Comparison of Windows NT Network Protocols

The following article on Windows NT protocols is a copy of an articlepublished in Microsoft's "Premier Showing" newsletter.

Comparison of Windows NT Network Protocols
 

Microsoft provides three transport drivers (i.e., protocols) with WindowsNT 3.5: TCP/IP, NWLink, and NBF. Windows NT 3.5 also ships with the DLCprotocol, which does not provide transport layer services. In this articlethe terms TCP/IP, NWLink and NBF refer to the Windows NT transport driversthat implement the Internet TCP/IP, Novell SPX/IPX and IBM NetBEUI networkprotocol suites, respectively. This article compares these protocols asimplemented in the Windows NT 3.5 transport drivers, to assist users inselecting the appropriate protocol(s) for their network.

Since each customer will be concerned with a different set of protocolcharacteristics, this article does not recommend which protocol customersshould use. Instead, it discusses the merits of each, thereby enablingcustomers to make the best choice for their environment. Microsoft willcontinue to support these three protocols, today and in the long term.

Windows NT installs NWLink by default, primarily because IPX is the mostcommon protocol in PC networks and it has relatively simple configurationrequirements. However, administrators can modify setup.inf files toinstall other protocols by default. This default setting does not implypreference of NWLink over TCP/IP or NBF.

NOTE: In the Windows NT 3.51 release, TCP/IP is now installed by default.

Customers should generally use the minimum protocols necessary, becausemultiple protocols usually result in the following:
 

• Higher memory requirement for clients.
• More complex client configuration and network administration.
• Higher support and software license costs.

The Network Basic Input/Output System (NetBIOS) standard, which wasoriginally developed for IBM by Sytek in 1983 defines two entities:
 

• A Session Layer interface that is a standard API for user applications to submit network I/O and control directives to underlying network protocol software. NetBIOS commands are submitted via Network Control Blocks (NCBs).
• A session management/data transport protocol called NetBIOS Frames Protocol (NBFP). NBFP functions at the Session and Transport Layers to perform the network I/O to accommodate the NetBIOS interface command set.

An application program that uses the NetBIOS interface API for networkcommunication can operate on any transport driver that exposes the NetBIOSinterface. Transport drivers that do not implement NBFP (e.g., TCP/IP andIPX) must expose the NetBIOS interface and have a means of mapping eachNetBIOS interface command to some sequence of their own native networkframes and protocols.

Unlike the 16 bit Windows, MS DOS and OS/2 versions of Microsoft Networksoftware, Windows NT transport drivers do not expose the NetBIOS interface;instead, they expose the more flexible Transport Driver Interface (TDI).Windows NT includes a NetBIOS Emulator to map NetBIOS commands to TDIcommands and events. Internal Windows NT network components use TDIcommands and events, rather than NetBIOS commands, to communicate withunderlying transport drivers.

The TDI clients require support for NetBIOS address format and message modedata transfer. NBF supports this natively through NBFP. Transports thatdo not include NBFP implement a NetBIOS compatibility layer to resolveNetBIOS format addresses to the transport's native address format, and toimplement message mode data transfer over the transport's native datatransfer protocol.

Windows NT transport drivers provide the services defined in several layersof the OSI Reference Model: Some Session Layer services; all Transport andNetwork Layer services; and the services of the LLC sub layer of the DataLink Layer. This constitutes all services between the TDI and the NetworkDriver Interface Specification 3.0 (NDIS) interface. All Windows NTtransport drivers except DLC export the TDI interface at their upper edgefor communication with TDI client applications, such as the Windows NTredirector and server. They export the NDIS interface at the lower edgefor communication with the underlying network interface card (NIC) driver.

NBF (NetBEUI)

IBM first introduced the NetBIOS Extended User Interface (NetBEUI) protocolspecification in 1985. It is optimized for departmental LANs or LANsegments. The Windows NT NetBEUI Frame (NBF) transport driver implementsthe IBM NetBEUI 3.0 specification, and is completely compatible with theNetBEUI shipped with past Microsoft networking products. NBF implementsNBFP, and therefore requires no NetBIOS compatibility layer.

TCP/IP

Windows NT includes an implementation of the Transmission ControlProtocol/Internet Protocol (TCP/IP). In general usage, the term TCP/IPrefers to a suite of protocols that includes TCP, UDP, IP, ICMP, and ARP.Since TCP/IP is available for many diverse operating systems such as UNIX,MVS, VM, VMS, NetWare and OS/2, Windows NT can use TCP/IP to communicatewith these different operating systems. TCP/IP also provides compatibilitywith the global Internet. TCP/IP is Microsoft's strategic protocol forscaleable Windows-based networking. The Windows NT TCP/IP transport driverincludes TCP, UDP, IP, ICMP, ARP and NBT. Microsoft completely redesignedthe TCP/IP transport driver in Windows NT 3.5, providing many enhancementsover the Streams based TCP/IP transport driver in Windows NT 3.1. TheNetBIOS compatibility layer for TCP/IP is NetBIOS over TCP/IP (NetBT inWindows NT 3.5; NBT in Windows NT 3.1).

NWLink (IPX)

Novell NetWare currently has the largest market share among PC basednetwork operating systems. NetWare's native Network Layer protocol is IPX,a Novell proprietary descendant of the Xerox XNS protocol. Microsoftimplements the lower level NetWare protocols in the NWLink transportdriver, which includes IPX, SPX, RIPX and NBIPX. The NetBIOS compatibilitylayer for NWLink is NetBIOS over IPX, also known as NBIPX (NwLnkNb inWindows NT 3.5; NWNBLink in Windows NT 3.1).

