Microsoft SMB, SMB2, NetBIOS, WINS protocol suite
This document provides a quick overview of how various Microsoft
protocol (SMB, SMB2, NetBIOS, WINS, dynamic DNS updates) work and
interact.
This is work in progress and reflects my current knowledge, which
might or might not be accurate.
Keywords: SMB, SMB2, CIFS, NetBIOS, WINS, dynamic DNS updates, netbios-ns,
netbios-dgm, netbios-ssn, port 137, port 138, port 139, port 445
1 SMB
- Server Message Block (SMB), aka Common Internet File System (CIFS).
- Application layer protocol to network access to files, printer,
etc. as well as inter process communication
- New version (SMB2) introduced with Windows Vista
- Originally used NetBIOS and NetBIOS over TCP/IP for communication.
- Uses NetBIOS datagram and session service.
- Question: when is datagram service used
- Direct communication over 445/TCP added with Win 2000
- Broadcast traffic issues were due to WINS
- SMB2 might only support 445/TCP and not NetBIOS, but I don't know.
- History:
- Originated at IBM
- Microsoft merged it with LAN Manager
- Designed to run over NetBIOS
2 NetBIOS
- Background
- Provides services related to OSI session layer
- NetBIOS is an API, not a networking protocol
- Developed in 1983, used for a bunch of things, but now only known as API providing services for SMB.
- Older OSes ran NetBIOS over Ethernet, IPX/SPX using NetBIOS Frames (NBF)
- Now mostly NetBIOS over TCP/IP (NBT). (NetBIOS is now used as synonym for NBT)
- Nodes have a NetBIOS name and an IP address.
- NetBIOS over TCP/IP services.
- Standardized in
- Provides:
+ Name Service (Port 137/UDP)
+ Datagram Service (Port 138/UDP)
+ Session Service (Port 139/TCP)
- SMB runs on top of NetBIOS
2.1 Windows Internet Naming Service (WINS)
- Microsoft's implementation of NetBIOS nameservice.
- Port 137/UDP, (multicast?, broadcast?, unicast?)
- Provides serverless NetBIOS name <--> IP translation
- Can also use central WINS server(s)
- WINS server can replicate and automatically discover replication
partners (see [MS-WINSRA]
- Superseded since Win2000 by hierarchical dynamic DNS updates (see
Section Hierarchical dynamic DNS updates.
- Dynamic DNS is centralized. Sends Name <--> IP mapping updates to
DNS Server
- Exchange, and MS-SQL (2000 and 2003) still require WINS.
- LLMNR (see my other site) adds
serverless name resolution using mulicast (introduces with WinVista).
Might make WINS really obsolete.
2.2 Session service
- Runs on port 139/TCP
- See RFCs for details
- Basic Idea
- Establish TCP connection
- Originator sends NetBIOS session request message (type=0x81)
(this includes information about the caller and callee, like
their WINS / NetBIOS names).
- Responder sends response (e.g., type=0x82 if session is accepted).
But can also deny or send a redirect.
- Messages are exchanged. These are of type 'session message'
(type=0x00). The session message is 4 bytes NetBIOS specific
information followed by the payload. SMB is carried in this payload.
The first couple of bytes of payload are SMB's magic Note, that the
NetBIOS message header specifies the length of the payload.
- NetBIOS also specifies Keepalives messages, but I don't know whether
these are used by Microsoft. They have type=0x85
- No other services or communication provided by session service
2.3 Datagram service
- Runs on port 138/UDP
- See RFC for details
- Basic idea:
- Each datagram has caller, callee, etc. header, followed by payload.
- Has some sort of support for fragmentation, however, I don't know if
Microsoft uses this and even they do, why it is necessary, as IP
should handle that on its own.
- SMB is carried as payload of the NetBIOS datagram
- Unknown which SMB messages use datagram service, as it is unreliable
3 SMB revisited
- If used over NetBIOS see above.
- If used native (port 445/port), each SMB message is preceded by a
shim NetBIOS 'session message' prefix (type 0x00, 4 bytes long,
includes the length of the message). Presumably this is required to
specify the length of the message. No NetBIOS session establishment
(types 0x81, 0x82 are used on port 445!)
- SMB2 still has this 4 byte prefix!
- See protocol specs below.
4 Hierarchical dynamic DNS updates
- Superseded WINS. But requires a central DNS server.
- Are SRV RRs relevant here??
- TODO