Optimize Your Windows XP Network: TCP/IP and NBT Configuration Guide

Table of Contents

This comprehensive guide delves into the registry parameters utilized by the Tcpip.sys protocol driver in Windows XP. The Tcpip.sys driver is responsible for implementing the standard TCP/IP network protocols, which are fundamental to network communication. Understanding these parameters can aid in optimizing your network configuration, although caution is advised due to the self-tuning nature of Windows XP’s TCP/IP stack.

Introduction to TCP/IP Configuration in Windows XP¶

The TCP/IP protocol suite within Windows XP obtains all its configuration data from the system registry. This information is typically written to the registry by the Network tool found in the Control Panel during the initial setup process. Furthermore, for systems configured to use Dynamic Host Configuration Protocol (DHCP), the DHCP Client service actively supplies additional configuration details.

While the default configuration, gathered through DHCP and the Network Control Panel, is designed to provide correct and efficient performance in most environments, there are specific circumstances where modifications to these default values may be necessary. Windows XP’s TCP/IP implementation is largely self-tuning, meaning it automatically adjusts many parameters for optimal performance. However, for unusual network setups or specific performance tuning requirements, optional registry parameters can be created or existing ones modified to alter the protocol drivers’ default behavior. It is crucial to proceed with caution when adjusting these parameters, as arbitrary changes can potentially lead to reduced computer performance or network connectivity issues.

How to Modify TCP/IP and NBT Parameters in the Registry¶

Modifying TCP/IP and NBT parameters involves directly editing the Windows Registry. This process requires administrative privileges and a careful approach to avoid system instability. Always consider backing up your registry before making significant changes.

To change these parameters, follow these detailed steps:

1. Open Registry Editor: Click on the Start menu, then select Run. In the Open text box, type regedit and press Enter. This action launches the Registry Editor application, providing access to the system’s configuration database.
2. Navigate to the Services Key: In the Registry Editor, navigate through the hierarchy to locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. This key contains configuration information for all services and drivers installed on the system, including TCP/IP and NBT.
3. Add or Modify a Value: Once you’ve located the appropriate subkey (either Tcpip\Parameters or Netbt\Parameters, or their respective Interfaces subkeys), right-click in the right pane. Select New to create a new value (if the parameter doesn’t exist) or right-click an existing value to Modify it. Type the exact parameter name as specified in the descriptions below, and then set the Data Type (e.g., REG_DWORD, REG_SZ, REG_EXPAND_SZ, REG_MULTI_SZ).
4. Confirm Value: After entering the parameter name and type, input the desired value data and click OK to save your changes.
5. Exit Registry Editor: Close the Registry Editor application.
6. Restart Your Computer: For most TCP/IP and NBT registry changes to take effect, a system restart is required. This ensures that the operating system reloads the drivers with the new configuration values.

All TCP/IP parameters are found under one of two primary subkeys within HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services:
* Tcpip\Parameters
* Tcpip\Parameters\Interfaces\ID for Adapter

The “ID for Adapter” is a unique identifier (GUID) for each network adapter installed on your system. You can determine the specific Adapter ID by examining HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\ID for Adapter\Connection. The Name value in these keys typically corresponds to the name seen in the Network Connections folder, helping you identify the correct adapter.

Understanding Registry Value Types¶

Before diving into specific parameters, it’s helpful to understand the common registry value types you’ll encounter:

Value Type	Description	Example Data
REG_DWORD	A 32-bit number, often representing boolean (0 for False, 1 for True) or numerical values.	0x1 (Hexadecimal) or 1 (Decimal)
REG_SZ	A standard character string.	"MyHostname"
REG_EXPAND_SZ	An expandable character string that can contain environment variables.	"%SystemRoot%\System32\Drivers\Etc"
REG_MULTI_SZ	A multi-string value, typically a list of strings separated by null characters.	"192.168.1.1\0192.168.1.2\0\0" (displayed as separate lines in Regedit)

Standard TCP/IP Parameters Configurable via Registry Editor¶

These parameters are generally installed with default values by the Network tool during TCP/IP component installation. While they have system-defined defaults, they can be modified using the Registry Editor to fine-tune network behavior.

DatabasePath¶

• Key: Tcpip\Parameters
• Value type: REG_EXPAND_SZ - Character string
• Valid range: Any valid Windows NT file path
• Default: %SystemRoot%\System32\Drivers\Etc
• Description: This parameter specifies the directory path where standard Internet database files like HOSTS, LMHOSTS, NETWORKS, and PROTOCOLS are located. These files are crucial for name resolution and protocol mapping, used by the Windows Sockets interface. Changing this path is rare and typically only done in specific enterprise environments.

