Welcome To Security.Fx-Vista.Com

Computer Security Information

Home

MS Windows 2000 TCP/IP Implementation Details - Part 4

<<< Back

DhcpSubnetMaskOpt

Key: Tcpip\Parameters\Interfaces\interface

Value Type: REG_SZ—dotted decimal IP subnet mask

Valid Range: Any subnet mask that is valid for the configured IP address

Default: None

Description: This parameter is filled in by the DHCP client service and is used to build the DhcpSubnetMask parameter, which the stack actually uses. Validity checks are performed before the value is inserted into the DhcpSubnetMask parameter.

Lease

Key: Tcpip\Parameters\Interfaces\interface

Value Type: REG_DWORD—time in seconds

Valid Range: 1–0xFFFFFFFF

Default: None

Description: The DHCP client service uses this parameter to store the time, in seconds, for which the lease on the IP address for this adapter is valid.

LeaseObtainedTime

Key: Tcpip\Parameters\Interfaces\interface

Value Type: REG_DWORD—absolute time, in seconds, since midnight of 1/1/70

Valid Range: 1–0xFFFFFFFF

Default: None

Description: The DHCP client service uses this parameter to store the time at which the lease on the IP address for this adapter was obtained.

LeaseTerminatesTime

Key: Tcpip\Parameters\Interfaces\interface

Value Type: REG_DWORD—absolute time, in seconds, since midnight of 1/1/70

Valid Range: 1–0xFFFFFFFF

Default: None

Description: The DHCP client service uses this parameter to store the time at which the lease on the IP address for this adapter expires.

LLInterface

Key: Tcpip\Parameters\Adapters\interface

Value Type: REG_SZ—Windows 2000 device name

Valid Range: A legal Windows 2000 device name

Default: Empty string (blank)

Description: This parameter is used to direct IP to bind to a different link-layer protocol than the built-in ARP module. The value of the parameter is the name of the Windows 2000 device to which IP should bind. This parameter is used in conjunction with the RAS component, for example. It is only present when ARP modules other than LAN bind to IP.

NTEContextList

Key: Tcpip\Parameters\Interfaces\interface

Value Type: REG_MULTI_SZ—number

Valid Range: 0–0xFFFF

Default: none

Description: This parameter identifies the context of the IP address associated with an interface. Each IP address associated with an interface has its own context number. The values are used internally to identify an IP address and should not be altered.

T1

Key: Tcpip\Parameters\Interfaces\interface

Value Type: REG_DWORD—absolute time, in seconds, since midnight of 1/1/70

Valid Range: 1–0xFFFFFFFF

Default: None

Description: The DHCP client service uses this parameter to store the time at which the service first tries to renew the lease on the IP address for the adapter by contacting the server that granted the lease.

T2

Key: Tcpip\Parameters\Interfaces\interface

Value Type: REG_DWORD—absolute time, in seconds, since midnight of 1/1/70

Valid Range: 1–0xFFFFFFFF

Default: None

Description: The DHCP client service uses this parameter to store the time at which the service tries to renew the lease on the IP address for the adapter by broadcasting a renewal request. Time T2 should only be reached if the service is unable to renew the lease with the original server for some reason.

ATM ARP Client Parameters

The ATM ARP client parameters are located—along with the TCP/IP parameters for each interface—under the AtmArpC subkey. A sample dump of the registry for a single TCP/IP interface for an ATM adapter is shown below.

