Home / server / Questions / 39767
Accepted
Roger Lipscombe
Asked: 2009-07-14 01:49:12 +0800 CST

What settings does Windows use to determine network location?

  • 772

Windows has the concept of network location awareness (NLA), which means that you can configure a network as "public" (i.e. home/work), "private", etc..

What information does it use to "fingerprint" a network for this purpose?

windows

3 Answers

  1. Source: http://msdn.microsoft.com/en-us/library/ms740558%28VS.85%29.aspx

    The Network Location Awareness (NLA) service provider is vital for computers or devices that might move between different networks, and for selecting optimal configurations when more than one is available. For example, a wireless computer roaming between physical networks can use NLA to determine the proper configuration based on information about its available network connection. NLA also proves valuable when a multihomed computer has a physical connection to one network while also connected to another network through a dial-up connection or a tunnel.

    In the past, developers had to obtain information about a logical network interface, and therefore make decisions about network connectivity, based on a multitude of disparate network information. In those circumstances, developers had to choose the appropriate network interface based on the IP address, the subnet of the interface, the Domain Name System (DNS) name associated with the interface, the MAC address of a NIC, a wireless network name, or other network information. NLA alleviates this problem by supplying a standard interface for enumerating logical network attachment information, correlating it with physical network interface information, and then providing notification when previously returned information gets invalidated.

    NLA provides the following network location information:

    • Logical Network Identity

      NLA first attempts to identify a logical network by its DNS domain name. If a logical network does not have a domain name, NLA identifies the network from custom static information stored in the registry, and finally from its subnet address.

    • Logical Network Interfaces

      For each network to which a computer is attached, NLA supplies an AdapterName that uniquely identifies a physical interface such as a NIC, or a logical interface such as a RAS connection. The AdapterName can then be used with functions available in the IP Helper API to obtain further interface characteristics.

    NLA implements the logical network as a service class, with an associated class GUID and properties. Each logical network for which NLA returns information is an instance of that service class.

    • 3
  2. Best Answer
    • 3

  3. Based on recent experimentation (with Server 2012, but I suspect earlier versions are similar) on non-domain, statically configured networks the NLA service uses the link-layer (MAC) address of the default gateway to identify the network.

    The details are unclear, though I suppose they could be worked out with a network analyzer. If the configured default gateway does not respond, NLA does not recognize the network, so it's definitely doing some sort of query. (That is, you can't just put in a dummy gateway address, or even a dummy gateway address plus static arp entry; the gateway MAC address associated with a particular network must actually respond in order for NLA to decide that the adapter is connected to that network.)

    See also my blog entry on a way of fooling Windows 2012 into assigning an adapter to a unique network.

    If the adapter is assigned an address by DHCP, the logic might be different. I haven't looked into that yet. The logic on a domain network is documented as per the existing answers.

    • 1