NetBIOS


NetBIOS is an acronym for Network Basic Input/Output System. It provides services related to the session layer of the OSI model allowing applications on separate computers to communicate over a local area network. As strictly an API, NetBIOS is not a networking protocol. Operating systems of the 1980s ran NetBIOS over IEEE 802.2 and IPX/SPX using the NetBIOS Frames and NetBIOS over IPX/SPX protocols, respectively. In modern networks, NetBIOS normally runs over TCP/IP via the NetBIOS over TCP/IP protocol. NetBIOS is also used for identifying system names in TCP/IP.
The NetBIOS Frames protocol is most commonly used as one of the layers of Microsoft Windows networking in the 1990s. NBF or NetBIOS over IEEE 802.2 LLC is used by a number of network operating systems released in the 1990s, such as LAN Manager, LAN Server, Windows for Workgroups, Windows 95 and Windows NT. Other protocols, such as NBT, and NBX also implement the NetBIOS/NetBEUI services over other protocol suites.

History and terminology

NetBIOS is an operating system-level API that allows applications on computers to communicate with one another over a local area network. The API was created in 1983 by Sytek Inc. for software communication over IBM PC Network LAN technology. On IBM PC Network, as an API alone, NetBIOS relied on proprietary Sytek networking protocols for communication over the wire.
In 1985, IBM went forward with the Token Ring network scheme and produced an emulator of Sytek's NetBIOS API to allow NetBIOS-aware applications from the PC-Network era to work over IBM's new Token Ring hardware. This IBM emulator, named NetBIOS Extended User Interface, expanded the base NetBIOS API created by Sytek with, among other things, the ability to deal with the greater node capacity of Token Ring. A new networking protocol, NetBIOS Frames, was simultaneously produced by IBM to allow the NetBEUI API to provide its services over Token Ring – specifically, at the IEEE 802.2 Logical Link Control layer; it uses 802.2 type 1 mode to provide the NetBIOS/NetBEUI name service and datagram service, and 802.2 type 2 mode to provide the NetBIOS/NetBEUI session service.
In 1985, Microsoft created its own implementation of the NetBIOS API for its MS-Net networking technology. As in the case of IBM's Token Ring, the services of Microsoft's NetBIOS implementation were provided over the IEEE 802.2 Logical Link Control layer by the NBF protocol. However, the MS-Net was only delivered to OEMs, and it was actually not a complete product, nor was it ready to communicate on the network in the form it was distributed. It lacked any implementation of OSI Layers 1 to 4 and an OEM was expected to provide these implementations to make its version of MS-Net a complete and ready to use product. MS-Net accessed the network through the Microsoft's own variant of NetBIOS, which was split into two parts - the lower level part that OEMs had to provide implemented the NetBIOS calls that depended on layers 1-4, while the higher level part, provided by Microsoft, was hardware- and protocol-independent. This NetBIOS implementation supported the full NetBIOS API, but was called by invoking x86 interrupt 0x2A, instead of IBM's standard interrupt 0x5C. The reliance on OEMs to implement parts of NetBIOS had the unfortunate side effect that different OEM versions of MS-Net and NetBIOS generally weren't able to communicate with one another.
In 1986, Novell released Advanced Novell NetWare 2.0 featuring the company's own emulation of the NetBIOS API. Its services were encapsulated within NetWare's IPX/SPX protocol using the NetBIOS over IPX/SPX protocol.
In 1987, a method of providing NetBIOS services atop TCP and UDP packets, NetBIOS over TCP/IP, was published. It was described in RFC 1001 and RFC 1002. The NBT protocol was developed in order to "allow an implementation to be built on virtually any type of system where the TCP/IP protocol suite is available," and to "allow NetBIOS interoperation in the Internet."
After the PS/2 computer hit the market in 1987, IBM released the PC LAN Support Program, which included a driver offering the NetBIOS API. The NBF protocol was officially supported by Microsoft on almost every version of Windows up to Windows 2000, but its use has decreased quickly since the development of NBT. Microsoft officially dropped support starting with Windows XP, but it is included on the Windows XP CD-ROM and can be installed manually. Windows Vista does not include NetBEUI support at all, but the Windows XP NetBEUI support drivers can be used.
There is some confusion between the names NetBIOS and NetBEUI. NetBEUI originated strictly as the moniker for IBM's enhanced 1985 NetBIOS emulator for Token Ring. The name NetBEUI should have died there, considering that at the time, the NetBIOS implementations by other companies were known simply as NetBIOS regardless of whether they incorporated the API extensions found in Token Ring's emulator. For MS-Net, however, Microsoft elected to name its implementation of the NBF protocol "NetBEUI" – naming its implementation of the transport protocol after IBM's enhanced version of the API. Consequently Microsoft file and printer sharing over Ethernet often continues to be called NetBEUI, with the name NetBIOS commonly used only in reference to file and printer sharing over TCP/IP. More accurately, the former is NetBIOS Frames, and the latter is NetBIOS over TCP/IP.
Because NBF protocol is unroutable it can only be used to communicate with devices in the same broadcast domain, but being bridgeable it can also be used to communicate with network segments connected to each other via bridges. The lack of support for routable networks means that NBF is only well-suited for small to medium-sized networks, where it has such an advantage over TCP/IP that requires little configuration. The NetBIOS/NetBEUI services must be implemented atop other protocols, such as IPX and TCP/IP in order to be of use in an internetwork.
Since its original publication in a technical reference book from IBM, the NetBIOS API specification has become a de facto standard in the industry despite originally supporting a maximum of only 80 PCs in a LAN. This limitation was generally overcome industry-wide through the transition from NBF to NBT, under which, for example, Microsoft was able to switch to Domain Name System for resolution of NetBIOS hostnames, having formerly used the LAN segment-compartmentalized NBF protocol itself to resolve such names in Windows client-server networks.

