NetBIOS protocol explanation and working principle of network neighbors

Netbois (basic network input/output system) was initially developed by IBM and sytek as an API to enable user software to use LAN resources. Since its birth, netbois has become one of many other network applications. Program . Strictly speaking, NetBIOS is the interface standard for accessing network services.
NetBIOS was originally designed as the network controller for the ibm lan and is a software layer that uses specific hardware to connect to the network operating system. NetBIOS is extended and allows the program to use the NetBIOS interface to operate the IBM licensing ring structure. NetBIOS has been recognized as an industrial standard. Generally, refer to NetBIOS-compatible LANs.
It provides a set of methods for network programs to communicate with each other and transmit data. Basically, NetBIOS allows programs and network sessions. It aims to separate the program from any type of hardware property. It also frees software developers from the following responsibilities: network error fixing, low-layer information addressing, and routing. Using the NetBIOS interface, you can do a lot of work for software developers.

NetBIOS standardizes interfaces between program and LAN operation capabilities. With them, you can refine the program to which layer of the OSI model is written, so that the program can be transplanted to other networks. In the NetBIOS LAN environment, the computer name is known by the system. Each computer in the network has a permanent name compiled using different methods. These names will be further discussed below.

By using NetBIOS datagram or broadcast, a PC on the NetBIOS LAN establishes a session to communicate with each other. Sessions allow more information to be transmitted, detected, and corrected. Communication is based on one-to-one communication. The datagram or broadcast mode allows one computer to communicate with multiple other computers at the same time, but the information size is limited. No errors are detected or corrected using the datagram or broadcast method. However, you do not need to establish a session for datagram communication.

In this environment, all communication is submitted to NetBIOS in a format called "Network Control Block. The allocation of these blocks in the memory depends on the user program. These "network control blocks" are allocated to the domain and reserved for input and output respectively.

In today's environments, NetBIOS is a common protocol. Ethernet, licensing ring, and ibm pc network support NetBIOS. In its original version, it serves only as an interface for programs and network adapters. Since then, the transfer function has been added to NetBIOS, increasing its functionality.

In NETBIOS, connection-oriented (TCP) and non-connection (UDP) communication are supported. It supports broadcast and replay, and supports three separate services: naming, session, and datagram.

[1.0.2] NetBIOS Name

The NetBIOS name is used to identify resources on the network. The program starts and ends the session with these names. You can use multiple programs to configure a separate machine. Each program has a unique NetBIOS name. Each pc supporting applications also has a user-defined or internal NetBIOS site name.

NetBIOS can contain up to 16 alpha letters. In the entire resource routing network, the combination of letters must be unique. Before a PC using NetBIOS can fully work on the network, the PC must first register the NetBIOS name.

Take a closer look at the following. Start a machine ~~ What is he doing ??

When Client A is active, client a broadcasts its name. When it successfully broadcasts itself, and no one else has the same name as it, the client registers successfully. The registration process is as follows:

1. on login, client a broadcasts its own and its NetBIOS information 6 to 10 times in all places (depending on this method, which the who wants to come up ....), Make sure that other network members receive the message. (If a machine does not receive the message, the client a in the network neighbor of the machine will be invisible)

2. If another client B uses this name, another client B releases its own broadcast, including the name it is using. Client A requesting login to stop all registration attempts.

3. If no other client is opposed to registration, client a requesting login completes the registration process. If a name server is available, the name server will be recorded in its database. The name of a server is a, and the IP address is XXX.

4. When host a is shut down normally, broadcast again to release the name just registered. After receiving the name, the computer on the same network segment will put it in the network neighbor and the sesame oil. (Rely on, fainted and shut down normally ..... Abnormal? Don't worry.) If there is a WINS server on the Internet, the name will be canceled after the client shuts down abnormally for a certain period of time. If the sesame oil WINS service is used, you can run it on the icon in the network neighbor ~~, Be careful. At this time, the query name must be broadcast ~~, If you have dozens of machines on the internet, broadcast N Articles, and wait for a response.

Is the problem solved? You need to know that broadcast packets are prone to problems, especially in networks with a large number of machines. This is one of the reasons why Network peers often cannot find people, and broadcast packets cannot pass through the routing, therefore, machines of different subnets are invisible in the network neighbors. (If a WINS server exists and the node type is not B, it will be a little better. It will not be broadcast. For details, refer to relevant information about the WINS node type)

In fact, even if some machines do not receive a registration request, that is, they cannot be seen in the network neighbors. As long as a is not exactly the same as B, it would be better if there is a WINS service, it doesn't matter if you have the same name with him. wins will update the record or refuse a to register the name. When you try to communicate with host a Based on NETBIOS, such as passing only files, you will first query the NetBIOS Name and start communication if you find it.

There are two types of names in the NetBIOS environment: unique and set. The unique name must be unique in the network. The Set Name does not have to be unique in the network. All processes with the same name belong to the same set. Each NetBIOS node contains a table with the current name of the node.

NetBIOS names can contain 16 letters. Microsoft only allows 15 letters to be used in the NetBIOS name, and the third letter is the NetBIOS suffix. The NetBIOS suffix is used in Microsoft networking software to differentiate the features of installation and the registered devices and services.

[Note: SMB and NBT (NetBIOS on TCP/IP) work closely together and both use port 137,138,139. Port 137 is the NetBIOS name UDP, port 138 is the NetBIOS datagram UDP, and port 139 is the NetBIOS session TCP] Hey hey, I have never heard of this port number for security knowledge, if you want to connect your network to the nearest neighbor, you still need to consider security ~~

The following table lists the NetBIOS suffixes currently used by Microsoft WindowsNT. The suffix is hexadecimal.