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \Tcpip \Parameters
Interfaces\{A24B73BE-D2CD-11D1-BE08-8FF4D413E1BE}\AtmArpC

SapSelector = REG_DWORD 0x00000001
AddressResolutionTimeout = REG_DWORD 0x00000003
ARPEntryAgingTimeout = REG_DWORD 0x00000384
InARPWaitTimeout = REG_DWORD 0x00000005
MaxResolutionAttempts = REG_DWORD 0x00000004
MinWaitAfterNak = REG_DWORD 0x0000000a
ServerConnectInterval = REG_DWORD 0x00000005
ServerRefreshTimeout = REG_DWORD 0x00000384
ServerRegistrationTimeout = REG_DWORD 0x00000003
DefaultVcAgingTimeout = REG_DWORD 0x0000003c
MARSConnectInterval = REG_DWORD 0x00000005
MARSRegistrationTimeout = REG_DWORD 0x00000003
JoinTimeout = REG_DWORD 0x0000000a
LeaveTimeout = REG_DWORD 0x0000000a
MaxJoinLeaveAttempts = REG_DWORD 0x00000005
MaxDelayBetweenMULTIs = REG_DWORD 0x0000000a
ARPServerList = REG_MULTI_SZ "4700790001020000000000000000A03E00000200"
MARServerList = REG_MULTI_SZ "4700790001020000000000000000A03E00000200"
MTU = REG_DWORD 0x000023dc
PVCOnly = REG_DWORD 0x00000000

A description of each of these parameters follows.

SapSelector

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number

Valid Range: 1–255

Default: 1

Description: Specifies the selector byte value used by the ATMARP client as the twentieth byte of its ATM address. The resulting address is used to register with the ATMARP server and the Multicast Address Resolution Server (MARS).

AddressResolutionTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 1–60

Default: 3

Description: Specifies how long the ATMARP client waits for a response after sending an ARP request for a unicast IP address (or MARS request for a multicast/broadcast IP address). If this timer elapses, the ATMARP client retransmits the request a maximum of (MaxResolutionAttempts – 1) times.

ARPEntryAgingTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 90–1800

Default: 900 seconds (15 minutes)

Description: Specifies how long the ATMARP client retains address resolution information for a unicast IP address before it is invalidated. If this timer expires, the ATMARP client does one of the following things:

  • If there are no virtual circuits (VCs) associated with the IP address, it deletes the ARP entry for this IP address.
  • If there is at least one permanent virtual circuit (PVC) associated with the IP address, it uses Inverse ARP on the PVC to revalidate the ARP entry.
  • If there is at least one SVC associated with the IP address, it sends an ARP request to the ARP server to revalidate the ARP entry.

InARPWaitTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 1–60

Default: 5

Description: Specifies how long the ATMARP client waits for a response after sending an Inverse Address Resolution Protocol (InARP) request to revalidate a unicast IP address to ATM address mapping, that is, an ARP entry. If this timer expires, the ATMARP client deletes the ARP table entry that contains the IP address.

MaxResolutionAttempts

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number

Valid Range: 1–255

Default: 4

Description: Specifies the maximum number of attempts to be made by the ATMARP client to resolve a unicast or multicast or broadcast IP address to an ATM address (or addresses).

MinWaitAfterNak

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 1–60

Default: 10

Description: Specifies how long the ATMARP client waits after receiving a failure (ARP NAK) response from the ARP server or MARS. This prevents the ATMARP client from flooding the server with queries for an IP address that is nonexistent or unknown.

ServerConnectInterval

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 1–30

Default: 5

Description: Specifies how long the ATMARP client waits after a failed attempt to connect to the ARP server before retrying the connection.

ServerRefreshTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 90–1800

Default: 900 seconds (15 minutes)

Description: Specifies the interval at which the ATMARP client sends an ARP Request with its own IP/ATM address information to refresh the ATMARP server's cache.

ServerRegistrationTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 1–60

Default: 3

Description: Specifies how long the ATMARP client waits for an ARP Response packet in reply to an ARP Request packet that it sent to register its own IP/ATM information with the ATMARP server. If this timer expires, the ATMARP client retransmits the ARP Request packet.

DefaultVcAgingTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 10–1800

Default: 60

Description: Specifies the inactivity time-out for all VCs initiated by the ATMARP client. This does not apply to PVCs. Inactivity is defined as a condition of no data activity in either direction. If this timer expires, the ATMARP client disconnects the VC.

