Window networking / NetBIOS / SMB / CIFS
Windows networking is a set of protocols and services that allow Windows machines to communicate to provide facilities such as file and printer sharing and work group and domain browsing.
This section contains a brief overview of how Windows Networking works.
The next section Configuring Windows networking for KFSensor describes how to configure Windows to enable KFSensor to emulate Windows networking.
The following section KFSensor Windows networking emulation describes how KFSensor emulates Windows networking and how to configure it and interpret the events it generates.
Windows Networking is extremely complex and confusing to understand given its long history of development.
Back in the old days of DOS machines could communicate with each other using a protocol called NetBIOS.
This ancient protocol is inferior in almost every aspect to the IP protocol. Pure NetBIOS is hardly ever used a
anymore on modern networks.
Microsoft introduced another protocol called Common Internet File System (CIFS) which enables the core functionality of Windows Networking; file and printer sharing and domain. The core of CIFS is a protocol called the Server Message Block (SMB). The SMB sits on top of NBT as its transport layer. SMB can be implemented on other protocols other than NBT, as described later on. The long term intention of Microsoft is to abandon NBT.
While NBT is essentially a Windows protocol, there exists a module for Linux called Samba that allows Linux to provides services to Windows clients.
With all these abbreviations it can get very confusing. KFSensor just uses NBT to refer to its components that deal with Windows networking, even though strictly speaking some of these components, have nothing to do with NBT.
NetBIOS names are used to identify machines and workgroups and form the key building blocks of the NBT system.
NetBIOS names are usually encoded into a special 32 character format which makes them un-readable unless they are decoded.
There are four separate services that are used to implement Windows networking.
The description given here is only very brief introduction and does not begin to describe the NBT or SMB protocols.
There are many articles and web sites that explain there issues in much greater detail. The following may be of interest: