How Windows XP Processed SMB Share Paths

Windows XP handled Server Message Block (SMB) share paths over local area networks by utilizing the SMB 1.0 (CIFS) protocol, translating Universal Naming Convention (UNC) paths into network requests through the Multiple UNC Provider, resolving hostnames via NetBIOS or DNS, establishing connections over TCP port 445 or port 139, and executing multi-step dialect negotiation, authentication, and tree-connection sequences to access remote resources.

Path Interception and the Multiple UNC Provider

When an application or user requested access to a network resource using a UNC path (e.g., \\ServerName\Share\Folder\File.txt), the Windows XP I/O Manager passed the request to the Multiple UNC Provider (MUP.sys). Operating as a kernel-mode driver, MUP determined which network redirector was responsible for the path. For standard Windows file sharing, MUP handed the request to the SMB redirector subsystem, primarily composed of rdbss.sys (Redirected Drive Buffering Subsystem) and mrxsmb.sys (SMB mini-redirector).

Name Resolution

Before sending SMB traffic, Windows XP resolved the target hostname (ServerName). The operating system utilized two primary mechanisms depending on the network configuration:

  • DNS Resolution: If the machine belonged to an Active Directory domain or standard DNS infrastructure was available, Windows XP attempted standard DNS lookup.
  • NetBIOS over TCP/IP (NBT): For legacy or peer-to-peer workgroup environments, resolution fell back to NetBIOS mechanisms, querying WINS servers, checking local LMHOSTS files, or broadcasting UDP packets over port 137.

Transport Layer Connection (Port 445 vs. Port 139)

Windows XP introduced streamlined transport capabilities compared to earlier Windows versions. When initiating an SMB session, it simultaneously attempted connections across two transports:

  1. Direct Hosted SMB: A direct TCP connection over port 445, bypassing the NetBIOS layer entirely.
  2. NetBIOS over TCP/IP: A TCP connection over port 139 following a NetBIOS session request.

The redirector sent TCP SYN packets to both ports concurrently. Whichever connection completed the three-way handshake first was selected for the SMB session, while the slower connection was terminated via a TCP RST. On modern LANs, port 445 was almost always preferred.

Protocol Negotiation and Authentication

Once the transport connection was established, Windows XP executed the SMB 1.0 protocol handshake:

  1. Negotiate Protocol (SMB_COM_NEGOTIATE): The client sent a list of supported SMB dialects. Windows XP typically negotiated the NT LM 0.12 dialect with compatible servers.
  2. Session Setup (SMB_COM_SESSION_SETUP_ANDX): The client transmitted user credentials to authenticate the session. Depending on the environment, Windows XP used NTLMv1, NTLMv2, or Kerberos (if connected to an Active Directory domain). If authentication succeeded, the server assigned a User ID (UID) to the session.

Tree Connection and Path Processing

After obtaining a valid UID, the redirector isolated the share component from the UNC path:

  1. Tree Connect (SMB_COM_TREE_CONNECT_ANDX): The client sent a request containing the share path (e.g., \\ServerName\Share). The server verified share permissions and returned a Tree ID (TID), which represented an open connection to that specific share.
  2. File and Directory Access (SMB_COM_NT_CREATE_ANDX): To access individual files or subdirectories within the path (\Folder\File.txt), the client issued NT_CREATE_ANDX commands relative to the established TID. Windows XP parsed standard Windows path delimiters (backslashes) and evaluated relative offsets within the remote file system.

Data Transfer and Caching

File operations were subsequently executed using SMB_COM_READ_ANDX and SMB_COM_WRITE_ANDX commands. Windows XP employed Opportunistic Locks (OpLocks) to optimize LAN performance, allowing the client to cache read and write operations locally until another client requested access to the same file, at which point the server instructed the client to break the OpLock and flush changes over the wire.