MARSConnectInterval

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 1–30

Default: 5

Description: Specifies how long the ATMARP client waits after a failed attempt to connect to the MARS before retrying the connection.

MARSRegistrationTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 1–60

Default: 3

Description: Specifies how long the ATMARP client waits for an MARS Join packet in reply to a MARS Join packet that it sent to register its ATM address with the MARS. If this timer expires, the ATMARP client retransmits the MARS Join packet.

JoinTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 5–60

Default: 10

Description: Specifies how long the ATMARP client waits for a MARS Join packet in reply to a MARS Join packet it sent to initiate membership to an IP multicast group (or the IP broadcast address). If this timer expires, the ATMARP client retransmits the MARS join packet a maximum of MaxJoinLeaveAttempts.

LeaveTimeout

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of seconds

Valid Range: 5–60

Default: 10

Description: Specifies how long the ATMARP client waits for a MARS Leave packet in reply to a MARS Leave packet that it sent to terminate membership from an IP multicast group (or the IP broadcast address). If this timer expires, the ATMARP client retransmits the MARS Leave packet a maximum of MaxJoinLeaveAttempts one time.

MaxJoinLeaveAttempts

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number

Valid Range: 1–10

Default: 5

Description: Specifies the maximum number of attempts to be made by the ATMARP client to Join or Leave an IP multicast (or broadcast) group.

MaxDelayBetweenMULTIs

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—Number of seconds

Valid Range: 2–60

Default: 5

Description: Specifies the maximum delay expected by the ATMARP client between successive MARS MULTI packets corresponding to a single MARS Request.

ARPServerList

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_MULTI_SZ

Valid Range: A list of strings containing ATM addresses

Default: 4700790001020000000000000000A03E00000200

Description: This is the list of ARP servers that the ARP client is allowed to register with. This is used in a failover fashion; that is, the ARP client tries to register using each address in sequence until successful.

MARServerList

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_MULTI_SZ—list of strings

Valid Range: A list of strings containing ATM addresses

Default: 4700790001020000000000000000A03E00000200

Description: This is the list of MARS servers that the ARP client is allowed to register with. This is used in a failover fashion; that is, the ARP client tries to register using each address in sequence, until successful.

MTU

Key: Tcpip\Parameters\Interfaces\interface\AtmArpC

Value Type: REG_DWORD—number of bytes

Valid Range: 9180–65527

Default: 9180

Description: Specifies the maximum transmission unit reported to the IP layer for this interface.

Appendix B: NetBIOS over TCP Configuration Parameters

All of the NetBT parameters are registry values located under one of two different subkeys of HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Services:

  • NetBT\Parameters
  • NetBT\Adapters\Interfaces\interface, in which interface refers to the subkey for a network interface to which NetBT is bound

Values under the latter key(s) are specific to each interface. If the system is configured using DHCP, a change in parameters takes effect if you issue the command ipconfig /renew from a command prompt. Otherwise, you must reboot the system for a change in any of these parameters to take effect.

Parameters Configurable Using the Registry Editor

The following parameters are installed with default values by the NCPA during the installation of the TCP/IP components. They may be modified using the Registry Editor (Regedt32.exe). A few of the parameters are visible in the registry by default, but most must be created in order to modify the default behavior of the NetBT driver.

BacklogIncrement

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 3–0x14 (1–20 decimal)

Default: 3

Description: This parameter was added in response to Internet SYN-ATTACK issues. When a connection attempt is made to the NetBIOS TCP port (139), if the number of free connection blocks is below 2, a BackLogIncrement number of new connection blocks are created by the system. Each connection block consumes 78 bytes of memory. A limit on the total number of connection blocks allowed can be set using the MaxConnBackLog parameter. One connection block is required for each NetBT connection.

BcastNameQueryCount

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 1–0xFFFF

Default: 3

Description: This value determines the number of times NetBT broadcasts a query for a specific name without receiving a response.