Name, numeric type, usage
========================================================== ======================================
=
00 U Workstation Service
01 U Messenger Service
<\\_ Msbrowse _> 01g master browser
03 U Messenger Service
06 u ras server service
1f u netdde Service
20 u File Server Service
21 U Ras Client Service
22 U exchange Interchange
23 U exchange store
24 U Exchange Directory
30 U Modem Sharing Server Service
31 U Modem Sharing client service
43 u sms client remote control
44 u sms admin remote control tool
45 u sms client remote chat
46 u sms client remote Transfer
4c U dec pathworks TCPIP Service
52 U dec pathworks TCPIP Service
87 U exchange MTA
6a U Exchange IMC
Be U network monitor agent
Bf u network monitor apps
03 U Messenger Service
00g Domain Name
1B U domain master browser
1c g Domain Controllers
1D U master browser
1e g Browser Service elections
1c g Internet Information Server
00 U Internet Information Server
[2B] U Lotus Notes server
Irismulticast [2f] G Lotus Notes
Irisnameserver [33] G Lotus Notes
Forte _ $ nd800za [20] u dca irmalan gateway service

Unique (u): Only one IP address is assigned to it. In a network device, a name may be registered multiple times, but the suffix is unique to make the name unique.

Set (G): A common set. A name can have multiple IP addresses.

Multi-access (m): The name is unique, but because there are multiple network interfaces on the same computer, this configuration should be allowed to be registered. The maximum number of addresses is 25.

Internet set (I): This is a special configuration of the group name. It is used to operate the Domain Name of the snt.

Domain Name (d): Newly introduced in NT4.0.

To quickly view the NetBIOS Name and service registered on a server, run the following command:
Nbstat-A [IPaddress]
Nbstat-A [host]

[1.0.3] NetBIOS session

NetBIOS Session Service provides a connection-oriented, reliable, and completely dual information service for user programs. NetBIOS requires a client program and a server program. The establishment of NetBIOS Sessions requires the cooperation between the two parties. A program must issue the listen command before other programs can issue the call command. For the listen command, refer to the name in its NetBIOS name table (or on a Windows Server) and the name used as the remote program at the other end of the session. If the listener is not listening, the call command will not succeed. If the call succeeds, each program receives the session ID as the confirmation for session creation.

Send and receive commands to transmit data. At the end of the session, each program will execute the pending command. There is no actual traffic control for the session service, because it is assumed that the LAN is fast enough to transmit the required data.

[1.0.4] NetBIOS Datagram

A datagram can be sent to a specific location, all members in the group, or broadcast to the entire LAN. Compared with other data services, NetBIOS datagram is connectionless and unreliable. The send_datasync Command requires the caller to set the target name. If the target name is a group name, each member in the group receives data. The caller of the receive_datvecommand must determine the local place name of the data it receives. In addition to actual data, receive_datasync also returns the sender name. If NetBIOS receives data but does not run the receive_datvecommand while waiting, the data will be discarded.

The send_broadcast_datagram Command sends information to each NetBIOS system on the local network. When the betbios node receives the broadcast data, each process that publishes the receive_broadcast_datagram command receives the data. If these commands are not running when the broadcast data is received, the data will be discarded.

NetBIOS enables the application to establish a session with another device, so that the network forwarder and processing protocol can process requests received and sent to another machine. NetBIOS does not actually operate on data. NetBIOS defines the network interfaces used to reach the protocols of these services, rather than the Protocols themselves. Historically, NetBIOS was bundled with a protocol called netbeui (network extension user interface. The combination of interfaces and protocols sometimes causes confusion, but they are different.

Network protocols provide at least one way to locate and connect to specific services on the network. This is usually done by converting the node and service name into a network address (name resolution. Before establishing a connection with TCP/IP, the NetBIOS service name must be resolved to an IP address. Most NetBIOS TCP
/IP implementation. Use the broadcast or LmHosts file to resolve the name and address. In a Microsoft environment, you are most likely to use netbios named wins
Name Server.

[1.0.5] netbeui explanation

Netbeui is an enhanced version of the NetBIOS protocol used by the network operating system. It standardizes unstandardized transmission frames in NetBIOS and adds additional features. Transport-layer drivers are often used by Microsoft LAN managers. Netbeui executes the OSI llc2 protocol. Netbeui is the original PC network protocol and IBM interface designed for the lanmanger (LAN operator) server. This agreement will be adopted by Microsoft later as a standard for their network products. It specifies that the high-level software sends and receives information through the NetBIOS frame protocol.
Method. This protocol runs on the standard 802.2 data link protocol layer.

[1.0.6] NetBIOS range

The NetBIOS range ID provides additional naming services for NetBIOS built on the TCP/IP (called NBT) module. The main purpose of NetBIOS range ID is to isolate NetBIOS communication on a single network from those nodes with the same NetBIOS range ID. The NetBIOS range ID is a string appended to the NetBIOS name. The NetBIOS range IDs on the two hosts must match. Otherwise, the two hosts cannot communicate with each other. NetBIOS range ID allows computers to use the same computer name and different range IDs. The range ID is part of the NetBIOS name and is unique.

NetBIOS is a non-routing service. To implement the host name service for different network segments, you need to set wins for resolution.