ForwardBroadcasts¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: This parameter was intended to control the forwarding of broadcast packets. However, in Windows XP, the forwarding of broadcasts is not supported at the TCP/IP level, and therefore, this parameter is effectively ignored by the operating system. Changing its value will have no practical impact on network behavior.

UseZeroBroadcast¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: If this parameter is set to 1 (True), the IP stack will utilize zeros-broadcasts (0.0.0.0) instead of the more common ones-broadcasts (255.255.255.255). Most modern networks and operating systems predominantly use ones-broadcasts. Setting this to true is generally only required for interoperability with older systems derived from BSD implementations that rely on zeros-broadcasts, as systems using different broadcast types may not communicate effectively on the same network segment.

Optional TCP/IP Parameters Configurable via Registry Editor¶

These parameters are not present in the registry by default. They must be manually created to modify specific behaviors of the TCP/IP protocol driver. Creating them allows for advanced tuning beyond standard configuration options.

ArpAlwaysSourceRoute¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0, 1 (False or True)
• Default: 0 (False)
• Description: Setting this parameter to 1 instructs TCP/IP to transmit ARP (Address Resolution Protocol) queries with source routing enabled on Token Ring networks. By default, the system first attempts ARP queries without source routing and only retries with source routing enabled if no response is received. This parameter is specific to Token Ring environments and might be useful for troubleshooting connectivity issues in complex Token Ring setups.

ArpUseEtherSNAP¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0, 1 (False or True)
• Default: 0 (False)
• Description: When set to 1, this parameter forces TCP/IP to transmit Ethernet packets using 802.3 SNAP (Subnetwork Access Protocol) encoding. By default, the stack uses the more common DIX Ethernet format for transmission. The system is always capable of receiving both formats, but this setting can be important for interoperability with older or specialized network devices that strictly adhere to 802.3 SNAP.

DefaultTTL¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Number of seconds/hops
• Valid range: 1-255
• Default: 128 for Windows XP
• Description: This parameter defines the default Time To Live (TTL) value that is stamped into the header of outgoing IP packets. The TTL acts as a counter, determining the maximum number of router hops an IP packet can traverse before being discarded to prevent endless loops on the network. A higher TTL allows packets to travel further, while a lower TTL can restrict their reach. Changing this might be considered for network diagnostic purposes or specific routing scenarios.

EnableDeadGWDetect¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0, 1 (False, True)
• Default: 1 (True)
• Description: If set to 1, TCP activates the Dead Gateway Detection feature. This mechanism enables TCP to request that IP switch to a backup gateway if a segment is retransmitted multiple times without an acknowledgment. Backup gateways can be configured in the Advanced settings of the TCP/IP configuration dialog within the Network Control Panel. Disabling this (setting to 0) might prevent automatic failover to alternative gateways.

EnablePMTUBHDetect¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0, 1 (False, True)
• Default: 0 (False)
• Description: When set to 1 (True), TCP attempts to detect “Black Hole” routers during Path MTU Discovery. A “Black Hole” router fails to return ICMP Destination Unreachable messages when it must fragment an IP datagram with the Don’t Fragment bit set. TCP relies on these messages to correctly perform Path MTU Discovery. Enabling this feature causes TCP to try sending segments without the Don’t Fragment bit if multiple retransmissions go unacknowledged, and if acknowledged, it will reduce the MSS and re-enable the Don’t Fragment bit for future packets. Enabling this can increase the maximum number of retransmissions for a segment.

EnablePMTUDiscovery¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0, 1 (False, True)
• Default: 1 (True)
• Description: If this parameter is set to 1 (True), TCP will try to determine the Maximum Transmission Unit (MTU), or largest packet size, along the entire path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, fragmentation at intermediate routers can be avoided, especially across networks with differing MTUs. Fragmentation significantly impacts TCP throughput and can contribute to network congestion. If set to 0, an MTU of 576 bytes is used for all connections not on the local subnet, potentially leading to increased fragmentation.

ForwardBufferMemory¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Number of bytes
• Valid range: Network MTU - some reasonable value smaller than 0xFFFFFFFF
• Default: 74240 (sufficient for fifty 1480-byte packets, rounded to a multiple of 256)
• Description: This parameter dictates the amount of memory IP allocates for storing packet data within the router’s packet queue. Once this buffer space is exhausted, the router will begin discarding packets randomly from its queue. Packet queue data buffers are 256 bytes in length, so the value must be a multiple of 256. This parameter is only relevant if the IP router functionality is enabled on the system; otherwise, it is ignored and no buffers are allocated.

