NetBIOS Session Management Protocol

NetBIOS Session Frames - Name Query - on 802.2 networks

In the NetBIOS Frames Protocol on 802.2 networks there are two frames used for managing names in session establishment. Details of these frames are given in the section called Name Management Protocol "Name Management Frames in NetBIOS on 802.2 networks"

NetBIOS Session Frames - Establishment and Termination - on 802.2 networks

• The "SESSION ALIVE" frame (0x1F) is send as the result of an inactivity timer expiring.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x1F identifying it as an "SESSION ALIVE" frame.

  All the remaining 39 octets are reserved.

• The "SESSION CONFIRM" frame (0x17) is used to request remote adapter status information.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. these fields are followed by the one octet command frame which has a value of 0x17 identifying it as an "SESSION CONFIRM" frame.

  The "DATA1" octet is an 8 bit binary string; the first bit "y" is set to 0 for versions of NetBIOS prior to version 2.20 and to 1 for higher versions. After 6 bits always set to 0, the last bit "x" is set to 0 for NetBIOS version 1.xx and set to 1 for version 2.00 or above (In practice this will now always be set to 1). The two bytes of the "DATA2" field are used to indicate the length of the user's receive buffer. The "DATA2" field is transmitted byte reversed.

  Two octets used for a transmission correlator are followed by a two octet response correlator; these fields are transmitted byte reversed. A single octet is used for the remote session number and is followed by an octet for the local session number.

• The "SESSION END" frame (0x18) is used to request remote adapter status information.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x18 identifying it as an "SESSION END" frame.

  The "DATA1" octet is reserved. The two bytes of the "DATA2" field are used to indicate the reason for termination. 0x00 indicates a normal session end, 0x01 indicates an abnormal end. The "DATA2" field is transmitted byte reversed. Four reserved octets are followed by a single octet used for the remote session number. The final octet is for the local session number.

• The "SESSION INITIALIZE" frame (0x19) is used to request remote adapter status information.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x19 identifying it as an "SESSION INITIALIZE" frame.

  The "DATA1" octet is an 8 bit binary string; the first bit "z" is set to 0 for versions of NetBIOS prior to version 2.20 and to 1 for higher versions (In practice this will now always be set to 1). Three reserved bits "rrr", always set to 0 are followed by 3 bits "xxx" used to indicate the largest frame value as seen by the MAC layer; the last bit "z" is set to 0 for NetBIOS version 1.xx and set to 1 for version 2.00 or above. The two octets of the "DATA2" field are used to indicate the length of the user's receive buffer. The "DATA2" field is transmitted byte reversed. A single octet is used for the remote session number and is followed by an octet for the local session number.

NetBIOS Session Frames - Data Transfer - on 802.2 networks

• The "DATA ACK" frame (0x14) is sent in response to a DATA ONLY LAST frame (see below).

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x14 identifying it as an "DATA ACK" frame.

  Three reserved octets are followed by a two octet transmit correlator then a two octet receive correlator; these fields are transmitted byte reversed. A single octet is used for the remote session number and is followed by an octet for the local session number.

• The "DATA FIRST MIDDLE" frame (0x15) is used to transmit user messages across a session.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x15 identifying it as an "DATA FIRST MIDDLE" frame.

  The "DATA1" octet is an 8 bit binary string; the first four bits are reserved; the fifth bit "x" is set to 1 if an acknowledgment is included; this is followed by a reserved bit; the seventh bit "y" is set to 0 for versions of NetBIOS prior to version 2.20 and set to 1 for later versions (In practice this will now always be set to 1); the last bit "z" is set to 0 if a RECEIVE CONTINUE was not requested, otherwise it is set to 1. The next two octets are for DATA2 and is a re-synchronization indicator set to 0001 if it is the first DATA FIRST MIDDLE frame. The "DATA2" field is transmitted byte reversed.

  This is followed by a transmit correlator then a two octet receive correlator. A single octet is used for the remote session number and is followed by an octet for the local session number. Finally the user data follows.

• The "DATA ONLY LAST" frame (0x16) is used to transmit user messages across a session and is either the only frame or the last.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x16 identifying it as an "DATA ONLY LAST" frame.

  The "DATA1" octet is an 8 bit binary string; the first four bits are reserved; the fifth bit "x" is set to 1 if an acknowledgment is included; this is followed by the sixth "y" bit which indicates that an "acknowledge with data allowed" is permitted; the seventh bit "z" is a "no.ack" indicator and the final bit is reserved. The next two octets are for DATA2 and is a re-synchronization indicator set to 0001 if this frame is send following receipt of a RECEIVE OUTSTANDING. The "DATA2" field is transmitted byte reversed. This is followed by a transmit correlator then a two octet receive correlator; these fields are transmitted byte reversed. A single octet is used for the remote session number and is followed by an octet for the local session number. Finally the user data follows.

• The "NO RECEIVE" frame (0x1A) is transmitted in response to a "DATA ONLY LAST" frame or a "DATA FIRST MIDDLE" frame.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x1A identifying it as an "NO RECEIVE" frame.

  The "DATA1" octet is an 8 bit binary string; the first six bits are reserved; the seventh bit "x" is set to 0 for versions of NetBIOS prior to 2.20, otherwise it is set to 1 (In practice this will now always be set to 1); the eighth bit is reserved. The next two bytes are for DATA2 and gives the number of data bytes accepted. The "DATA2" field is transmitted byte reversed. Four reserved octets are followed by a single octet used for the remote session number; this is followed by an octet for the local session number.

• The "RECEIVE OUTSTANDING" frame (0x1B) is transmitted in response to a "NO RECEIVE" frame.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x1C identifying it as an "RECEIVE OUTSTANDING" frame.

  The "DATA1" octet is reserved. The next two octets are for DATA2 and gives the number of data bytes accepted. The "DATA2" field is transmitted byte reversed. Four reserved octets are followed by a single octet used for the remote session number; this is followed by an octet for the local session number.

• The "RECEIVE CONTINUE" frame (0x1C) is transmitted in response to a "DATA ONLY LAST" frame which had the RECEIVE CONTINUE bit set.

  The frame begins with a two byte length field with a value of 0x002C followed by the two byte frame deliminator field 0xEFFF; these fields are transmitted byte reversed. These fields are followed by the one octet command frame which has a value of 0x1C identifying it as an "RECEIVE CONTINUE" frame.

  Three reserved octets are followed by a two octet transmit correlator, transmitted byte reversed, which is followed by two more reserved octets. A single octet is used for the remote session number and is followed by an octet for the local session number.