BcastQueryTimeout

Key: Netbt\Parameters

Value Type: REG_DWORD—time in milliseconds

Valid Range: 100–0xFFFFFFFF

Default: 0x2ee (750 decimal)

Description: This value determines the time interval between successive broadcast name queries for the same name.

BroadcastAddress

Key: Netbt\Parameters

Value Type: REG_DWORD—4-byte, little-endian encoded IP address

Valid Range: 0–0xFFFFFFFF

Default: The 1s-broadcast address for each network

Description: This parameter can be used to force NetBT to use a specific address for all broadcast name-related packets. By default, NetBT uses the 1s-broadcast address appropriate for each net (that is, for a network of 10.101.0.0 with a subnet mask of 255.255.0.0, the subnet broadcast address would be 10.101.255.255). This parameter would be set, for example, if the network uses the 0s-broadcast address (set using the UseZeroBroadcast TCP/IP parameter). The appropriate subnet broadcast address would then be 10.101.0.0 in the example above. This parameter would then be set to 0x0b650000. This parameter is global and is used on all subnets to which NetBT is bound.

CachePerAdapterEnabled

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 1 (true)

Description: This value determines whether NetBIOS remote name caching is done on a per-adapter basis. Nbtstat -c has been enhanced to show the per-adapter name cache.

CacheTimeout

Key: Netbt\Parameters

Value Type: REG_DWORD—time, in milliseconds

Valid Range: 0xEA60–0xFFFFFFFF

Default: 0x927c0 (600000 milliseconds = 10 minutes)

Description: This value determines the time interval that names are cached in the remote name table. The nbtstat –c command can be used to view the remaining time for each name in the cache.

ConnectOnRequestedInterfaceOnly

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: This value can be used to allow NetBT connections on the requested adapter only. When the redirector on a multihomed computer calls another computername, it places calls on all NetBT transports (protocol/adapter combinations) to which it is bound. Each transport independently attempts to reach the target name. Setting this parameter limits each transport to connecting to other computers that are reachable via its own adapter, preventing crossover traffic. For more details, see the "NetBIOS Name Registration and Resolution for Multihomed Computers" section of this paper.

It no longer works no wonder it doesn't make sense.

EnableDns

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 1 (true)

Description: If this value is set to 1 (true), NetBT queries the DNS server for names that cannot be resolved by WINS, broadcast, or the Lmhosts file.

EnableProxyRegCheck

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: If this parameter is set to 1 (true), the proxy name server sends a negative response to a broadcast name registration if the name is already registered with WINS or is in the proxy's local name cache with a different IP address. This feature prevents a system from changing its IP address as long as WINS has a mapping for the name. For this reason, it is disabled by default.

InitialRefreshT.O.

Key: Netbt\Parameters

Value Type: REG_DWORD—time, in milliseconds

Valid Range: 960000–0xFFFFFFF

Default: 960000 (16 minutes)

Description: This parameter specifies the initial refresh time-out used by NetBT during name registration. NetBT tries to contact the WINS servers at one-eighth of this time interval when it is first registering names. When it receives a successful registration response, that response contains the new refresh interval to use.

LmhostsTimeout

Key: Netbt\Parameters

Value Type: REG_DWORD—time in milliseconds

Valid Range: 1000–0xFFFFFFFF

Default: 6000 (6 seconds)

Description: This parameter specifies the time-out value for Lmhosts and DNS name queries submitted by NetBT. The timer has a granularity of the time-out value, so the actual time-out could be as much as twice the value.

MaxConnBackLog

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 2–0x9c40 (1-40,000 decimal)

Default: 1000

Description: This value determines the maximum number of connection blocks that NetBT allocates. See the BackLogIncrement parameter for more details.