IGMPLevel¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Number
• Valid range: 0, 1, 2
• Default: 2
• Description: This parameter governs the computer’s support for IP multicasting and its participation in the Internet Group Management Protocol (IGMP).
  • 0: No multicast support.
  • 1: Can only send IP multicast packets.
  • 2: Can both send IP multicast packets and fully participate in IGMP to receive multicast packets.
    Setting this to 2 is the standard for most modern network interactions involving multimedia streaming or other multicast applications.

KeepAliveInterval¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 1 - 0xFFFFFFFF
• Default: 1000 (one second)
• Description: This parameter specifies the time interval that separates successive keepalive retransmissions. Keepalive packets are used to determine if an idle connection is still active. Once a response to a keepalive is received, the KeepAliveTime parameter dictates the delay until the next keepalive transmission. If the number of retransmissions specified by TcpMaxDataRetransmissions are unanswered, the connection is ultimately aborted.

KeepAliveTime¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 1 - 0xFFFFFFFF
• Default: 7,200,000 (two hours)
• Description: This parameter controls how frequently TCP attempts to verify the integrity of an idle connection by sending a keepalive packet. If the remote computer is reachable and functioning, it will acknowledge the keepalive transmission. By default, keepalive packets are not sent unless a program explicitly enables this feature on a particular connection. Reducing this time can help detect broken connections faster, but it also increases network traffic.

MTU¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD Number
• Valid range: 68 - the MTU of the underlying network
• Default: 0xFFFFFFFF
• Description: This parameter allows you to override the default Maximum Transmission Unit (MTU) for a specific network interface. The MTU represents the largest packet size, in bytes, that the transport layer will transmit over the underlying network, including the transport header. Values larger than the network’s default MTU will cause the transport to revert to the network’s default. Values smaller than 68 bytes will force the transport to use an MTU of 68 bytes. Setting a custom MTU can be crucial for VPNs or networks with specific MTU requirements to prevent fragmentation.

NumForwardPackets¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD Number
• Valid range: 1 - some reasonable value smaller than 0xFFFFFFFF
• Default: 50
• Description: This parameter determines the number of IP packet headers allocated for the router’s packet queue. If all headers are in use, the router starts discarding packets randomly from the queue. This value should be at least as large as ForwardBufferMemory divided by the maximum IP data size of connected networks. It must not exceed ForwardBufferMemory divided by 256, as at least 256 bytes of forward buffer memory are used per packet. The optimal number depends on traffic type. Like ForwardBufferMemory, this is ignored if IP routing is not enabled.

TcpMaxConnectRetransmissions¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Number
• Valid range: 0 - 0xFFFFFFFF
• Default: 2
• Description: This parameter dictates the maximum number of times TCP will retransmit a connection request (SYN packet) before abandoning the connection attempt. The retransmission timeout duration doubles with each successive retransmission attempt for a given connection. The initial timeout value is typically three seconds. Increasing this value might help establish connections over very lossy or high-latency networks, but it will also increase the time taken to detect a failed connection.

TcpMaxDataRetransmissions¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Number
• Valid range: 0 - 0xFFFFFFFF
• Default: 5
• Description: This parameter controls how many times TCP will retransmit an individual data segment (any segment other than a connection request) before terminating the connection. The retransmission timeout doubles with each successive retransmission on an active connection. The timeout is reset when acknowledgments resume. The initial timeout value is dynamically determined based on the measured round-trip time of the connection. Increasing this value can improve robustness over unreliable links, but at the cost of increased latency before a connection is deemed broken.

TcpNumConnections¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Number
• Valid range: 0 - 0xfffffe
• Default: 0xfffffe
• Description: This parameter sets the absolute maximum number of TCP connections that the computer can have open simultaneously. The default value is very high, suggesting that this limit is rarely hit in typical usage. Adjusting this might be relevant for high-performance servers or specialized applications that manage a very large number of concurrent TCP sessions.

TcpTimedWaitDelay¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Time in seconds
• Valid range: 30-300 (decimal)
• Default: 0x78 (120 decimal)
• Description: This parameter specifies the duration a connection remains in the TIME_WAIT state after it has been closed. While a connection is in the TIME_WAIT state, the associated socket pair cannot be immediately reused, which can impact performance on busy servers with high connection churn. This state is also known as the “2MSL” (two Maximum Segment Lifetimes) state. According to RFC 793, the value should ideally be twice the maximum segment lifetime on the network. For Windows 2000, the default was 240 seconds; for Windows XP and Server 2003, it was reduced to 120 seconds for IPv4 to enhance performance. The IPv6 stack retains a default of 240 seconds. Reducing this value can free up ports faster, but might lead to issues if delayed packets arrive.

