Multiservice Networking, IPX Networking, and Security - CCIE Routing and Switching Exam Certification Guide - page 574

environments, this is called NWLink. It uses IPX socket type 20. The most scalable solutions
run NetBIOS over TCP/IP (NBT). With NBT, NetBIOS broadcasts still exist, but they run over
TCP port 137. This provides the ability to filter NetBIOS with access lists.

WINS

WINS a service that provides a dynamic NetBIOS name registration database, which is similar
to the service DNS provides for Internet names. The IP address of the WINS server can be
automatically given to the clients through Dynamic Host Configuration Protocol (DHCP).

Windows clients register their NetBIOS names with the WINS server upon startup and then
send unicast requests directly to the WINS server to resolve NetBIOS names to IP addresses,
which virtually eliminates NAME_QUERY broadcasts. The stations use the WINS server to get
name resolution, which reduces the NBT traffic, as shown in Figure 12-9.

WINS

Figure 12-9

NBT Traffic WINS Traffic

WINS server

Filtering NetBIOS with Access Lists
If required, IP-extended access lists can filter NBT packets. NetBIOS name service uses UDP
and TCP port 137; NetBIOS datagram service uses UDP and TCP port 138; and the NetBIOS
session service uses UDP and TCP port 139.

The following is an example:

access-list 101 deny udp any any eq netbios-ns
access-list 101 deny tcp any any eq 137
access-list 101 permit ip any any