MaxPreloadEntries

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 0x3E8–0x7D0 (1000–2000 decimal)

Default: 1000 decimal

Description: This value determines the maximum number of entries that are preloaded from the Lmhosts file. Entries to preload into the cache are flagged in the Lmhosts file with the #PRE tag.

MaxDgramBuffering

Key: Netbt\Parameters

Value Type: REG_DWORD—number of bytes

Valid Range: 0x20000–0xFFFFFFFF

Default: 0x20000 (128K)

Description: This parameter specifies the maximum amount of memory that NetBT dynamically allocates for all outstanding datagram sends. Once this limit is reached, further sends fail due to insufficient resources.

MinimumRefreshSleepTime

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 21600000-4294967295

Default: 21600000 ms (6 hours)

Description: This parameter is used to reset the TTL on the WakeupTimer if ˝ of the TTL is less than 6 hours when the machine is put into sleep or hiberate mode.

MinimumFreeLowerConnections

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 20-500

Default: 50

Description: This parameter is used allocate the number of free handles that the system has upon boot to accept incoming connections. These handles are allocated in addition to the number of active connections that are being serviced. Once the machine is in a steady state the number of free handles increases to ˝ the value of the used handles. The number of free handles is never less than 50 unless specified in the registry.

NameServerPort

Key: Netbt\Parameters

Value Type: REG_DWORD—UDP port number

Valid Range: 0–0xFFFF

Default: 0x89

Description: This parameter determines the destination port number to which NetBT sends name service-related packets, such as name queries and name registrations, to WINS. The Microsoft WINS Server listens on port 0x89 (138 decimal). NetBIOS name servers from other vendors may listen on different ports.

NameSrvQueryCount

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 0–0xFFFF

Default: 3

Description: This value determines the number of times that NetBT sends a query to a WINS server for a specified name without receiving a response.

NameSrvQueryTimeout

Key: Netbt\Parameters

Value Type: REG_DWORD—time in milliseconds

Valid Range: 100–0xFFFFFFFF

Default: 1500 (1.5 seconds)

Description: This value determines the time interval between successive name queries to WINS for a specified name.

NodeType

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 1, 2, 4, 8 (b-node, p-node, m-node, h-node)

Default: 1 or 8 based on the WINS server configuration

Description: This parameter determines what methods NetBT uses to register and resolve names. A b-node system uses broadcasts. A p-node system uses only point-to-point name queries to a name server (WINS). An m-node system broadcasts first, then queries the name server. An h-node system queries the name server first, then broadcasts. Resolution through Lmhosts and DNS, if enabled, follows these methods. If this key is present, it overrides the DhcpNodeType key. If neither key is present, the system defaults to b-node if there are no WINS servers configured for the client. The system defaults to h-node if there is at least one WINS server configured.

NoNameReleaseOnDemand

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: This parameter determines whether the computer releases its NetBIOS name when it receives a name-release request from the network. It was added to allow the administrator to protect the machine against malicious name-release attacks.

RandomAdapter

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: This parameter applies to a multihomed host only. If it is set to 1 (true), NetBT randomly chooses the IP address to put in a name-query response from all of its bound interfaces. Usually, the response contains the address of the interface to which the query arrived. This feature would be used for load balancing by a server with two interfaces on the same network.

RefreshOpCode

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 8, 9

Default: 8

Description: This parameter forces NetBT to use a specific opcode field in name-refresh packets. The specification for the NetBT protocol is somewhat ambiguous in this area. Although the default of 8 that is used by Microsoft implementations appears to be the intended value, some other implementations, such as those by Ungermann-Bass, use the value 9. Two implementations must use the same opcode field to interoperate.

ScopeId

Key: Netbt\Parameters

Value Type: REG_SZ—character string

Valid Range: Any valid DNS domain name consisting of two dot-separated parts or an asterisk (*).

Default: None

Description: This parameter specifies the NetBIOS name scope for the node. This value must not begin with a period. If this parameter contains a valid value, it overrides the DHCP parameter of the same name. A blank value (empty string) is ignored. Setting this parameter to the value "*" indicates a null scope and overrides the DHCP parameter.