TcpUseRFC1122UrgentPointer¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0, 1 (False, True)
• Default: 0 (False)
• Description: This parameter determines whether TCP uses the RFC 1122 specification for urgent data processing or the mode adopted by BSD-derived systems. These two mechanisms interpret the urgent pointer in the TCP header and the length of the urgent data differently and are not interoperable. By default, Windows XP uses the BSD mode. Changing this might be necessary for specific application compatibility issues when dealing with urgent data over TCP.

TcpWindowSize¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Number of bytes
• Valid range: 0 - 0xFFFF
• Default: The smaller of 0xFFFF (65535) OR the larger of four times the maximum TCP data size on the network OR 8192, rounded up to an even multiple of the network TCP data size.
• Ethernet default: 8760
• Description: This parameter sets the maximum TCP receive window size for the computer. The receive window defines the amount of data (in bytes) that a sender can transmit without needing to receive an acknowledgment. Generally, a larger receive window can significantly improve performance, especially on networks with high latency and high bandwidth (“long fat networks”). For optimal efficiency, the receive window size should ideally be an even multiple of the TCP Maximum Segment Size (MSS) for the network.

TCP/IP Parameters Configurable from Network Connection Properties¶

The following parameters are typically created and managed automatically by the Network Connections interface in Windows XP, based on user input. Direct manipulation of these in the registry is generally not required or recommended, as they can be easily configured through the graphical user interface.

DefaultGateway¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_MULTI_SZ - List of dotted decimal IP addresses
• Valid range: Any set of valid IP addresses
• Default: None
• Description: This parameter specifies a list of IP addresses for default gateways that are used to route packets that are not destined for a subnet directly connected to the computer, and for which there isn’t a more specific route defined. This setting configured manually overrides any DhcpDefaultGateway parameter received from a DHCP server.

Domain¶

• Key: Tcpip\Parameters
• Value type: REG_SZ - Character string
• Valid range: Any valid DNS domain name
• Default: None
• Description: This parameter holds the DNS domain name of the computer. It is utilized by the Windows Sockets interface for various name resolution operations, often appended to hostnames during DNS lookups.

EnableDhcp¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: When this parameter is set to 1 (True), it indicates that the DHCP client service should attempt to use DHCP to automatically configure the primary IP interface associated with the network adapter. If set to 0, static IP configuration is expected.

Hostname¶

• Key: Tcpip\Parameters
• Value type: REG_SZ - Character string
• Valid range: Any valid DNS hostname
• Default: The computer name of the computer
• Description: This parameter defines the DNS hostname of the computer. This is the name that will be returned when the hostname command is executed or when other network clients query the system for its name.

IPAddress¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_MULTI_SZ - List of dotted-decimal IP addresses
• Valid range: Any set of valid IP addresses
• Default: None
• Description: This parameter specifies the IP addresses that are bound to the IP interfaces on the adapter. If the first address in this list is 0.0.0.0, it signifies that the primary interface on the adapter should be configured via DHCP. A computer configured with multiple IP interfaces for a single adapter is known as “logically multihomed.” Each IP address listed here must have a corresponding valid subnet mask specified in the SubnetMask parameter.

IPEnableRouter¶

• Key: Tcpip\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: Setting this parameter to 1 (True) transforms the Windows XP computer into an IP router. This enables the system to forward IP packets between the different networks it is connected to, acting as a gateway for traffic between segments. This is fundamental for enabling network address translation (NAT) or simple routing functions.

NameServer¶

• Key: Tcpip\Parameters
• Value type: REG_SZ - A space-delimited list of dotted decimal IP addresses
• Valid range: Any set of valid IP addresses
• Default: None (Blank)
• Description: This parameter lists the IP addresses of the DNS name servers that will be queried by Windows Sockets for name resolution. These are the servers responsible for translating human-readable domain names into IP addresses. Multiple servers can be listed, separated by spaces.

SearchList¶

• Key: Tcpip\Parameters
• Value type: REG_SZ - Delimited list of DNS domain name suffixes
• Valid range: Any set of valid DNS domain name suffixes
• Default: None
• Description: This parameter specifies a list of domain name suffixes that the DNS client will append to a name during resolution if the initial query for the unadorned name fails. By default, only the value of the Domain parameter is appended. This list can include multiple suffixes, allowing the system to try various domain combinations when resolving short hostnames, which is useful in complex network environments.

