Although NetBIOS is often encapsulated, it can be implemented "on the wire". This chapter looks at the implementation of NetBIOS on two popular networking technologies, Ethernet and Token Ring as well as the 802.2 Logical Link Control layer used with these technologies. This documentation looks at the technologies in relation to NetBIOS rather than attempting to provide a full description of the protocols; there are many excellent books on 802.2, Ethernet and Token Ring that describe those subjects in detail.

In the OSI Reference Model, the Datalink layer sits above the Physical layer and below the Network layer. When considering IEEE LAN technology the situation is a little more complex. There are a number of LAN systems such as Token Ring and Ethernet and the physical characteristics of these are defined in the Physical Layer of the OSI model. Characteristics such as the frame format for systems such as Token Ring and Ethernet are defined in the Datalink layer in standards such as 802.3, 802.5 etc. A common interface was required between these standards and the protocols in layer 3 and this is implemented in 802.2. A full description of IEEE 802.2 Logical Link Control is beyond the scope of this document; a brief overview is given below. IEEE 802.2 Logical Link Control frames often provide the data link layer support for implementations of NetBIOS. This is the case when NetBIOS frames are being carried "on the wire" rather than encapsulated in another protocol. The relationship is illustrated in the Open Systems Interconnection (OSI) Reference Model 802.2 supports both connection-oriented and connection-less oriented communications. The Logical Link Control offers services to the Network layer through Service Access Points (SAPs). The SAP is used to identify the process at the Network layer. IEEE 802.2 frames have the following form: DSAP 1 byte Destination Service Access Point SSAP 1 byte source Service Access Point Control 1 or 2 bytes field length depends on the service Information This variable length field carries any data Some examples of DSAP and SSAP values are given below. For IPX (the network protocol traditionally used with NetWare networks), DSAP = 0xE0 (224), SSAP = 0xE0 and Control is 1 byte 0x03 which denotes the 802.2 unnumbered format. For SNAP (Sub-Network Access Protocol), DSAP = 0xAA (170), SSAP = 0xAA For NetBIOS, DSAP = 0xF0 (240) , SSAP = 0xF0 Some IEEE 802.2 Numbers of interest can be found at The Internet Assigned Numbers Authority web site, Protocol Numbers and Assignment Services in IEEE 802 Numbers: http://www.iana.org/assignments/ieee-802-numbers In 1985 IBM implemented NetBIOS over Token Ring and established the way in which NetBIOS frames would map to 802.2 frames. When NetBIOS is implemented over Token Ring, the NetBIOS frames are mapped directly on to the 802.2 frames; the NetBIOS frame is contained in the information field of the 802.2 frame: DSAP 1 byte Destination Service Access Point 0xF0 SSAP 1 byte source Service Access Point 0xF0 Control 1 or 2 bytes field length depends on the service Information: NetBIOS header Optional data The above scheme is general to implementations of NetBIOS over 802.2 where other underlying technologies are used such as Ethernet.

Token Ring is becoming less popular with many organizations moving to Ethernet. Token Ring is discussed here because of it's importance in the history of NetBIOS and understanding of NetBIOS. When IBM introduced Token-Ring, an emulator for NetBIOS was produced. The NetBIOS Extended User Interface (NetBEUI) was introduced in 1985. NetBIOS was no longer implemented only on a set of propriety protocols, but also on 802.2 frames. The implementation on Token-Ring was the first implementation over 802.2 and provides a reference model. Detailed information can be found in the IBM manual: IBM LAN Technical Reference, see IBM LAN Technical Reference IEEE 802.2 and NetBIOS Application Program Interfaces. A full description of Token Ring is beyond the scope of this document; some basic information on Token Ring and its use with NetBIOS is given below. There are two kinds of Token Ring frames: Media Access Control (MAC) frames and Non-MAC frames. MAC frames carry Token Ring management information between nodes, Non-MAC frames carry user data. The non-MAC frames contain IEEE 802.2 Logical Link Control frames which in turn can contain NetBIOS frames.

Token Ring frame 802.2 Frame detail NBF frame Start Delimiter (SDEL) 1 octet Access Control (AC) 1 octetFrame Control (FC) 1 octetDestination Address 6 octetsSource Address 6 octetsIEEE 802.2 Logical Link Control DSAP 2 octets SSAP 2 octets Control 1 or 2 octets Data 46-1500 octets NetBIOS header Optional dataFrame Check sequence (FCS) 4 octetsEnd Delimiter (EDEL) 1 octet Frame Status (FS) Check sequence 1 octet

Many manuals and documents describe Token-Ring in detail including Novell's Guide to NetWare LAN Analysis, see

A full description of Ethernet is beyond the scope of this document; some basic information on Ethernet and its use with NetBIOS is given below. Ethernet is widely used today and well documented. Four types of Ethernet frames have been in common use. For convenience the notation used by Novell is used to describe the four Ethernet frame types: Ethernet_802.3 Known as Ethernet 802.3 raw, this frame type is used in NetWare networks and was the default type in NetWare v2.x and v3.x Ethernet_II Known as Ethernet DIX (Developed by Digital Intel Xerox) Ethernet_802.2 IEEE Ethernet Ethernet_SNAP SNAP (Sub-Network Access Protocol) derived from the Ethernet 802.2 structure

Known as Ethernet 802.3 raw, this frame type is used in NetWare networks and was the default type in NetWare v2.x and v3.x Because of the nature of these frames they are unlikely to carry NBF frames, unless encapsulated in IPX. Preamble 7 octetsStart frame deliminator 1 octetDestination Address 6 octetsSource Address 6 octetsLength 2 octetsData 46-1500 octetsFrame Check sequence 4 octets

NBF frames are found in Ethernet_802.2 frames more than in other Ethernet frames when NBF is implemented "on the wire" rather than encapsulated. Ethernet_802.2 frames are also used with IPX/SPX and FTAM (File Transfer Access and Management) protocol. Ethernet frame 802.2 Frame detail NBF frame Preamble 7 octets Start frame deliminator 1 octet Destination Address 6 octets Source Address 6 octets Length 2 octets IEEE 802.2 Logical Link Control DSAP 2 octets SSAP 2 octets Control 1 or 2 octets Data 46-1500 octets NetBIOS header Optional data Frame Check sequence 4 octets

Ethernet_SNAP frames are used by IPX/SPX, TCP/IP and AppleTalk Phase II. Preamble 7 octetsStart frame deliminator 1 octetDestination Address 6 octetsSource Address 6 octetsLength 2 octetsDSAP 2 octets value AASSAP 2 octets value AAControl 1 octetsOrganizational code 3 octetsEthernet Type 2 octetsData 46-1500 octetsFrame Check sequence 4 octets

Ethernet_II frames are used with IPX/SPX TCP/IP AppleTalk Phase I Following the source address, is an Ethernet frame type. Information on Ethernet frame types can be found at: http://www.iana.org/assignments/ethernet-numbers and at: http://www.cavebear.com/CaveBear/Ethernet/type.html For SNA (Systems Network Architecture) communications the value registered for the type is 0x80D5. This value of 0x80D5 is also used for other systems using the IEEE 802.2 API including NetBIOS Preamble 8 octetsDestination Address 6 octetsSource Address 6 octetsEthernet Type 2 octetsData 46-1500 octetsFrame Check sequence 4 octets

Many manuals and documents describe Ethernet in detail including Novell's Guide to NetWare LAN Analysis, see