SessionKeepAlive

Key: Netbt\Parameters

Value Type: REG_DWORD—time in milliseconds

Valid Range: 60,000–0xFFFFFFFF

Default: 3,600,000 (1 hour)

Description: This value determines the time interval between keep-alive transmissions on a session. Setting the value to 0xFFFFFFF disables keep-alives.

SingleResponse

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: This parameter applies to a multihomed host only. If this parameter is set to 1 (true), NetBT supplies only the IP address from one of its bound interfaces in name-query responses. By default, the addresses of all bound interfaces are included.

Size/Small/Medium/Large

Key: Netbt\Parameters

Value Type: REG_DWORD

Valid Range: 1, 2, 3 (small, medium, large)

Default: 1 (small)

Description: This value determines the size of the name tables that are used to store local and remote names. In general, a setting of 1 (small) is adequate. If the system is acting as a proxy name server, the value is automatically set to 3 (large) to increase the size of the name cache hash table. Hash table buckets are sized as follows:

  • Small: 16
  • Medium: 128
  • Large: 256

SMBDeviceEnabled

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 1 (true)

Description: Windows 2000 supports a new network transport known as the SMB Device, which is enabled by default. This parameter can be used to disable the SMB device for troubleshooting purposes. See the "NetBT Internet/DNS Enhancements and the SMB Device" section of this paper for more details.

TryAllNameServers

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: This parameter controls whether the client continues to query additional name servers from the list of configured servers when a NetBIOS session setup request to one of the IP addresses fails. If this parameter is enabled, attempts are made to query all the WINS servers in the list and connect to all the IP addresses supplied before failing the request to the user.

TryAllIPAddrs

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 1 (true)

Description: When a WINS server returns a list of IP addresses in response to a name query, they are sorted into a preference order based on whether any of them are on the same subnet as an interface belonging to the client. This parameter controls whether the client pings the IP addresses in the list and attempts to connect to the first one that responds, or whether it tries to connect to the first IP address in the (sorted) list and fails if that connection attempt fails. By default, the client pings each address in the list and attempts to connect to the first one that answers the ping.

UseDnsOnlyForNameResolutions

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: This parameter is used to disable all NetBIOS name queries. NetBIOS name registrations and refreshes are still used, and NetBIOS sessions are still allowed. To completely disable NetBIOS on an interface, see the NetbiosOptions parameter.

WinsDownTimeout

Key: Netbt\Parameters

Value Type: REG_DWORD—time in milliseconds

Valid Range: 1000–0xFFFFFFFF

Default: 15,000 (15 seconds)

Description: This parameter determines the amount of time that NetBT waits before trying to use WINS again after it fails to contact any WINS server. This feature primarily allows computers that are temporarily disconnected from the network, such as laptops, to proceed through boot processing without waiting to time out each WINS name registration or query individually.

Parameters Configurable from the Connections UI

The following parameters can be set using the Network Control Panel tool (NCPA). There should be no need to configure them directly.

EnableLmhosts

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 1 (true)

Description: If this value is set to 1 (true), NetBT searches the Lmhosts file, if it exists, for names that cannot be resolved by WINS or broadcast. By default, there is no Lmhosts file database directory (specified by Tcpip\Parameters\DatabasePath), so no action is taken. This value is written by the Advanced TCP/IP Configuration dialog box of the NCPA.

EnableProxy

Key: Netbt\Parameters

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: If this value is set to 1 (true), the system acts as a proxy name server for the networks to which NetBT is bound. A proxy name server answers broadcast queries for names that it has resolved through WINS. A proxy name server allows a network of b-node implementations to connect to servers on other subnets that are registered with WINS.

NameServerList

Key: Netbt\Parameters\Interfaces\interface

Value Type: REG_MULTI_SZ—space separated, dotted decimal IP address (that is, 10.101.1.200)

Valid Range: any list of valid WINS server IP addresses.