SubnetMask¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_MULTI_SZ - List of dotted decimal IP addresses
• Valid range: Any set of valid IP addresses
• Default: None
• Description: This parameter defines the subnet masks to be used with the IP interfaces bound to the specific network adapter. If the first mask in the list is 0.0.0.0, it signifies that the primary interface’s subnet mask should be configured by DHCP. Crucially, there must be a valid subnet mask value in this parameter for each IP address that is specified in the IPAddress parameter, ensuring proper network segmentation and communication.

Non-Configurable TCP/IP Parameters¶

These parameters are internally created and utilized by the TCP/IP components of Windows XP. They are not intended for user modification through the Registry Editor, as doing so could lead to unpredictable system behavior or network connectivity issues. They are listed here for reference and informational purposes only.

DhcpDefaultGateway¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_MULTI_SZ - List of dotted decimal IP addresses
• Valid range: Any set of valid IP addresses
• Default: None
• Description: This parameter holds the list of default gateways provided by the DHCP server. It is written by the DHCP client service if DHCP is enabled for the adapter. This parameter is overridden by any manually configured DefaultGateway parameter.

DhcpIPAddress¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_SZ - Dotted decimal IP address
• Valid range: Any valid IP address
• Default: None
• Description: This parameter stores the IP address that the interface received from a DHCP server. If the IPAddress parameter contains a manually set first value other than 0.0.0.0, that static value takes precedence over this DHCP-assigned address.

DhcpNameServer¶

• Key: Tcpip\Parameters
• Value type: REG_SZ - A space-delimited list of dotted decimal IP addresses
• Valid range: Any set of valid IP addresses
• Default: None
• Description: This parameter lists the DNS name servers provided by the DHCP service. It is written by the DHCP client service if enabled. Any manually configured NameServer parameter will override the values stored in DhcpNameServer.

DhcpServer¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_SZ - Dotted decimal IP address
• Valid range: Any valid IP address
• Default: None
• Description: This parameter records the IP address of the DHCP server that granted the lease for the IP address found in the DhcpIPAddress parameter for this specific network interface.

DhcpSubnetMask¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_SZ - Dotted decimal IP subnet mask
• Valid range: Any subnet mask that is valid for the configured IP address
• Default: None
• Description: This parameter stores the subnet mask that was configured for the IP address by the DHCP server. It is associated with the address specified in the DhcpIPAddress parameter.

IPInterfaceContext¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD
• Valid range: 0 - 0xFFFFFFFF
• Default: None
• Description: This parameter is exclusively written and used by the TCP/IP driver for internal communication with and functionality of the DHCP client service. It holds context information specific to the IP interface.

Lease¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD - Time in seconds
• Valid range: 1 - 0xFFFFFFFF
• Default: None
• Description: Used by the DHCP client service, this parameter stores the total duration (in seconds) for which the IP address lease for this adapter is considered valid.

LeaseObtainedTime¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD - Absolute time in seconds since midnight of 1/1/70
• Valid range: 1 - 0xFFFFFFFF
• Default: None
• Description: This parameter records the exact time, represented as an absolute number of seconds since January 1, 1970, at midnight, when the DHCP client service successfully obtained the IP address lease for this adapter.

LeaseTerminatesTime¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD - Absolute time in seconds since midnight of 1/1/70
• Valid range: 1 - 0xFFFFFFFF
• Default: None
• Description: This parameter, used by the DHCP client service, stores the absolute time (seconds since 1/1/70 midnight) at which the IP address lease for this network adapter is scheduled to expire.

LLInterface¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_SZ - NT device name
• Valid range: A valid NT device name
• Default: Empty string (Blank)
• Description: This parameter serves to direct IP to bind to a different link-layer protocol than the built-in ARP module. Its value is the name of the Windows NT-based device to which IP should bind. This parameter is notably used in conjunction with components like the Remote Access Service (RAS).

T1¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD - Absolute time in seconds since midnight of 1/1/70
• Valid range: 1 - 0xFFFFFFFF
• Default: None
• Description: This parameter is used internally by the DHCP client service to store the time at which the service will first attempt to renew the IP address lease for the adapter. At time T1, the client service contacts the DHCP server that originally granted the lease.

T2¶

• Key: Tcpip\Parameters\Interfaces\ID for Adapter
• Value type: REG_DWORD - Absolute time in seconds since midnight of 1/1/70
• Valid range: 1 - 0xFFFFFFFF
• Default: None
• Description: This parameter is also used by the DHCP client service to store the time at which it will attempt a second phase of lease renewal. If the service was unable to renew the lease with the original DHCP server at time T1, it will broadcast a renewal request at time T2 to any available DHCP server.

