NetBIOS Session Service (NBSS)
The NetBIOS Session Service is part of the NetBIOS-over-TCP protocol suite, see the ["NetBIOS"] page for further information.
XXX - add a brief description of NBSS history
- ["TCP"]: NBSS uses ["TCP"] as its transport protocol. The well known TCP port for NBSS traffic is 139.
XXX - Add example traffic here (as plain text or Wireshark screenshot).
The NBSS dissector is fully functional.
(XXX add links to preference settings affecting how NBSS is dissected).
Example capture file
XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Wireshark can open gzipped files automatically.
A complete list of NBSS display filter fields can be found in the [http://www.wireshark.org/docs/dfref/n/nbss.html display filter reference]
Show only the NBSS based traffic:
You cannot directly filter NBSS while capturing. However, as it runs atop ["TCP"] port 139, you can filter on that one.
Capture NBSS traffic:
tcp port 139
[http://www.ietf.org/rfc/rfc1001.txt RFC1001] Protocol Standard For a NetBIOS Service on a TCP/UDP Transport: Concepts and Methods
[http://www.ietf.org/rfc/rfc1002.txt RFC1002] Protocol Standard For a NetBIOS Service on a TCP/UDP Transport: Detailed Specifications