On Fri, Apr 02, 1999 at 04:25:09PM -0800, Guy Harris wrote:
> > I see already that some of the NetBIOS directed datagrams that are already
> > (partially) decoded contain SMBs (\255SMB). In addition, SMBs can be
> > carried over NetBEUI (which is 802.3/LLC with a NSAP of F0, I think), IPX,
> > and TCP.
>
> There's also a NetBIOS layer between, at least, the latter two cases and
> SMB - the NetBIOS Session Service for TCP, and some sort of
> NetBIOS-over-IPX layer for IPX. There's not (yet) a decoder for NBSS,
> but there's "packet-nbipx.c" for NetBIOS-over-IPX.
Yes. I've talked to the maintainer of one of the NetBIOS FAQs, and he is unaware
of any published standard for NetBIOS over IPX. It appears to be a proprietary
protocol "layer". In packet-nbipx.c, I have tried to make a distinction between
the way non-NT NetWare clients use NB over IPX, and the way NT NetWare clients
use NB IPX (which I called "nwlink", in reference to the name of the driver in
NT). I made the distinction because in my rudimentary examination of the two
types of communications, there seemed to be a difference. Perhaps there isnt',
though.
Whether there is a difference or not, NB over IPX still needs to be fleshed
out some more. But because there is not published standard, it will have to
be guessed at. And you can always take a look at what other packet analyzers
say about your traces.
I also have *lots* of MBs of SMB over NB over IPX packet traces,
if you need any.
--gilbert
