Is pipelining a feature of the SMB/CIFS protocol? I found that SMB2 does have a pipelining mecanism but no clear answer is available for the previous version. I have a network capture with several SMB Transaction Secondary messages on top of several NetBIOS session service messages, is that common on a network?
Yes, SMBv1/CIFS has special "AndX" commands, which can chain to another command in the same packet – although only a few specific commands can be part of the chain. (There are 8 "AndX" commands in total – OPEN_ANDX, READ_ANDX, WRITE_ANDX, and a few others).
Batched messages using the AndX construct were introduced in the LAN Manager 1.0 dialect. Batched messages reduce the number of messages required to complete a series of commands by sending multiple command requests or responses in a single message. SMB commands that apply the AndX construct are known as "AndX Commands", and are identified by the NT LAN Manager convention of appending "_ANDX" to the command name. Messages of this type are known as AndX Messages.
AndX Messages contain a construct, conceptually similar to a linked-list, that is used to connect the batched block pairs. The resulting list is referred to as an AndX Chain.
Each AndX Command has a specific list of commands that can follow it in an AndX Chain. Each command's list of permitted follow-on commands is documented in the command's corresponding subsection of section 2.2.4, SMB Commands.
Quoted from the official Microsoft protocol documentation: