There is a suite or family of protocols which includes the NetBIOS Frames Protocol, NBF, (often referred to as NetBEUI or sometimes as NetBIOS), the Server Message Block protocol, SMB, and Common Internet File System, CIFS. These protocols are associated with the original NetBIOS implementation with which they have a historical link.

Many systems use SMB including Microsoft's Windows for Workgroups, Windows 95 / 98 / ME, LAN Manager, Windows NT, Windows 2000 and IBM's OS/2 and LAN Server, NetWare 6 and the SAMBA implementation. SAMBA is freely available for a wide range of systems and further information can be found at the SAMBA web site.

This document begins by describing NetBIOS (Network Basic Input / Output System) also known as NetBEUI (NetBIOS Extended User Interface) or NBF (NetBIOS Frames protocol) in terms of an original suite of protocols which includes the Name Management Protocol (NMP), Diagnostic and Monitoring Protocol (DMP), User Datagram Protocol (UDP) and the Session Management Protocol (SMP) that were used in the original implementation.

Following a brief description of supporting technologies such as Ethernet and Token Ring, encapsulation of these protocols is considered as well as using these protocols to encapsulate other protocols.

There is no formal standard that defines the protocol(s) used with NetBIOS; in practice the IBM LAN Technical Reference IEEE 802.2 and NetBIOS Application Program Interface is used as a reference (see Bibliography).

There are many implementations of NetBIOS networking and these implementations are generally incompatible. It is because of the diversity and lack of a formal standard that makes understanding NetBIOS networking difficult.

It is not clear whether there is only one protocol or several protocols involved in NetBIOS networking. The original implementation for the PC Network certainly seemed to have the above-mentioned protocols (NMP, DMP, UDP and SMP) however the distinction is less clear with NetBIOS on Token-Ring and other implementations. Given that at least network layer and session layer functions are involved, the various packets used will be discussed in terms of the original protocols for convenience, even if the distinctions are somewhat arbitrary.

Following descriptions of the lower level protocols and encapsulation, important higher level protocols (such as SMB, CIFS and the browser service) that run over these lower protocols are described. The situation with respect to the higher level protocols is also complicated; the protocols (SMB and CIFS) were developed as proprietary protocols and information has been difficult to obtain. Although information has been released from time to time, it is not always easy to obtain information on the latest version. Currently Microsoft continues to develop CIFS for it's range of operating systems. Teams of developers such as the SAMBA group reverse engineer the technology. This documentation presents information that is publicly available.


The NetBIOS interface was developed for International Business Machines Corporation (IBM) in 1983 by Sytec Inc. (which became Hughes LAN Systems, then Whittaker Communications). This operated over proprietary Sytec protocols on IBM's PC Network which is a broadband local area network. The broadband PC Network is a bus-attached LAN, which can accommodate up to 72 connecting devices. The baseband PC Network is also a bus-attached LAN which can accommodate up to 80 connecting devices; It is important to note the scale of LAN which NetBIOS was designed for. NetBIOS was not designed for large networks.

When IBM announced the Token-Ring, an emulator for NetBIOS was produced allowing applications developed for the PC Network to operate on Token-Ring. The NetBIOS Extended User Interface (NetBEUI) was introduced in 1985. The Token-Ring network can accommodate up to 260 devices on one ring and multiple rings can be connected by Bridges.

In 1986 Novell released Advanced NetWare version 2.0. With version 2.0 and all subsequent packages a NetBIOS interface has been included; Novell implemented NetBIOS encapsulated in IPX/SPX. Later Microsoft reverse- engineered the technology to provide encapsulation of NetBIOS in IPX/SPX that is compatible with the Novell implementation.

With the Personal System /2 computer (PS/2) in 1987, IBM announced the PC LAN Support Program which included a NetBIOS driver.

In March 1987, RFC 1001 was published which described a "Protocol Standard for a NetBIOS Service on a TCP/UDP Transport".

Prior to the IBM Lan Support Program, versions of NetBIOS were named with version numbers 1.X. With the LAN Support Program the following NetBIOS versions were used:

Table 1. LAN Support Program versions compared with NetBIOS versions

LAN Support Program version NetBIOS version
1.00 2.0
1.01 2.1
1.02 2.2

Version 2.x of NetBIOS has been superseded by NetBIOS version 3.0 and version 4.0.

In 1987 Microsoft announced the LAN Manager which runs natively over NetBIOS frames.

Microsoft and Intel introduced the SMB Core Protocol in 1988 (SMB-CORE.PS). SMB has been developed during subsequent years and is widely used be many systems. The protocol began life as a proprietary protocol and documentation was very difficult to find. A Version of the protocol (version 2) was published by the Open Group X/Open 1992. However since that time subsequent versions have been developed by Microsoft which re-named the protocol "Common Internet File System" (CIFS).

The history of SMB and CIFS is further discussed in: the section called History in the chapter called Server Message Block Protocol