Default: blank (no address)

Description: This parameter specifies the IP addresses of the list of WINS servers configured for the computer. If this parameter contains a valid value, it overrides the DHCP parameter of the same name. This parameter replaces the Windows NT 4.0 parameters NameServer and NameServerBackup, which are no longer used.

NetbiosOptions

Key: Netbt\Parameters\Interfaces\interface

Value Type: REG_DWORD—number

Valid Range: 1, 2

Default: 1

Description: This parameter controls whether NetBIOS is enabled on a per-interface basis. On the Start menu, point to Settings, and click Network and Dial-up Connections. Right-click Local Area Connection, and click Properties. Select Internet Protocol (TCP\IP), and click Properties, then click Advanced. Click the WINS tab. The NetBIOS options are Enable NetBIOS over TCP\IP, Disable NetBIOS over TCP\IP, or Use NetBIOS setting from the DHCP server, the default. When enabled, the value is 1. When disabled, the value is set to 2. If this key does not exist, the DHCPNetbiosOptions key is read. If this key does exist, DHCPNetbiosOptions is ignored.

Non-Configurable Parameters

The following parameters are created and used internally by the NetBT components. They should never be modified using the Registry Edit or it can cause the component to become unstable. They are listed here for reference only.

DHCPNameServerList

Key: Netbt\Parameters\Interfaces\interface

Value Type: REG_MULTI_SZ—space separated, dotted decimal IP address (that is, 10.101.1.200)

Valid Range: any list of valid WINS server IP addresses.

Default: blank (no address)

Description: This parameter specifies the IP addresses of the list of WINS servers, as provided by the DHCP service. This parameter replaces the Windows NT 4.0 parameters DHCPNameServer and DHCPNameServerBackup, which are no longer used. See also NameServerList, which overrides this parameter if it is present.

DHCPNetbiosOptions

Key: Netbt\Parameters\Interfaces\interface

Value Type: REG_DWORD—number

Valid Range: 1, 2

Default: 1

Description: This parameter is written by the DHCP client service. See the NetbiosOptions parameter for a description.

DhcpNodeType

Key: Netbt\Parameters

Value Type: REG_DWORD—number

Valid Range: 1–8

Default: 1

Description: This parameter specifies the NetBT node type. It is written by the DHCP client service, if enabled. A valid NodeType value overrides this parameter. See the entry for NodeType for a complete description.

DhcpScopeId

Key: Netbt\Parameters

Value Type: REG_SZ—character string

Valid Range: a dot-separated name string such as microsoft.com

Default: none

Description: This parameter specifies the NetBIOS name scope for the node. It is written by the DHCP client service, if enabled. This value must not begin with a period. See the entry for ScopeId for more information.

NbProvider

Key: Netbt\Parameters

Value Type: REG_SZ—character string

Valid Range: _tcp

Default: _tcp

Description: This parameter is used internally by the RPC component. The default value should not be changed.

TransportBindName

Key: Netbt\Parameters

Value Type: REG_SZ—character string

Valid Range: N/A

Default: \Device\

Description: This parameter is used internally during product development. The default value should not be changed.

Appendix C: Windows Sockets and DNS Registry Parameters

AFD Registry Parameters

Afd.sys is the kernel-mode driver that is used to support Windows Sockets applications. When there are three default values, the default is calculated based on the amount of memory detected in the system:

  • The first value is the default for smaller computers (less than 19 MB).
  • The second value is the default for medium computers (<32 MB on Windows 2000 Professional, <64 MB on Windows 2000 Server).
  • The third value is the default for large computers (>32 MB on Windows 2000 Professional, >64 MB on Windows 2000 Server).

For example, if the default is given as 0/2/10, a system containing 12.5 to 20 MB of RAM would default to 2.

