SMB frame header

Each SMB frame begins with a standard header. Following a deliminator of "0xFF", there are three bytes "0x53", "0x4d" and "0x42" corresponding to the values "S", "M", "B" which makes identifying SMB frames easier. The three ID bytes are followed by a command byte which is discussed in the section called SMB Command Codes

Table 7. SMB frames (Octets in order transmitted.)

Field Name Length SMB
Deliminator 1 0xFF
ID 3 0x53 "S"
0x4d "M"
0x42 "B"
Command 1 0xNN
Error class 1 0xNN
Reserved 1 reserved
Error code 2 0xNN
0xNN
Flags 1 0xNN
Flags 2 / Reserved 2 0xNN
0xNN
Reserved? 12? 12 0xNN
0xNN
0xNN
0xNN
0xNN
0xNN
0xNN
0xNN
0xNN
0xNN
0xNN
0xNN
authenticated resource identifier / Tree ID 2 0xNN
0xNN
caller's Process ID 2 0xNN
0xNN
unathenticated User ID 2 0xNN
0xNN
Multiplex ID 2 0xNN
0xNN
count of 16-bit fields Word count 1 0xNN
variable no of 16-bit fields byte count 2 0xNN
0xNN
count of 8-bit fields that follow 2 0xNN
0xNN
variable number of 8-bit fields 2 0xNN
0xNN

SMB is very analogous to the NetWare Core Protocol (NCF); there are numerous functions available for accomplishing various tasks. There are very many SMB frames for different functions and all share the same header format; the second field, "command", determines the function and possibly the format of the rest of the frame following the header.