Encapsulation in TCP/IP

NetBIOS is often described as a "Session Layer" protocol and a variety of transport systems have been used in different implementations. Particularly because NetBIOS is a non-routable protocol, it has often been implemented using other routable protocols to provide the transport.

It has traditionally been the NetBIOS API that has been the "standard". In most implementations (certainly NetBIOS over TCP/IP and NetBIOS over IPX), encapsulation has been implemented to ensure that higher level protocols (such as SMB) can run over the encapsulated protocol in the same way as they would run over NetBIOS Frames Protocol, NBF (otherwise known as NetBEUI or NetBIOS). Thus it is important to understand the NetBIOS Frames Protocol, NBF in order to understand the various encapsulation implementations.

RFC1001 and RFC1002

The suite of protocols known as "TCP/IP" is perhaps the best know protocol suite. Currently most systems use IP version 4; the next generation of IP, IPv6 has not yet widely replaced IP version 4. These protocols are well documented in "Request for Comments" (RFCs) and there are many books available on the subject.

NetBIOS can be carried over TCP/IP (v4) networks. The relevant RFCs describing NetBIOS on a TCP and UDP foundation are:

RFC 1001

Protocol standard for a NetBIOS service on a TCP/UDP transport: concepts and methods

RFC 1002

Protocol standard for a NetBIOS service on a TCP/UDP transport: detailed specifications

The protocol standards described in the above RFCs are designed to preserve existing NetBIOS services, utilize existing standards and minimize new developments. The standards proposed also aimed to be robust and efficient while not necessarily requiring central management or many additional facilities to run.

Within this system NetBIOS names are aligned with the Domain Name Service (DNS). A "NetBIOS Scope" is defined as a population of computers through out which a NetBIOS name is known. Because many non-intersecting NetBIOS Scopes may exist on an internetwork, each NetBIOS scope has a "scope identifier"; this is a string that is in a DNS compatible format. This can be thought of as a pseudo sub-domain containing all the NetBIOS names in a given Scope.

NetBIOS names are strings of 16 bytes with few restrictions; NetBIOS names can and often do contain characters that are illegal in DNS names such as spaces, underscores and other non-alphanumeric characters. DNS names may only contain alphanumeric characters, hyphens and stops. An encoding scheme is used to represent the 16 byte NetBIOS names as a 32 character string to which a stop and then the scope identifier is appended to form a DNS name. Each name needs to be registered for use with an IP address.

There are two servers defined which may be implemented with NetBIOS on a TCP/UDP transport: The NetBIOS Name Server (NBNS) and the NetBIOS Datagram Distribution Server (NBDD).

The NBNS can be configured to work in a variety of ways either acting simply as a bulletin board where systems can register names, or completely managing names and addresses. Several NBNS system can be configured to work together to provide a distributed service.

Since multicasting and broadcasting are not widely implemented on internets, the NBDD service provides this function. Datagrams to be sent to individual nodes or broadcast, can be sent to the NBDD which will forward the datagram to the target node or nodes.

Systems implementing NetBIOS on a TCP/UDP transport, other than NBNS and NBDS servers, are known as "End-Nodes". Two distinct types of "End-Node" are defined: Broadcast nodes ("B" nodes) and Point-to-point nodes ("P" nodes). Broadcast nodes ("B" nodes) communicate using a combination of UDP datagrams and TCP connections. "B" nodes can function within a broadcast area which is a single MAC-bridged LAN. Point-to-point nodes communicate exclusively by directed UDP datagrams and TCP sessions. "P" nodes depend upon NBNS servers to register their name to IP address mappings and discover the names of other End-Nodes.

Two further kinds of End-Node are used with NetBIOS on a TCP/UDP transport: RFC 1001 defines Mixed mode nodes ("M" nodes) as "P" nodes with "B" node characteristics. "M" nodes use NBNS and NBDD servers, but may continue to function if these servers are temporarily unavailable. An "M" node typically performs functions as a "B" node and then as a "P" node if necessary. Hybrid nodes ("H" nodes) are not defined in RFC 1001 and have not been standardized; these are mixed nodes similar to "M" nodes but function broadly in the opposite manner to "M" nodes. "H" nodes function as a "P" node first and then as a "B" node.

NetBIOS on a TCP/UDP transport provides the standard NetBIOS services: Adapter Status Transactions, NetBIOS Session Service and NetBIOS Datagram Service.

Details of packet formats are given in RFC 1002.

The following UDP and TCP port numbers are used with NetBIOS on a TCP/UDP transport:

Table 1. UDP and TCP port numbers are used with NetBIOS

Service UDP Port TCP Port
Name Service 137 137
Session Service   139
Datagram Service 138  

There are several implementations of NetBIOS on a TCP/UDP transport. A free implementation is "SAMBA" which is available for various Unix platforms and non-Unix platforms. Further information about "SAMBA" can be obtained from the "SAMBA" Web page:


The product can be obtained from the above web site, which is also a useful source of information.