2.1 Transport

The SMB 2 Protocol supports Direct TCP, NetBIOS over TCP [RFC1001] [RFC1002], SMB2 Remote Direct Memory Access (RDMA) Transport [MS-SMBD], and QUIC as transports.<2> These transports are supported by the various SMB2 dialects as follows:

  • All dialects of SMB2 support operation over Direct TCP. The Direct TCP transport packet header has the following structure.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Zero

StreamProtocolLength

SMB2Message (variable)

...

Zero (1 byte): The first byte of the Direct TCP transport packet header MUST be zero (0x00).

StreamProtocolLength (3 bytes): The length, in bytes, of the SMB2Message in network byte order. This field does not include the 4-byte Direct TCP transport packet header; rather, it is only the length of the enclosed SMB2Message.

SMB2Message (variable): The body of the SMB2 packet. The length of an SMB2Message varies based on the SMB2 command represented by the message.

  • SMB2 dialects 2.0.2, 2.1, 3.0, and 3.0.2 allow NetBIOS over TCP [RFC1001] [RFC1002].

  • SMB2 dialects 3.0, 3.0.2, and 3.1.1 allow operation over SMB2 RDMA Transport [MS-SMBD].

  • SMB2 dialect 3.1.1 allows operation over QUIC transport.

The server assigns an implementation-specific name to each transport, as specified in [MS-SRVS] section 2.2.4.96.

The SMB2 Protocol can be negotiated as the result of a multi-protocol exchange as specified in section 3.2.4.2.1. When the SMB2 Protocol is negotiated on the connection, there is no inheritance of the base SMB Protocol state. The SMB2 Protocol takes over the transport connection that is initially used for negotiation, and thereafter, all protocol flow on that connection MUST be SMB2 Protocol.