Understanding NetBIOS over TCP/IP (NBT) Configuration¶

NetBIOS over TCP/IP (NBT) is a session-layer protocol that allows older applications designed for NetBIOS to run on modern TCP/IP networks. It facilitates NetBIOS name registration, resolution, and session management across IP networks. All NBT parameters are registry values found under one of two distinct subkeys within HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services:

• Netbt\Parameters
• Netbt\Parameters\Interfaces\Tcpip_ID for Adapter

Similar to TCP/IP, “ID for Adapter” refers to the specific network adapter to which NBT is bound. The relationship between an Adapter ID and a Network Connection can be identified by looking at the Name value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\ID for Adapter\Connection. Values located under the Tcpip_ID for Adapter subkeys are specific to each individual network adapter. For changes to NBT parameters to take effect, if the computer is configured via DHCP, issuing the ipconfig /renew command in a command shell might be sufficient. Otherwise, a full computer restart is typically required.

A Quick Look at NetBIOS and NBT¶

NetBIOS (Network Basic Input/Output System) provides services related to the session layer of the OSI model, allowing applications on different computers to communicate over a local area network. NBT encapsulates these NetBIOS services within TCP/IP packets, enabling them to traverse routers and operate across larger, interconnected networks, including the internet. This is particularly important for older Windows file and print sharing protocols.

Standard NBT Parameters Configurable via Registry Editor¶

These NBT parameters are installed with default values when the TCP/IP components are set up by the Network tool. They can be modified using Registry Editor (Regedit.exe) to adjust NBT’s behavior.

BcastNameQueryCount¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Count
• Valid range: 1 to 0xFFFF
• Default: 3
• Description: This value determines the number of times NetBT will broadcast a query for a particular NetBIOS name on the local network without receiving any response. Increasing this count might help in noisy or unreliable broadcast domains, but also increases network traffic and resolution time for non-existent names.

BcastQueryTimeout¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 100 to 0xFFFFFFFF
• Default: 0x2ee (750 decimal)
• Description: This value specifies the time interval, in milliseconds, between successive broadcast name queries for the same NetBIOS name. A shorter timeout will make NetBT try to resolve names faster, but might overwhelm slower networks or devices.

CacheTimeout¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 60000 to 0xFFFFFFFF
• Default: 0x927c0 (600000 milliseconds = 10 minutes)
• Description: This value determines how long, in milliseconds, NetBIOS names resolved through various means (like WINS or broadcasts) are cached in the remote name table. A longer timeout reduces name resolution traffic but means changes to network names take longer to propagate.

NameServerPort¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - UDP port number
• Valid range: 0 - 0xFFFF
• Default: 0x89 (137 decimal)
• Description: This parameter defines the destination UDP port number to which NetBT sends packets related to name service operations, such as name queries and name registrations, primarily to WINS (Windows Internet Name Service) servers. The standard Microsoft WINS service listens on port 0x89. Other vendors’ NetBIOS name servers might use different ports, requiring adjustment here for compatibility.

NameSrvQueryCount¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Count
• Valid range: 0 - 0xFFFF
• Default: 3
• Description: This value determines the number of times NetBT will send a direct query to a WINS server for a specified NetBIOS name if it doesn’t receive a response. Similar to broadcast queries, increasing this can improve reliability with unreliable WINS servers but delays resolution of non-existent names.

NameSrvQueryTimeout¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 100 - 0xFFFFFFFF
• Default: 1500 (1.5 seconds)
• Description: This value specifies the time interval, in milliseconds, between successive name queries sent directly to WINS servers for a particular name. Shorter timeouts lead to faster attempts, but may not be suitable for high-latency connections to WINS servers.

SessionKeepAlive¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 60,000 - 0xFFFFFFFF
• Default: 3,600,000 (1 hour)
• Description: This value determines the time interval, in milliseconds, between keepalive transmissions on an NBT session. Keepalives are used to ensure that idle sessions remain active and to detect if the remote peer is still available. Setting the value to 0xFFFFFFF (a very large number) effectively disables keepalives for NBT sessions.

