ports in samba

Christopher R. Hertel crh at ubiqx.mn.org
Thu Feb 27 19:54:03 GMT 2003

On Thu, Feb 27, 2003 at 12:47:59AM -0800, D Jemms wrote:
> > Port 445 is
> > Microsoft's direct SMB
> > over TCP (no NetBIOS in the middle) the preferred
> > method for
> > Windows 2000 and XP - should be a cleaner way to
> > work with, but I do not
> > know it well yet...
> According to http://support.microsoft.com/?kbid=204279
> if I disable NetBios over TCP/IP on windows2000,
> ideally it whould use port 445 and all SMBs should
> come directly over TCP.
> But in traces I can see TCP, NBT  and then SMB, for
> all the SMBs ???What is wrong here ? can it be
> possible to see TCP,SMB in traces without NBT in
> between ? If yes,What is the procedure?
> Help on this will be highly appreciated.

You need to read http://ubiqx.org/cifs/

There is a four byte header between the TCP header and the SMB message.
The four byte header is used with both SMB over NBT and SMB over naked
TCP.  It is needed so that the length of the SMB message can be 
discovered.  Ethereal will call this the NBT header even if you are 
capturing port 445 (naked TCP transport).

Chris -)-----

Samba Team -- http://www.samba.org/     -)-----   Christopher R. Hertel
jCIFS Team -- http://jcifs.samba.org/   -)-----   ubiqx development, uninq.
ubiqx Team -- http://www.ubiqx.org/     -)-----   crh at ubiqx.mn.org
OnLineBook -- http://ubiqx.org/cifs/    -)-----   crh at ubiqx.org

More information about the samba-technical mailing list