What Is NetBIOS over TCP/IP in Windows 2000?

This article provides an overview of the NetBIOS over TCP/IP (NetBT) setting in Microsoft Windows 2000. It examines the purpose of the protocol, its role in bridging modern IP networks with legacy networking services, the options available for configuration, and the operational impact of enabling or disabling it in enterprise environments.

Core Function of NetBIOS over TCP/IP

NetBIOS over TCP/IP, commonly referred to as NetBT or NBT, allows legacy Network Basic Input/Output System (NetBIOS) services to run over standard Transmission Control Protocol/Internet Protocol (TCP/IP) networks. In Microsoft Windows 2000, NetBT encapsulates NetBIOS packets within TCP and UDP headers, enabling NetBIOS-dependent applications to communicate across routed IP subnets.

NetBT operates across specific network ports:

  • UDP Port 137: NetBIOS Name Service (NBNS) for name registration and resolution.
  • UDP Port 138: NetBIOS Datagram Service for connectionless message transfer and browsing.
  • TCP Port 139: NetBIOS Session Service for connection-oriented communication, including legacy Server Message Block (SMB) file and printer sharing.

The Shift in Windows 2000: Direct Hosting vs. NetBT

Prior to Windows 2000, operating systems such as Windows NT 4.0, Windows 95, and Windows 98 relied strictly on NetBT for file sharing and network browsing. Windows 2000 introduced "direct hosting" of SMB directly over TCP/IP using port 445, effectively removing the dependency on NetBIOS for modern, homogeneous Windows 2000 environments that rely on the Domain Name System (DNS).

Despite this advancement, NetBT was retained in Windows 2000 to maintain backward compatibility. When a Windows 2000 system initiates a file-sharing connection, it simultaneously attempts to connect over port 445 (direct SMB) and port 139 (NetBT). The first protocol to respond is utilized for the session.

NetBIOS over TCP/IP Settings

Windows 2000 allows administrators to configure the NetBT state on a per-adapter basis within the Advanced TCP/IP Settings menu (located under the WINS tab). The setting offers three options:

  1. Default: The adapter obtains its NetBT state from a Dynamic Host Configuration Protocol (DHCP) server. If the DHCP server provides vendor-specific NetBT options (such as option 043), Windows 2000 applies that configuration. If unassigned, NetBT remains enabled.
  2. Enable NetBIOS over TCP/IP: Forces the adapter to run NetBT regardless of DHCP instructions. This ensures connectivity with legacy systems and WINS servers, opening ports 137, 138, and 139.
  3. Disable NetBIOS over TCP/IP: Disables the NetBT stack entirely on the selected network interface. Ports 137 through 139 are closed, and the system relies exclusively on DNS for name resolution and port 445 for SMB communications.

Reasons to Enable or Disable NetBT

Enabling NetBT is required if the Windows 2000 client must communicate with legacy operating systems (such as Windows NT 4.0 or Windows 9x) or if third-party enterprise applications explicitly rely on NetBIOS naming conventions.

Disabling NetBT improves network efficiency and system security. It eliminates NetBIOS broadcast traffic, mitigates the need for Windows Internet Name Service (WINS) infrastructure, and reduces the attack surface by closing ports historically associated with network reconnaissance and exploitation.