Services

NetBIOS provides three distinct services:
In order to start sessions or distribute datagrams, an application must register its NetBIOS name using the name service. NetBIOS names are 16 octets in length and vary based on the particular implementation. Frequently, the 16th octet, called the NetBIOS Suffix, designates the type of resource, and can be used to tell other applications what type of services the system offers. In NBT, the name service operates on UDP port 137.
The name service primitives offered by NetBIOS are:
  • Add name – registers a NetBIOS name.
  • Add group name – registers a NetBIOS "group" name.
  • Delete name – un-registers a NetBIOS name or group name.
  • Find name – looks up a NetBIOS name on the network.
Internet Protocol Version 6 are not supported by the NetBIOS name resolution protocol.

Datagram distribution service

Datagram mode is connectionless; the application is responsible for error detection and recovery. In NBT, the datagram service runs on UDP port 138.
The datagram service primitives offered by NetBIOS are:
  • Send Datagram – send a datagram to a remote NetBIOS name.
  • Send Broadcast Datagram – send a datagram to all NetBIOS names on the network.
  • Receive Datagram – wait for a packet to arrive from a Send Datagram operation.
  • Receive Broadcast Datagram – wait for a packet to arrive from a Send Broadcast Datagram operation.

    Session service

Session mode lets two computers establish a connection, allows messages to span multiple packets, and provides error detection and recovery. In NBT, the session service runs on TCP port 139.
The session service primitives offered by NetBIOS are:
  • Call – opens a session to a remote NetBIOS name.
  • Listen – listen for attempts to open a session to a NetBIOS name.
  • Hang Up – close a session.
  • Send – sends a packet to the computer on the other end of a session.
  • Send No Ack – like Send, but doesn't require an acknowledgment.
  • Receive – wait for a packet to arrive from a Send on the other end of a session.
In the original protocol used to implement NetBIOS services on PC-Network, to establish a session, the initiating computer sends an Open request which is answered by an Open acknowledgment. The computer that started the session will then send a Session Request packet which will prompt either a Session Accept or Session Reject packet.
During an established session, each transmitted packet is answered by either a positive-acknowledgment or negative-acknowledgment response. A NAK will prompt retransmission of the data. Sessions are closed by the non-initiating computer by sending a close request. The computer that started the session will reply with a close response which prompts the final session closed packet.

NetBIOS name vs Internet host name

When NetBIOS is run in conjunction with Internet protocols, each computer may have multiple names: one or more NetBIOS name service names and one or more Internet host names.

NetBIOS name

The NetBIOS name is 16 ASCII characters, however Microsoft limits the host name to 15 characters and reserves the 16th character as a NetBIOS Suffix. This suffix describes the service or name record type such as host record, master browser record, or domain controller record or other services. The host name is specified when Windows networking is installed/configured, the suffixes registered are determined by the individual services supplied by the host. In order to connect to a computer running TCP/IP via its NetBIOS name, the name must be resolved to a network address. Today this is usually an IP address. A computer's NetBIOS name is often the same as that computer's host name, although truncated to 15 characters, but it may also be completely different.
NetBIOS names are a sequence of alphanumeric characters. The following characters are explicitly not permitted: \/:*?"<>|. Since Windows 2000, NetBIOS names also had to comply with restrictions on DNS names: they cannot consist entirely of digits, and the hyphen or full-stop characters may not appear as the first or last character. Since Windows 2000, Microsoft has advised against including any full-stop characters in NetBIOS names, such that applications can use the presence of a full-stop to distinguish domain names from NetBIOS names.
The Windows LMHOSTS file provides a NetBIOS name resolution method that can be used for small networks that do not use a WINS server.