8.2 NBT or Not NBT
| Before we actually start, there is one more thing to mention: The SMB protocol is supposed to be "transport independent." That is, SMB should work over any reliable transport that meets a few basic criteria. NBT is one such transport, but SMB does not really require the NetBIOS API. It can, for instance, be run directly over TCP/IP. Just for fun, we will refer to SMB over TCP/IP without NBT as "naked" or "raw." When running naked, SMB defaults to using TCP port 445 instead of the NBT Session Service port (TCP/139). Windows 2000, Windows XP, and Samba all support raw transport, but the large number of "legacy" Windows clients still in use suggest that NBT will not go away any time soon. Other than the new port number, there are only two notable differences between NBT and naked transport. The first is that naked transport does not make use of the NBT SESSION REQUEST and POSITIVE SESSION RESPONSE messages. The second is that the two transports interpret the SESSION MESSAGE header a bit differently. Recall (from Chapter 6 on page 129) that the NBT Session Service prepends a four-byte header to each SESSION MESSAGE , like so: The LENGTH field, as shown, is 17 bits wide. [5] Raw TCP transport also prepends a four-byte header, but there are no reserved bits so the LENGTH may use three full bytes:
Appendix B of the SNIA CIFS Technical Reference is the only source that was found which clearly shows the naked transport LENGTH field as being 24 bits wide. This 24-bit field translates to 16 megabytes, though, and that's a bigbunch more than is typically practical. Fortunately, the actual maximum message size is something that is negotiated when the client and server establish the session. When we discuss the SMB messages themselves we will ignore the SESSION MESSAGE headers, since they are part of the transport, not the SMB protocol. |
EAN: 2147483647
Pages: 210