SMB Over IP Without NetBIOS in Windows 2000

With the release of Microsoft Windows 2000, Microsoft introduced "direct hosted" Server Message Block (SMB), enabling network file and print sharing directly over TCP/IP without the NetBIOS abstraction layer. This transition reduced protocol overhead, eliminated broadcast-heavy NetBIOS naming dependencies, and simplified network routing. The core protocol changes responsible for this capability include the introduction of dedicated TCP port 445, the simplification of the session packet framing header, and the reliance on standard Domain Name System (DNS) for host resolution.

The Shift from NetBIOS over TCP/IP to Direct Hosting

Prior to Windows 2000, SMB required NetBIOS over TCP/IP (NBT) as an intermediary transport layer. NBT relied on three specific ports defined in RFC 1001 and RFC 1002:

  • UDP Port 137: NetBIOS Name Service (NBNS / WINS)
  • UDP Port 138: NetBIOS Datagram Service
  • TCP Port 139: NetBIOS Session Service

Windows 2000 eliminated the requirement for this middle layer by defining a direct TCP transport for SMB. By running directly on raw TCP/IP, the operating system bypasses the NetBIOS API and transport layer entirely, establishing a standard, stream-oriented TCP connection between client and server.

Implementation of TCP Port 445

The primary architectural change that allows SMB to operate without NetBIOS is the assignment and implementation of TCP port 445 (and UDP port 445, though connection-oriented SMB primarily uses TCP).

When a Windows 2000 client connects to a file share without NetBIOS, it sends a TCP SYN packet directly to destination port 445. Because port 445 listens specifically for raw SMB data, there is no need to negotiate a NetBIOS session prior to initiating SMB dialect negotiation.

Streamlined Session Packet Framing

Under traditional NBT on port 139, the NetBIOS Session Service wraps SMB traffic in a specific session packet format that includes session request, positive session response, keep-alive, and session message types.

In direct-hosted SMB over port 445, this session layer is replaced by a lightweight framing mechanism:

  • A simplified 4-byte header is prepended to the standard SMB message.
  • The first byte is reserved and set to 0x00.
  • The following three bytes (24 bits) encode the length of the SMB packet in big-endian format.

This allows the TCP stream receiver to delimit SMB messages without the overhead and state management associated with NetBIOS session negotiations.

Replacement of NetBIOS Naming with DNS

NetBIOS relied on a flat 16-character naming system resolved via local subnet broadcasts, LMHOSTS files, or WINS servers. SMB over IP eliminates this dependency by integrating completely with standard hierarchical DNS.

When establishing an SMB session over port 445, Windows 2000 resolves target server names using standard DNS forward lookups (A records) or Fully Qualified Domain Names (FQDNs). This removes the need for NetBIOS Name Service (port 137) queries and allows SMB traffic to route seamlessly across subnets and firewalls without NetBIOS helper services.

Dual-Stack Connection Negotiation

To preserve backward compatibility with legacy Windows NT 4.0, Windows 98, and Windows 95 systems, Windows 2000 implemented a dual-stack connection mechanism:

  1. When a client attempts to connect to an SMB server using a NetBIOS name, it transmits TCP SYN packets simultaneously to port 139 and port 445.
  2. If the destination server responds on port 445 first, the client immediately resets (RST) the port 139 connection and proceeds with direct-hosted SMB.
  3. If the server only responds on port 139 (or responds on port 139 first), the client establishes the connection via NBT.
  4. If the target is specified via an IP address or FQDN, Windows 2000 bypasses port 139 entirely and connects directly via port 445.