Size/Small/Medium/Large¶

• Key: Netbt\Parameters
• Value type: REG_DWORD
• Valid range: 1, 2, 3 (Small, Medium, Large)
• Default: 1 (Small)
• Description: This value controls the size of the internal name tables used by NBT to store local and remote NetBIOS names.
  • Small (1): Adequate for most client workstations (Hash table buckets: 16).
  • Medium (2): (Hash table buckets: 128).
  • Large (3): Often automatically set to Large if the computer functions as a proxy name server, to accommodate a larger name cache hash table (Hash table buckets: 256).
    Choosing a larger size can improve performance for systems handling many NetBIOS names but consumes more memory.

Optional NBT Parameters Configurable via Registry Editor¶

These NBT parameters typically do not exist in the registry by default. They can be created to modify the default behavior of the NetBT protocol driver, offering advanced customization for specific network scenarios.

BroadcastAddress¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Four bytes, little-endian encoded IP address
• Valid range: 0 - 0xFFFFFFFF
• Default: The ones-broadcast address for each network (e.g., 255.255.255.255 or subnet-specific broadcast).
• Description: This parameter can be used to compel NetBT to use a specific IP address for all broadcast name-related packets. By default, NetBT automatically determines and uses the appropriate ones-broadcast address for each network it is bound to (e.g., for a 192.168.1.0/24 network, it would use 192.168.1.255). This parameter would be set, for example, if the network predominantly uses the zeros-broadcast address (which can be configured using the UseZeroBroadcast TCP/IP parameter). For instance, if the desired zeros-broadcast address is 192.168.1.0, this parameter would be set to 0xC0A80100 (hexadecimal representation of 192.168.1.0 in little-endian format). This parameter is global and affects all subnets to which NetBT is bound.

EnableProxy¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: If this value is set to 1 (True), the computer will function as a NetBIOS proxy name server for the networks to which NBT is bound. A proxy name server listens for broadcast queries for NetBIOS names and attempts to resolve them through WINS (Windows Internet Name Service), then responds to the broadcasting client. This feature allows B-node implementations (which rely on broadcasts) to resolve names of servers located on other subnets that are registered with WINS.

EnableProxyRegCheck¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: If this parameter is set to 1 (True), the proxy name server will send a negative response to a broadcast name registration request if the requested name is already registered with WINS or exists in the proxy’s local name cache with a different IP address. The risk of enabling this feature is that it can prevent a computer from changing its IP address (e.g., via DHCP) if WINS already has a mapping for that name. For this reason, it is disabled by default to allow more flexible IP address assignments.

InitialRefreshT.O.¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 960000 - 0xFFFFFFF
• Default: 960000 (16 minutes)
• Description: This parameter specifies the initial refresh timeout that NBT uses during the name registration process. When NBT first registers its names, it tries to contact the WINS servers at an interval of ⅛th of this time. Upon receiving a successful registration response, that response typically contains a new, dynamic refresh interval to be used subsequently.

LmhostsTimeout¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 1000 - 0xFFFFFFFF
• Default: 6000 (6 seconds)
• Description: This parameter specifies the timeout value for queries to the LMHOSTS file and DNS name queries initiated by NBT. The internal timer has a granularity equal to this timeout value, meaning the actual timeout experienced could be up to twice this value. Adjusting this can influence how quickly NBT moves on to the next name resolution method if LMHOSTS or DNS is unresponsive.

MaxDgramBuffering¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Count of bytes
• Valid range: 0 - 0xFFFFFFFF
• Default: 0x20000 (128 KB)
• Description: This parameter sets the maximum amount of memory that NetBT dynamically allocates for all outstanding datagram sends. Once this memory limit is reached, any additional datagram send requests will fail due to insufficient resources. Increasing this can support higher volumes of datagram traffic but consumes more system memory.

NodeType¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Number
• Valid range: 1, 2, 4, 8 (B-node, P-node, M-node, H-node)
• Default: 1 or 8 based on the WINS server configuration
• Description: This parameter dictates the methods NetBT uses for NetBIOS name registration and resolution.
  • 1 (B-node): Uses broadcast for resolution.
  • 2 (P-node): Uses only point-to-point queries to a name server (WINS).
  • 4 (M-node): Broadcasts first, then queries the name server.
  • 8 (H-node): Queries the name server first, then broadcasts.
    Resolution through LMHOSTS or DNS follows these primary methods. If this key is present, it overrides the DhcpNodeType key. If neither key is present, the computer defaults to B-node if no WINS servers are configured, and H-node if at least one WINS server is configured. H-node is generally preferred in WINS-enabled environments.

RandomAdapter¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: This parameter applies exclusively to multihomed hosts (computers with multiple network interfaces). If set to 1 (True), NetBT will randomly select one of its bound IP addresses to include in a NetBIOS name query response, rather than defaulting to the address of the interface on which the query arrived. This feature can be used by a server with two interfaces on the same network to assist with basic load balancing.

