How Windows 95 Used NetBIOS for Network Discovery

In Windows 95, local network resource discovery relied on the NetBIOS (Network Basic Input/Output System) API to identify computers, locate shared folders or printers, and populate the Network Neighborhood interface. Because early local area networks (LANs) frequently lacked centralized domain controllers or DNS-based naming, Windows 95 utilized a combination of 16-byte NetBIOS names, broadcast-based resolution mechanisms, local LMHOSTS lookup files, WINS servers, and a dynamic Master Browser election process to discover neighboring resources.

NetBIOS Name Structure

Every Windows 95 machine assigned itself a NetBIOS name consisting of 16 bytes:

  • Characters 1–15: The machine or workgroup name set by the user in the Network Control Panel. If the name was shorter than 15 characters, it was padded with spaces.
  • Byte 16: A hidden hex suffix identifying the specific network service registered by that machine. Common suffixes included <00> for the Workstation Service, <20> for the Server Service (file and print sharing), and <1D> for the Master Browser.

The Name Resolution Process

When a user attempted to access another machine or browse resources, Windows 95 resolved the target NetBIOS name using specific node types depending on whether TCP/IP, IPX/SPX, or NetBEUI was the underlying transport protocol:

  1. Local NetBIOS Cache: The operating system first checked its internal RAM cache for recently resolved names.
  2. Subnet Broadcasts (B-node): In standard peer-to-peer workgroups without a dedicated server, Windows 95 sent a broadcast query across the local subnet asking, "Who has this NetBIOS name?" The machine configured with that specific name and service responded directly with its hardware (MAC) or IP address.
  3. LMHOSTS File: If configured, the system scanned a static plain-text mapping file (C:\WINDOWS\LMHOSTS) to match NetBIOS names with IP addresses.
  4. WINS Servers (P-node/M-node/H-node): In enterprise environments using TCP/IP, Windows 95 queried a centralized Windows Internet Name Service (WINS) server to locate machines across routed subnets where broadcasts were blocked.

The Master Browser Service and Network Neighborhood

To populate the Network Neighborhood without requiring every workstation to continuously query every other computer on the wire, Windows 95 utilized the Computer Browser service:

  • Browser Elections: Machines on the network dynamically held an "election" to designate a Master Browser. If a system came online with a higher operating system version or specific browser flags, an election packet was broadcast, and the highest-priority machine took over.
  • Server Announcements: When a Windows 95 machine booted with file and printer sharing enabled, it broadcast host announcement packets to the Master Browser at regular intervals (starting at 1 minute and backing off to every 12 minutes).
  • Browse List Maintenance: The Master Browser aggregated these announcements into a central browse list containing all active nodes in the workgroup.
  • Browse Retrieval: When a user opened Network Neighborhood, Windows 95 asked the local Master Browser for a copy of the current browse list. The client then contacted the individual listed machines directly to enumerate their specific shared folders and printers.