Figure 6.6 The NetBEUI frame format
The default protocol for the Microsoft Windows operating systems today is TCP/IP, but the early versions of Windows NT and Windows for Workgroups relied on another protocol called the NetBIOS Extended User Interface, or NetBEUI. NetBEUI support is still included in all of the Windows operating systems, and certain elements of it are an integral part of Windows networking, whether you use the NetBEUI protocol or not.
NetBEUI differs substantially from IP and IPX. The primary difference is that NetBEUI does not route packets between networks. This means that the protocol is not suitable for use on large internetworks.
NetBEUI was adopted by Microsoft for use with Windows at a time when the company was first adding networking capabilities to the operating system. Like NetWare, the initial market was for small LANs, and it is in this environment that NetBEUI excels. For a small standalone network, NetBEUI provides excellent performance, is self-adjusting, and is self-configuring. There's no need to supply the client with an address and other configuration parameters, as with TCP/IP. NetBEUI, however, does not support Internet communications. This requires TCP/IP; if you will be connecting your network to a shared Internet connection, you must run TCP/IP.
The Network Basic Input/Output System (NetBIOS) is a programming interface that applications use to communicate with the networking hardware in the computer and, through that, with the network. NetBIOS includes its own name space, which NetBEUI uses to identify computers on the network, just as IP uses its own IP addresses and IPX uses hardware addresses. The computer name that you assign to a system during the Windows installation is in reality a NetBIOS name, which must be unique on the network.
A NetBIOS name is 16 characters long. Windows reserves the sixteenth character for a code that identifies the type of resource using the name, leaving 15 user-assigned alphanumeric characters. Different codes can identify NetBIOS names as representing computers, domain controllers, users, groups, and other resources. If you assign a name of fewer than 15 characters to a computer, the system pads it out to 15, so that the identification code always falls on the sixteenth character.
NetBIOS names are stored in a flat file database; there is no hierarchy among the names. IP and IPX both use a hierarchical system of addressing in which one value identifies the computer, and another value identifies the network on which the computer is located. NetBIOS names have no network identifier, which is why NetBEUI is not routable; it has no means of addressing packets to specific networks or maintaining routing tables containing information about networks. NetBEUI deals solely with computer identifiers, which means that all of the computers must be accessible from the one network.
The NetBEUI Frame (NBF) protocol is a multipurpose protocol that Windows-based systems use for a variety of purposes, including the registration and resolution of NetBIOS names, the establishment of sessions between computers on the network, and the transport of file and print data using Windows' Server Message Blocks (SMB) protocol. All of these functions use a single frame format, as diagrammed in Figure 6.6.
The following are the functions of the frame fields.
The value in the Command field dictates the type of message contained in the packet, using the following values:
There are four separate protocols that make use of the NBF frame: the Name Management Protocol (NMP), the Session Management Protocol (SMP), the User Datagram Protocol (UDP), and the Diagnostic and Monitoring Protocol (DMP).
Name Management Protocol (NMP) is the protocol that systems use to register and resolve NetBIOS names on the network. When a system first starts up, it generates an Add Name Query message containing its NetBIOS name and transmits it to the other NetBIOS systems on the network. The function of this message is to ensure that no other system is using that same name. If there is a duplication, the system already using the name must reply with an Add Name Response message, and the querying system displays an error message. If the system receives no response, the name is considered to be registered to that system.
Name resolution is the process of converting a NetBIOS name into the hardware address needed for a system to transmit data-link layer frames to it. When a NetBEUI system has data to transmit to a particular system or wants to establish a session with another system, it begins by generating a Name Query message containing the name of the target system in the Destination Name field and sending it to all of the NetBIOS systems on the network. All of the systems on the network with registered NetBIOS names are required to respond to Name Query messages containing their name. The system with the requested name responds by transmitting a Name Recognized message back to the sender as a unicast message. The sender, on receiving this message, extracts the hardware address of the system holding the requested name and can then transmit subsequent packets to it as unicasts.
One of the drawbacks of NetBEUI, and one of the reasons why it is only suitable for relatively small networks, is the large number of broadcast packets it generates. These Name Query requests are actually transmitted to a special NetBIOS address, but on a Windows-based network, this is the functional equivalent of a broadcast. On a large network or one with high traffic levels, systems must process a large number of these name resolution broadcasts for no reason, because they are intended for other systems.
The NBF messages used by NMP use NetBEUI's connectionless service. These messages are part of brief request and response transactions that don't require additional services like packet acknowledgement. For more extensive data transfers, however, a connection-oriented, reliable service is required, and to do this, the two communicating systems must first create a session between them. The systems use NBF's Session Management Protocol (SMP) messages to establish a session, transmit data, and then break down the session afterward.
The session establishment process begins with a standard name resolution exchange, followed by the establishment of a session at the Logical Link Control (LLC) layer. Then the client system initiating the session transmits a Session Initialize to the server system, which responds with a Session Confirm message. At this point, the session is established, and the systems can begin to transmit application data using Data First Middle and Data Only Last messages. These messages may contain data generated by other protocols, such as SMBs. The system receiving the data replies with Receive Continue or Data Ack messages that serve as acknowledgments of successful transmissions.
During the session, when no activity is taking place, the systems transmit periodic Session Alive messages, which prevent the session from timing out. When the exchange of data packets is completed, the client generates a Session End message, which terminates the session.
To exchange small amounts of data, systems can also use the same connectionless service as NMP. This is sometimes referred to as the User Datagram Protocol (UDP), but it is important not to confuse this protocol with the TCP/IP transport layer protocol of the same name. The UDP is the simplest of the NBF protocols, consisting only of two message types, the Datagram message and the Datagram Broadcast message. Systems can transmit various kinds of information using these messages, including SMB data.
NetBEUI systems use the Diagnostic and Monitoring Protocol (DMP) to gather status information about systems on the network. A NetBEUI system generates a Status Query message and transmits it to all of the NetBIOS systems on the network. The systems reply with Status Response messages containing the requested information.
For each of the NBF message types listed below, specify which of the four NBF protocols—NMP, SMP, UDP, or DMP— is primarily associated with it.