There are two more Session Service message types to cover:
0x00: SESSION MESSAGE
Once you have established a session (by sending a SESSION REQUEST and receiving a POSITIVE SESSION RESPONSE ) you are ready to send messages. Each message is prefixed with a SESSION MESSAGE header, which looks like this:
HEADER { TYPE = 0x00 LENGTH = <Length of data to follow> }
Since the TYPE byte has a value of 0x00 , and the next seven bits are always supposed to be zero as well, the Session Message header may be viewed simply as a long integer length value.
length = ntohl( *(ulong *)packet );
It might be wise to mask out the unused FLAGS bits, just in case.
0x85: SESSION KEEPALIVE
The Keepalive is used to detect a lost connection. Basically, if one node hasn't sent anything to the other node for a while (typically five to six minutes), it will send a SESSION KEEPALIVE , just to make sure the remote end is still listening. The receiver simply discards the message.
HEADER { TYPE = 0x85 LENGTH = 0 }
TCP is a connection-oriented protocol, so the Keepalive should generate an ACK nowledgement, or possibly a series of retries if the TCP ACK doesn't show up right away. The Keepalive message forces TCP to verify that the connection is still working, and to report back if there is a problem. If a problem is detected , the client or server can gracefully shut down its end of the connection.
RFC 1001 makes it clear that sending the NBT Session Service Keepalive message is optional. TCP itself also has a keepalive mechanism, which should be used instead, if possible.