The following values can be set under:

HKEY_LOCAL_MACHINE
\SYSTEM
\CurrentControlSet
\Services
\Afd
\Parameters:

DefaultReceiveWindow

Value Type: REG_DWORD

Default: 4096/8192/8192

Description: The number of receive bytes that AFD buffers on a connection before imposing flow control. For some applications, a larger value here gives slightly better performance at the expense of increased resource utilization. Applications can modify this value on a per-socket basis with the SO_RCVBUF socket option.

DefaultSendWindow

Value Type: REG_DWORD

Default: 4096/8192/8192

Description: This is similar to DefaultReceiveWindow, but for the send side of connections.

DisableAddressSharing

Value Type: REG_DWORD

Default: 0

Range: 0, 1

Description: This parameter is used to prevent address sharing (SO_REUSEADDR) between processes so that if a process opens a socket, no other process can steal data from it. A similar effect can be achieved if an application uses the new socket option SO_EXCLUSIVEADDRUSE. This setting allows administrators to secure older applications that are not aware of this option.

DisableRawSecurity

Value Type: REG_DWORD

Default: 0

Range: 0, 1

Description: Disables the check for administrative privileges when attempting to open a raw socket. This is not used for Windows 2000 transports (like TCP/IP, which manages its own security for raw sockets), which have TDI_SERVICE_FORCE_ACCESS_CHECK set. See the TCP/IP AllowUserRawAccess registry parameter.

DynamicBacklogGrowthDelta

Value Type: REG_DWORD

Valid Range: 0–0xFFFFFFFF

Default: 0

Description: Controls the number of free connections to create when additional connections are necessary. Be careful with this value; a large value could lead to explosive free connection allocations. (Although this parameter still exists, the TCP stack itself has been hardened against SYN-ATTACK in Windows 2000; therefore, it should not be necessary to use this feature of AFD.)

FastCopyReceiveThreshold

Value Type: REG_DWORD

Default: 1024

Description: When an application posts a receive with a buffer that is smaller than the current packet being buffered by Winsock, AFD can either make an additional copy of the packet and then copy data to the application buffers directly (which is a two-stage copy because application buffers cannot be accessed directly under the lock), or it can lock and map application buffers and copy data once. This value represents a compromise between extra code execution for data copying, and extra code execution in the I/O subsystem and memory manager. The default value was found, by testing, to be the best overall value for performance. Changing this value is not generally recommended.

FastSendDatagramThreshold

Value Type: REG_DWORD

Default: 1024

Description: Datagrams smaller than the value of this parameter go through the fast I/O path or are buffered on send. Larger ones are held until the datagram is actually sent. The default value was found by testing to be the best overall value for performance. Fast I/O means copying data and bypassing the I/O subsystem, instead of mapping memory and going through the I/O subsystem. This is advantageous for small amounts of data. Changing this value is not generally recommended.

IgnorePushBitOnReceives

Value Type: REG_DWORD—Boolean

Valid Range: 0, 1 (false, true)

Default: 0 (false)

Description: Normally, Windows 2000 completes a Windows Sockets Receive when one of the following occurs:

  • Data arrives with the push bit set.
  • The user recv buffer is full.
  • 0.5 seconds have elapsed since any data arrived.

Setting this parameter to a 1 causes Afd.sys to treat all incoming packets as though the push bit was set. This should only be done when necessary to work around client TCP/IP implementations that are not properly pushing data.

IrpStackSize

Value Type: REG_DWORD

Valid Range: 1–255

Default: 4

Description: The count of IRP stack locations used by default for AFD. Changing this value is not recommended.

LargeBufferSize

Value Type: REG_DWORD

Default: PAGE_SIZE (4096 bytes on i386, 8192 bytes on Alpha)

Description: The size, in bytes, of large buffers used by AFD. Smaller values use less memory and larger values can improve performance.

LargeBufferListDepth

Value Type: REG_DWORD

Default: 0/2/10