126.96.36.199 SMB (NCACN_NP)
This protocol sequence specifies RPC directly over SMB. There are no intermediate protocols between RPC and SMB.
When these extensions are enabled over the SMB transport protocol, the network address used by the client MUST be an IPv4 or IPv6 address or a server name.<3>The server name MUST be a Unicode string that represents either a NetBIOS host name (see [MS-NBTE] section 2.2.1) or a fully qualified domain name (see [RFC1035] section 3.1 and [RFC2181] section 11).
The tower encoding for RPC over SMB MUST be the same as what is specified in [C706] Appendix L, for ncacn_ip_tcp. The port address MUST be the endpoint encoded into a NULL-terminated string in ASCII character format. The length of the string MUST be less than 0xFFFF bytes. For changes in how these extensions interpret the tower encoding (as specified in [C706] Appendix L), see section 188.8.131.52.3.
When an application is creating a binding handle for RPC over named pipes, the application will provide a server name, endpoint, and credentials. The server name, endpoint, and credentials are provided to SMB ([MS-CIFS] section 184.108.40.206) to uniquely identify the named pipe (SMB session) which the RPC binding handle will use.
All PDUs sent over SMB MUST be sent as named pipe writes ([MS-CIFS] section 220.127.116.11), and PDUs to be received MUST be received as named pipe reads, as specified in [MS-CIFS] section 18.104.22.168. However, in the case of synchronous RPCs, an implementation of these extensions MAY require the Server Message Block (SMB) Protocol implementation to execute a transaction encompassing the write of the last request PDU and the read of the first response PDU on the client. The last request PDU MUST be a bind, an alter_context, or the last fragment of a request. The first response PDU MUST be a bind_ack or bind_nak, an alter_context_response, or the first fragment of a response. The transaction over a write and read is as specified in [MS-CIFS].<5>