Lesson 3:NetBEUI | Self-Paced Training Kit Exam 70-642: Configuring Windows Server 2008 Network Infrastructure

The default protocol for the Microsoft Windows operating systems today is TCP/IP, but the early versions of Microsoft Windows NT and Microsoft Windows for Workgroups relied on another protocol called NetBEUI. NetBEUI support is still included in all of the Windows operating systems, and certain elements of it are an integral part of Windows networking, whether you use the NetBEUI protocol or not.

After this lesson, you will be able to

Understand the function of NetBIOS in the Windows operating systems
Describe the NetBEUI Frame format
Understand the functions of the four protocols that use NetBEUI Frames

Estimated lesson time: 30 minutes

NetBEUI differs substantially from IP and IPX. The primary difference is that NetBEUI does not route packets between networks, so the protocol is not suitable for use on large internetworks.

Microsoft adopted NetBEUI for use with Windows at a time when the company was first adding networking capabilities to its operating systems. Like NetWare, the initial market was for small LANs, and it is in this environment that NetBEUI excels. For a small stand-alone network, NetBEUI provides excellent performance, and it is self-adjusting and self-configuring. There's no need to supply the client with an address and other configuration parameters, as with TCP/IP. NetBEUI, however, does not support Internet communications; this requires TCP/IP. If connecting your network to a shared Internet connection, you must run TCP/IP.

If you're having problems getting a Windows-based system to communicate with the other systems on a TCP/IP network, installing NetBEUI on the systems involved is a good way of isolating the problem. If the systems can communicate using NetBEUI, you know that the networking hardware and the network interface adapter driver are all functioning properly and the problem most likely lies with the TCP/IP configuration on one or both systems.

NetBIOS Naming

NetBIOS is a programming interface that applications use to communicate with the networking hardware in the computer and, through that, with the network. NetBIOS includes its own namespace, which NetBEUI uses to identify computers on the network, just as IP uses its own IP addresses and IPX uses hardware addresses. The computer name that you assign to a system during Windows installation is, in reality, a NetBIOS name, which must be unique on the network.

A NetBIOS name is 16 characters long. Windows reserves the last character for a code that identifies the type of resource using the name, leaving 15 user-assigned alphanumeric characters. Different codes can identify NetBIOS names as representing computers, domain controllers, users, groups, and other resources. If you assign a name of fewer than 15 characters to a computer, the system pads it out to 15, so that the identification code always falls on the final character.

Microsoft Windows 2000 departs from previous Windows practices by storing its computer and user names using the Domain Name System (DNS) namespace instead of NetBIOS. However, Active Directory, Windows 2000's directory service, maintains NetBIOS functionality for purposes of backward compatibility. An earlier version of Windows can see and interact with Windows 2000 systems using NetBIOS equivalents of the DNS names, and in the same way, Windows 2000 can work with the NetBIOS names of systems running earlier versions of Windows.

NetBIOS names are stored in a flat-file database; there is no hierarchy among the names. IP and IPX both use a hierarchical system of addressing in which one value identifies the computer and another value identifies the network on which the computer is located. NetBIOS names have no network identifier, which is why NetBEUI is not routable; it has no means of addressing packets to specific networks or maintaining routing tables containing information about networks. NetBEUI deals solely with computer identifiers, which means that all of the computers must be accessible from the one network.

The NetBEUI Frame

The NetBEUI Frame (NBF) protocol is a multipurpose protocol that Windows-based computers use for a variety of purposes, including the registration and resolution of NetBIOS names, the establishment of sessions between computers on the network, and the transport of file and print data using Windows' Server Message Blocks (SMB) protocol. All of these functions use a single frame format, as diagrammed in Figure 6.6.

The following are the functions of the NBF fields:

Length (2 bytes). This field specifies the length of the NBF header (in bytes).
Delimiter (2 bytes). This field signals the receiving system that the message should be delivered to the NetBIOS interface.
Command (1 byte). This field identifies the function of the NBF message.
Data1 (1 byte). This field is used to carry optional data specific to the message type specified by the Command field.
Data2 (2 bytes). This field is used to carry optional data specific to the message type specified by the Command field.
Transmit Correlator (2 bytes). This field contains a value that the receiving system will duplicate in the same field of its reply messages, enabling the sending system to associate the requests and replies.
Response Correlator (2 bytes). This field contains the value that the sending system expects to receive in the Transmit Correlator field of the reply to this message.
Destination Name (16 bytes). This field contains the NetBIOS name of the system that will receive the packet.
Source Name (16 bytes). This field contains the NetBIOS name of the system sending the packet.
Destination Number (1 byte). This field contains the number assigned to the session by the destination system.
Source Number (1 byte). This field contains the number assigned to the session by the source system.
Optional (variable). This field contains the actual data payload of the packet.

