in that it does not support routing and is self configuring. NetBios, on the other hand, is a network interface and sits above the transport protocols.

A major weakness of NetBios is it's naming. With NetBios, the name space is flat, thus all systems and domains have to have a unique name, unlike DNS names which, being hierarchal, allows substaintially more flexibility.All NT, 95 and Windows for Workgroups systems have unique NetBios names. NT also used NetBios names to find different services by utilising the 16th character (often shown as NetBios name - the xx is the 16th character and is in hex). To find the domain controler for the Hawaii domain, for example, you would find HAWAII<1B>.

A programmer would use NetBios to access the transport protocols. In this sense, NetBios is transport independent. NetBios over TCP/IP (NBT) is defined in RFC 1001/2. With NT, if you have TCP/IP you have NetBios too, there's no way to separate this.

A final note: to a large degree, NetBios as both a network interface and a naming convention will be going in Windows 2000. Although Windows 2000 will support NetBios names (for downlevel clients and domains), DNS as the locator service and DNS names as standard.

Wednesday, June 01, 2005

Setting up new router/switch

Get ready
Choose your hostname, IP addresses and make the DNS reflect these.

Log on
Connect your terminal to the console port. If brand new, you can just hit return when asked for a password. Otherwise, enter our password. Now prepare to configure the box by entering privileged mode:

enable

and give the password, again possibly just hitting return.
--------------------------------------------------------------------------------

Get a clean state
If the box is being recycled, make the config "out of the box" with:
clear config all

If you are changing the type of module in a slot, nuke the config for that slot with:
clear config 2

or
clear config 3

as appropriate. If you don't do this, the spanning tree parameters may be wrong.
--------------------------------------------------------------------------------

Give the box its identity
set password
set enablepass
set prompt
set banner motd @
The it-network@blogger.com

Authorized access only
#
set system name
set system location
set system contact

--------------------------------------------------------------------------------

SNMP
set snmp community read-only
set snmp community read-write
set snmp community read-write-all
set snmp trap 10.10.10.1



--------------------------------------------------------------------------------

IP host config
set int eth0 10.10.1.1 255.255.255.0
set ip route default 10.10.1.3

--------------------------------------------------------------------------------

DNS
set ip dns server 10.10.1.200
set ip dns domain
set ip dns enable


This step is not essential. The DNS feature can only be used by an administrator who is logged in to the switch. If there are network problems, DNS lookups will probably fail anyway. Bare IP addresses will always do, and are what is usually used in this context.
--------------------------------------------------------------------------------

Set the time
This is not vital, but you may be confused in an emergency if the box logs problems with wrong times on them. Set the time:
set ntp client enable
set ntp server 10.10.1.100
set ntp server 10.10.1.101

If the box is going somewhere really weird where it won't be able to reach those NTP servers, set the time instead with:
set time Monday 07/20/1999 10:00:00

set timezone

--------------------------------------------------------------------------------

Turn on CGMP
CGMP is used for multicasting. It should be turned on. It is off by default on CatOS.
set cgmp enable



--------------------------------------------------------------------------------

Turn off VTP

set vtp mode transparent

--------------------------------------------------------------------------------

Set up necessary VLANs
set vlan 13 name staff
set vlan 14 name student


--------------------------------------------------------------------------------

Turn off bad things
Cisco have some funny options turned on by default. This can muck up devices which boot fast.
Use the example below as a guide, adjusting the port numbers for the cards you have installed. Note that on older CatOS versions the "port channel" commands only seem to work if you do the ports one module at a time.

Be extremely careful if you are trying to do this "cleanup" on a box which is already configured. It is very easy to turn off important trunks by doing this. Do not copy these commands or port numbers!

For CatOS 6.1 and newer (most new boxes bought from now on):

set trunk all off
set port channel all mode off


or (an example for a full 4006) -- still CatOS 6.1 and newer:
set trunk 1/1-2,2/1-48,3/1-48,4/1-48,5/1-48,6/1-48 off
set port channel 1/1-2 mode off
set port channel 2/1-48 mode off
set port channel 3/1-48 mode off
set port channel 4/1-48 mode off
set port channel 5/1-48 mode off
set port channel 6/1-48 mode off


For CatOS prior to 6.1 (most of our 4003s in production that haven't been upgraded yet):
set trunk 2/1-34,3/1-48 off
set port channel 2/1-34 off
set port channel 3/1-48 off


If you are adding a card to a previously vacant slot, you will need to fix up these settings for that module.


--------------------------------------------------------------------------------

GBIC trunks
Make sure that VLANs to be carried on the trunk have all been set up. Prune off all other VLANs except VLAN 1 (from release 7.2, dot1q trunks support 4096 VLANs). Give the port a sensible name.
set vlan 1 2/1
set trunk 2/1 on
clear trunk 2/1 2-1005
clear trunk 2/1 1025-4094
set trunk 2/1 13-14
set port name 2/1 c4-h04-2
set spantree portfast 2/1 disable

Don't worry about autonegotiation or duplicity - these don't apply to gigabit.
--------------------------------------------------------------------------------

Slower trunks (over copper usually)
Set the speed and the duplicity explicitly.
set vlan 1 2/3
set trunk 2/3 on
clear trunk 2/3 2-1005
clear trunk 2/3 1025-4094
set trunk 2/3 13-14
set port name 2/3 c4-h04-3
set port speed 2/3 100
set port duplex 2/3 full
set spantree portfast 2/3 disable

Make sure the other end of the trunk matches exactly. Don't let trunks autonegotiate anything.
--------------------------------------------------------------------------------

Vanilla ports
Ports to be connected to a single host:
set vlan 14 2/3-34
set vlan 13 3/1-48
set spantree portfast 2/3-34,3/1-48 enable

portfast mode must never be set on links to other networking devices (hubs, switches, routers, bridges, concentrators). It will sabotage the spanning tree calculations.
To accommodate particular computers, you may need to set some of these on some ports, e.g.:

set port speed 3/1 100
set port duplex 3/1 full

The speed will usually autonegotiate, but this will sometimes fail, particularly with Sun computers. Any big important computer should have all of these parameters configured explicitly, both at the switch and on the computer.
--------------------------------------------------------------------------------

Dumb hubs
Set parameters explicitly to the appropriate values, e.g.:
set vlan 14 2/3
set spantree portfast 2/3 disable
set port speed 2/3 10
set port duplex 2/3 half

It is very important to turn off portfast mode. Trunks are kind enough to ignore it, but vanilla links to dumb devices won't. Although dumb hubs will not participate in spanning tree, a switch could be daisy-chained off the dumb hub later, causing problems.
--------------------------------------------------------------------------------

Undoing things
Examples:
set trunk 2/1 off
set port duplex 2/3
set port speed 2/3
set port name 2/3
set spantree portfast 2/3 disable
set vlan 1 2/3
clear config 3


--------------------------------------------------------------------------------

Making changes later
When making changes to a port, check that you have the right:
port name
port duplex
port speed
portfast mode
trunking or not
VLANs down a trunk - exactly those needed, at both ends of the trunk

--------------------------------------------------------------------------------