0

Is pipelining a feature of the SMB/CIFS protocol? I found that SMB2 does have a pipelining mecanism but no clear answer is available for the previous version. I have a network capture with several SMB Transaction Secondary messages on top of several NetBIOS session service messages, is that common on a network?

  • What is your definition of pipeline in this context? That would probably depend on the network and what you do on it. – Seth Apr 25 '17 at 12:14
  • 1
    pipelining, that is, sending additional requests before the response to a previous request arrives – Jeff Bencteux Apr 25 '17 at 13:15
2

Yes, SMBv1/CIFS has special "AndX" commands, which can chain to another command in the same packet – although only a few specific commands can be part of the chain. (There are 8 "AndX" commands in total – OPEN_ANDX, READ_ANDX, WRITE_ANDX, and a few others).

Batched messages using the AndX construct were introduced in the LAN Manager 1.0 dialect. Batched messages reduce the number of messages required to complete a series of commands by sending multiple command requests or responses in a single message. SMB commands that apply the AndX construct are known as "AndX Commands", and are identified by the NT LAN Manager convention of appending "_ANDX" to the command name. Messages of this type are known as AndX Messages.

AndX Messages contain a construct, conceptually similar to a linked-list, that is used to connect the batched block pairs. The resulting list is referred to as an AndX Chain.

Each AndX Command has a specific list of commands that can follow it in an AndX Chain. Each command's list of permitted follow-on commands is documented in the command's corresponding subsection of section 2.2.4, SMB Commands.

Quoted from the official Microsoft protocol documentation:

  • Thanks, very useful. I think my capture is not following MS documentation because several TRANSACTION_SECONDARY requests on top of each other does not seem to be allowed. Any idea how this happened? Could this be crafted by a malware or can a normal SMB implementation do that? – Jeff Bencteux Apr 26 '17 at 8:18

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.