The name server interface definition supports several procedures for accessing name data at the name server. The use of NS_GET_SAPS_BY_SAPNAME and NS_GET_SAPNAMES_BY_SAP has been shown above.
Two additional functions are provided to permit maximum experimental flexibility, namely NS_LOWLEVEL_LOOKUP and NS_GET_SAP_BY_NAME. The former has data types which can be "hacked" at client and server ends to permit arbitrarily marshalled bytes to be sent to the server. The server would have to implement the "msdr-hacked" marshalling routines to understand the data being sent to it.
NS_GET_SAP_BY_NAME permits the client to send a variable length string which will be parsed by the server according to some server-defined "language" to work out what service is required. The return is a set of zero or more saps. Additional routines supply extra information if it is known, to help the server perform the search.
Ideally a client which "knows" what its arguments mean should marshal them for a special rpc call the the server, rather than simply sending a string.