NBT SessionAlive and TCP/IP Session Termination (115499)

SUMMARY

On Windows NT build 528, if TCP/IP protocol is the transport used, then NetBIOS over TCP/IP (NBT) KeepAlive frames maintain an idle session by default. The session is terminated if the other end does not respond to these frames. This article describes NBT session termination.

NOTE: This information applies only to NetBIOS over TCP/IP on Windows NT build 528. To determine which build of Windows NT you have installed:

In the Program Manager window, choose Run from the File menu.
In the Command Line field, type "winver" (without the quotation marks), and then choose the OK button. The Windows Version dialog box appears with the version number and build number of Windows NT.

MORE INFORMATION

The default value for NbtKeepAlive is 60 seconds (KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NBT\Parameters). This means that if there is no activity for 60 seconds, NBT generates a SessionAlive frame to probe the connection. It is the function of TCP/IP to attempt to deliver these SessionAlive frames. The number of attempts made by TCP/IP to deliver the frame is governed by "TcpMaxRetransmissionAttempts" which has a default of (KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP\Parameters).

The Retransmission (RETX) timer depends on the Smooth Round Trip Time (SRTT); it is a dynamic timer and varies between any two stations; it also cannot be set or tuned in any way.

The current RETX timer (whatever it is at that moment) is used for the first RETX attempt (of the seven). The RETX timer (t) is increased for subsequent retransmissions based on the formula: t=2t. Therefore, if the initial RETX value is 1 sec, then subsequent RETX timers would expire at 2, 4, 8, 16, 32, 64, 128 intervals.

In the above example, assuming there is no response, TCP/IP would report failure to the above layer after 255 seconds (1+2+4...+128, including the time until the seventh attempt expires), then the redirector would clear the session.

One point to note is that NBT would submit NEW SessionAlive Frames at 60 second intervals, which TCP/IP does not attempt to retransmit. In the above example, four new SessionAlive frames may be submitted by NBT in this 255 second period.

If there is a need to clear the session quicker, reducing MaxRetransmissionAttempts even by one to a value of 6 would make it dramatically quicker (two minutes less, as per the example above). Reducing NbtKeepAlive from a value of 60 seconds to a lesser value will also contribute to clearing the session quicker.

The following is a network trace illustrating the above:

#  DeltaT  Src MAC   Dst MAC   Ntprotocol  Description
--------------------------------------------------------------------

2  0.225   MOHAK01   Mohaksta  TCP   ACK seq:0x20131
3  59.850  Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4BF
4  0.936   Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4BF
5  1.975   Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4BF
6  3.957   Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4BF
7  7.941   Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4BF
8  15.883  Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4BF
9  29.613  Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4C3
10 2.082   Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4BF
11 58.217  Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4C7
12 5.171   Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4BF
13 55.150  Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4CB
14 60.291  Mohaksta  MOHAK01   NBT   Session Keep Alive seq:0x3EE4CF

In the above trace, frame 2 is the last frame from MOHAK01. NBT initiates Session Alive Frames starting at #3. Frames 9,11,13,14 are "New" Session Alive Frames submitted by NBT which are not retransmitted by TCPIP.