RefreshOpCode¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Number
• Valid range: 8, 9
• Default: 8
• Description: This parameter forces NetBT to use a specific opcode in name update packets during NetBIOS name registration. The NetBT protocol specification is somewhat ambiguous in this area. While Microsoft implementations default to 8, which appears to be the intended value, some other implementations (e.g., from Ungermann-Bass) use the value 9. For interoperability between different NetBIOS implementations, both sides must use the same opcode.

SingleResponse¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: This parameter is also relevant only for multihomed hosts. If set to 1 (True), NBT will include only a single IP address from one of its bound interfaces in NetBIOS name query responses. By default, the addresses of all bound interfaces are included in the response. This might be used to simplify name resolution for clients or to control which IP address is advertised for a service.

WinsDownTimeout¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Time in milliseconds
• Valid range: 1000 - 0xFFFFFFFF
• Default: 15,000 (15 seconds)
• Description: This parameter determines the duration, in milliseconds, that NBT will wait before attempting to use WINS again after it has failed to contact any configured WINS server. This feature allows computers that are temporarily disconnected from the network to proceed through boot processing without excessively long delays caused by individual WINS name registration or query timeouts.

NBT Parameters Configurable from the Connection Properties¶

The following parameters can be conveniently configured through the graphical user interface within the Network Connections folder in Windows XP. Direct modification of these parameters in the registry is generally unnecessary, as the GUI provides a user-friendly way to manage them.

EnableDns¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 0 (False)
• Description: If this value is set to 1 (True), NBT will query the Domain Name System (DNS) for names that could not be resolved by its primary methods, such as WINS, broadcast, or the LMHOSTS file. This enables a wider range of name resolution capabilities for NetBIOS applications, extending beyond local network methods.

EnableLmhosts¶

• Key: Netbt\Parameters
• Value type: REG_DWORD - Boolean
• Valid range: 0 or 1 (False or True)
• Default: 1 (True)
• Description: When this value is set to 1 (True), NBT will search the LMHOSTS file for NetBIOS names that could not be resolved by WINS or broadcast methods, provided the file exists. By default, there isn’t an LMHOSTS file in the directory specified by Tcpip\Parameters\DatabasePath, so NBT takes no action unless a file is created. This setting is typically managed through the Advanced TCP/IP configuration dialog within the Network Control Panel.

NameServer¶

• Key: Netbt\Parameters\Interfaces\Tcpip_ID for Adapter
• Value type: REG_SZ - Dotted decimal IP address (for example, 11.101.1.200)
• Valid range: Any valid IP address
• Default: blank (no address)
• Description: This parameter specifies the IP address of the primary WINS server that NBT should use for name registration and resolution. If this parameter contains a valid value, it will explicitly override any WINS server address that might have been provided by DHCP for this interface.

NameServerBackup¶

• Key: Netbt\Parameters\Interfaces\Tcpip_ID for Adapter
• Value type: REG_SZ - Dotted decimal IP address (for example, 11.101.1.200)
• Valid range: Any valid IP address.
• Default: blank (no address)
• Description: This parameter specifies the IP address of the backup WINS server. NBT will attempt to use this server if the primary WINS server (specified by NameServer) is unavailable or unresponsive. Similar to the primary WINS server setting, a valid value here will override any backup WINS server address obtained through DHCP.

ScopeId¶

• Key: Netbt\Parameters
• Value type: REG_SZ - Character string
• Valid range: Any valid DNS domain name consisting of two dot-separated parts, or a “*“.
• Default: None
• Description: This parameter defines the NetBIOS name scope for the node. NetBIOS name scopes are used to logically group NetBIOS resources and prevent name conflicts in large networks. The value must not begin with a period. If this parameter contains a valid value, it overrides any DHCP-provided scope ID. A blank value (empty string) will be ignored. Setting this parameter to the literal value “*” indicates a null scope, which will also override the DHCP parameter, essentially disabling scope filtering.

Non-Configurable NBT Parameters¶

The following parameters are created and used internally by the NetBT components of Windows XP. They are not intended for user modification using the Registry Editor. Attempting to modify these values could compromise the stability and functionality of the NetBT protocol. They are provided here solely for informational purposes.

Consider this guide a reference for advanced network troubleshooting and optimization in Windows XP. Always exercise caution when making direct registry modifications.

---

Do you have any experience optimizing Windows XP networks? Share your tips or questions about specific TCP/IP or NBT parameters in the comments below!