What are SMB's?

Server Message Blocks are a type of "messaging protocol" that LAN Manager (and NT) clients and servers use to communicate with each other. SMB's are a higher level protocol that can be transported over NetBEUI, NetBIOS over IPX, and NetBIOS over TCP/IP (or NBT).

SMBs are used by Windows 3.X, Win95, WintNT and OS/2. When it comes to security and the compromise of security on an NT network, the one thing to remember about SMBs is that it allows for remote access to shared directories, the registry, and other system services, making it a deadly protocol in the eyes of security conscience people.

The SMB protocol was originally developed by IBM, and then jointly developed by Microsoft and IBM. Network requests that are sent using SMB's are encoded as Network Control Blocks (NCB) data structures. The NCB data structures are encoded in SMB format for transmission across the network. SMB is used in many Microsoft and IBM networking software:

  • MS-Net
  • IBM PC Network
  • IBM LAN Server
  • MS LAN Manager
  • LAN Manager for Unix
  • DEC Pathworks
  • MS Windows for Workgroups
  • Ungermann-Bass Net/1
  • NT Networks through support for LAN Manager

SMB Messages can be categorized into four types:

Session Control: Used to establish or discontinue Redirector connections with a remote network resource such as a directory or printer. (The redirector is explained below)

File: Used to access and manipulate file system resources on the remote computer.

Printer: Used by the Redirector to send print data to a remote printer or queue, and to obtain the status of remote print devices.

Message: Used by applications and system components to send unicast or broadcast messages.


The Redirector
The Redirector is the component that enables a client computer to gain access to resources on another computer as if the remote resources were local to the client computer. The Redirector communicates with other computers using the protocol stack.

The Redirectors primary function is to format remote requests so that they can be understood by a remote station (such as a file server) and send them on their way through the network.

The Redirector uses the Server Message Block (SMB) structure as the standard vehicle for sending these requests. The SMB is also the vehicle by which stations return responses to Redirector requests.

Each SMB contains a header consisting of the command code (which specifies the task that the redirector wants the remote station to perform) and several environment and parameter fields (which specify how the command should be carried out).

In addition to the header, the last field in the SMB may contain up to 64K of data to be sent to the remote station.