Figure 6.6 The NetBEUI Frame format

The value in the Command field dictates the type of message contained in the packet, using the following values:

00 Add Group Name Query
01 Add Name Query
02 Name In Conflict
03 Status Query
07 Terminate Trace (remote)
08 Datagram
09 Datagram Broadcast
0A Name Query
0D Add Name Response
0E Name Recognized
0F Status Response
13 Terminate Trace (local and remote)
14 Data Ack
15 Data First Middle
16 Data Only Last
17 Session Confirm
18 Session End
19 Session Initialize
1A No Receive
1B Receive Outstanding
1C Receive Continue
1F Session Alive

There are four separate protocols that make use of the NetBEUI Frame: the Name Management Protocol (NMP), the Session Management Protocol (SMP), the User Datagram Protocol (UDP), and the Diagnostic and Monitoring Protocol (DMP).

NMP

Name Management Protocol (NMP) is the protocol that systems use to register and resolve NetBIOS names on the network. When a system first starts up, it generates an Add Name Query message containing its NetBIOS name and transmits it to the other NetBIOS systems on the network. The function of this message is to ensure that no other system is using that same name. If there is a duplication, the system already using the name must reply with an Add Name Response message, and the querying system displays an error message. If the system receives no response, the name is registered to that system.

Name resolution is the process of converting a NetBIOS name into the hardware address needed for a system to transmit data-link layer frames to it. When a NetBEUI system has data to transmit to a particular system or wants to establish a session with another system, it begins by generating a Name Query message containing the name of the target system in the Destination Name field and sending it to all of the NetBIOS systems on the network. All of the systems on the network with registered NetBIOS names are required to respond to Name Query messages containing their name. The system with the requested name responds by transmitting a Name Recognized message back to the sender as a unicast message. The sender, on receiving this message, extracts the hardware address of the system holding the requested name and can then transmit subsequent packets to it as unicasts.

One of the drawbacks of NetBEUI, and one of the reasons it is only suitable for relatively small networks, is the large number of broadcast packets it generates. These Name Query requests are actually transmitted to a special NetBIOS address, but on a Windows-based network, this is the functional equivalent of a broadcast. On a large network or a network with high traffic levels, systems must process a large number of these name resolution broadcasts for no reason, because they are intended for other systems.

SMP

The NBF messages used by NMP use NetBEUI's connectionless service. These messages are part of brief request and response transactions that don't require additional services like packet acknowledgment. For more extensive data transfers, however, a connection-oriented, reliable service is required, and to do this, the two communicating systems must first create a session between them. The systems use NBF's Session Management Protocol (SMP) messages to establish a session, transmit data, and then break down the session afterward.

The session establishment begins with a standard name resolution exchange, followed by the establishment of a session at the Logical Link Control (LLC) layer. Then the client system initiating the session transmits a Session Initialize message to the server system, which responds with a Session Confirm message. At this point, the session is established, and the systems can begin to transmit application data using Data First Middle and Data Only Last messages, which may contain data generated by other protocols, such as SMB. The system receiving the data replies with Receive Continue or Data Ack messages that serve as acknowledgments of successful transmissions.

During the session, when no activity is taking place, the systems transmit periodic Session Alive messages, which prevent the session from timing out. When the exchange of data packets is completed, the client generates a Session End message, which terminates the session.

UDP

To exchange small amounts of data, systems can also use the same connectionless service as NMP. This is sometimes referred to as the User Datagram Protocol (UDP), but it is important not to confuse this protocol with the TCP/IP transport layer protocol of the same name. The UDP is the simplest of the NBF protocols, consisting of only two message types, the Datagram message and the Datagram Broadcast message. Systems can transmit various kinds of information using these messages, including SMB data.

DMP

NetBEUI systems use the Diagnostic and Monitoring Protocol (DMP) to gather status information about systems on the network. A NetBEUI system generates a Status Query message and transmits it to all of the NetBIOS systems on the network. The systems reply with Status Response messages containing the requested information.

Exercise 1: NBF Protocols

For each of the NBF message types listed, specify which of the four NBF protocols—NMP, SMP, UDP, or DMP—is primarily associated with it.

Datagram Broadcast
Data First Middle
Name Query
Status Response
Add Name Response

Lesson Review

How does a NetBEUI network prevent two systems from using the same NetBIOS name?
Give two reasons why NetBEUI is not suitable for use on a large internetwork.
Place the following phases of a NetBEUI Frame session in the proper order:
1. Session Alive
2. Session Initialize
3. LLC session establishment
4. Name resolution
5. Session End
6. Session Confirm
Which of the following protocols is capable of providing connection-oriented service?
1. IP
2. IPX
3. NetBEUI
4. None of the above

Lesson Summary

NetBEUI is a network layer protocol used by small Windows networks for LAN networking services.
NetBEUI differs from IP and IPX primarily in that it has no network identifiers and is therefore not routable.
The NetBEUI Frame provides transport services for four protocols: the Name Management Protocol (NMP), the Session Management Protocol (SMP), the User Datagram Protocol (UDP), and the Diagnostic and Monitoring Protocol (DMP).