Using \\ in Windows

Hey,

Just wondering what using \\ does in Windows.

When I go Start > Run and type in \\(ip address) or \\computername, it shows the shared resources on the other computers.

What I am wondering is...

When I type in \\computername, what is happening?

Is my machine sending out something like a broadcast address resolution message, and trying to resolve "computername" to an IP address?

Thank you.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

thenjduke

This means going to point to a unc path.

drew2000

It's using netbios, which can use a broadcast packet to resolve the name.

How NetBIOS name resolution really works

Drew

thenjduke

And I recommend looking at the IOS model how this is handled. Be honest with you the first thing I would do is work way down IOS model. Remember that each layer relies on the other adjancent layers.

up2thetime

OSI model right?

I thought it was something similar to how ARP works.

Instead of resolving MAC address to a given IP, it resolves an IP to a computer-name.

thenjduke

OSI Model yeah. Sorry was thinking about upgrading IOS on Router when I answer this. Windows is funny when comes to getting computer names on the network. Microsoft does not follow standards so \\ might look for netbios name first. Who the hell knows with them though. It is rather annoying. I took my MCSE about two years ago and OMG what the hell they are all over the place.

up2thetime

Hey thanks!

I was wondering how it worked. Just started working with Windows.

I was trying to relate the \\ command to something in the ICND1 book.

dynamik

As mentioned earlier, it's using NetBIOS. If it doesn't already have the name>IP mapping cached, it simply sends out a broadcast asking who that name belongs to (or uses a WINS server if configured for that).

thenjduke

Exactly what Dynamik said. I figure it used netbios. It is ashame that windows does it this way.

undomiel

I've been looking for some documentation and sadly will confess I can't find any, either way. But I do believe that Windows Explorer on Windows 2000 on up will first attempt name resolution by DNS and then fail back to NetBIOS. Otherwise UNC browsing would always be slow as molasses.

dynamik

thenjduke wrote: »

Exactly what Dynamik said. I figure it used netbios. It is ashame that windows does it this way.

You can disable NetBIOS

astorrs

Actually Windows name resolution is well defined it's just not well published.

For a non-FQDN (SERVER1) it follows this order until it gets an answer or gives up:

Cache
WINS
Broadcast
LMHosts file
Hosts file
DNS

or if you prefer "Can We Buy Large Hard Drives?"

As for FQDN's (SERVER1.DOMAIN.COM) it follows this order until it gets an answer or gives up:

It first checks its local DNS cache
It queries the first name server of the preferred network adapter and waits just one second.
If no answer is received, it resends the query simultaneously to the first name server configured for each network adapter and waits two seconds. If the host has only one network adapter, this step is skipped.
If no answer is received, it resends the query simultaneously to all name servers configured for all adapters and waits two seconds.
If no answer is received, it resends the query simultaneously to all name servers configured for all adapters and waits four seconds.
If no answer is received, it resends the query simultaneously to all name servers configured for all adapters and waits eight seconds.
If after all this time no name server has returned an answer, it gives up and an error is returned.

undomiel

Finally found the documentation that I was looking for. I would beg to differ about the name resolution. Chapter 7 - Host Name Resolution

From my understanding the order works this way:

1. checks local host name
2. checks the local host dns cache (which is also where the hosts entries are loaded, didn't know that before)
3. checks the configured dns server (unqualified names will be appended depending upon the configured network connection's settings)
4. checks the netbios cache
5. checks the configured wins server
6. checks via broadcast

I also found this one for win3.1-95 and it looks like I was wrong, the resolution order is similar: Microsoft TCP/IP Host Name Resolution Order