This section compares the Windows NT transport drivers in each of thefollowing areas:
 

• Industry acceptance and experience
• Open or proprietary specifications
• Interoperability
• Simplicity of configuration and administration
• Network segmentation
• Routing capabilities
• Name registration and resolution requirements
• Network traffic
• Network status reporting
• Memory requirements
• Performance
• Application programming support

As mentioned previously, the customer's computing environment willdetermine which protocol characteristics are desired, and which are mostimportant. The applicability and importance of the foregoingcharacteristics will be dependent upon factors such as the following:
 

• Size of the network
• Single or multiple locations
• Homogeneous or heterogeneous nodes
• Internet connectivity requirements
• Application programming requirements
• Size and expertise of support staff

Industry Acceptance and Experience

The more popular protocols have a larger based of experienced support anddesign engineers. In late 1994 Sage Research, Inc. performed a study ofrouter based LAN backbones with at least 250 nodes in Fortune 500companies. Their study concluded that TCP/IP is used on 95% of all suchnetworks, while SPX/IPX is used on 87%.
 

• NetBEUI usage is limited primarily to Microsoft and IBM PC network environments.
• TCP/IP is widely accepted, established and understood, especially in UNIX and non PC networks. It is the protocol of the global Internet.
• SPX/IPX is the most popular protocol in PC network environments.

Open or Proprietary Specifications

Open protocol specifications enable programmers to obtain all theinformation necessary to develop their own protocol drivers without payinglicense fees.
 

• NetBEUI is a proprietary specification owned by IBM. However, IBM makes this specification available to developers.
• TCP/IP is an open specification. Anyone can easily obtain RFCs for implementing the TCP/IP protocols. Anyone can also submit RFCs to the Internet Engineering Task Force (IETF) for consideration.
• SPX/IPX is a proprietary specification owned by Novell, which can make it difficult to obtain specifications for the upper layers like NCP. However, Novell has made the new SPX II specification available.

Interoperability

The availability of a protocol on a variety of operating systems andhardware platforms provides the advantage of interoperability. Windows NTprovides native support for NetBEUI, TCP/IP and SPX/IPX through the NBF,TCP/IP and NWLink transport drivers.
 

• NetBEUI is limited almost exclusively to Microsoft and IBM PC networks: Microsoft LAN Manager, Windows NT, Windows for Workgroups; LAN Manager for UNIX; and IBM PCLAN and LAN Server environments.
• TCP/IP is available on a wide variety of operating systems such as Windows NT, UNIX, NetWare, VMS, VM, MVS, MS DOS, Macintosh, and OS/2. It is the protocol of the global Internet. NetWare/IP will enable NetWare customers to run TCP/IP-only networks, accessing NetWare services without requiring SPX/IPX. However, NetWare/IP is not native IP for NetWare; it emulates the IPX stack to NCP, which still requires an underlying IPX (or emulated IPX) layer. In comparison, Windows NT provides true protocol independent networking, running SMBs over its transport drivers without emulation requirements.
• IPX is the native protocol of Novell NetWare. However, SPX/IPX is also available on other operating systems: Microsoft provides NWLink for Windows NT; TGV provides IPX for DEC VMS; Novell offers IPX on UnixWare.

Simplicity of Configuration and Administration

Administrators of any size network desire simplicity of clientconfiguration and network administration. Large sites have many clients toconfigure, while small sites may not have sufficient support personnel.All three protocols are self tuning in their Windows NT 3.5 implementation.However, Microsoft exposes certain tuning parameters for manualconfiguration in special situations.
 

• NBF requires little or no initial configuration or network administration.
• TCP/IP is potentially difficult to configure due to the relative complexity of its multi part naming scheme, and the fact that a default gateway (router) must be identified for each station. To reduce the client configuration burden, Windows NT 3.5 supports the Dynamic Host Configuration Protocol (DHCP), an open standard that transparently provides dynamic negotiation of client configuration. DHCP clients require no manual IP configuration, and administrators do not have to manually assign IP addresses. However, DHCP does require proper planning and administration of DHCP servers.
• NWLink requires little or no initial client configuration on small non routed networks. The node ID component of the IPX address is simply the six byte MAC address of the NIC. This simple node ID eliminates the need for manual client configuration. Configuring a server's external and internal networks is more complex, however.

Network Segmentation

Administrators of large networks desire the ability to differentiatebetween multiple interconnected networks. Hierarchical network addressesprovide the ability to manage a hierarchy of subnetworks within networks,allowing smarter forwarding and security. Creating smaller segments withfewer stations produces more manageable networks with reduced trafficlevels. This ability may not be critical for small networks.
 

• NetBEUI uses a single part naming scheme, and therefore has no facility for differentiating between multiple interconnected networks.
• TCP/IP uses a multi part naming scheme that allows very large multi location networks to be logically segmented into multiple levels of subnets. Network administrators can use the network ID component of the IP address in conjunction with a subnet mask to configure and manage subnetworks within subnetworks. IP uses subnetworks to logically segment large networks into separate, smaller interconnected subnetworks.
• IPX uses a simple two part naming scheme that allows large multi location networks to be logically segmented into multiple subnets. However, the IPX network ID is not hierarchical; it does not divide into subcomponents.

Routing Capabilities

Multi location networks require routing capabilities, while single locationnetworks have little use for such capabilities. Routable protocols do notgenerally allow broadcast packets to traverse routers, thereby reducingnetwork congestion. Both IP and IPX are natively routable; they do notrequire encapsulation for routing. Both employ interior gateway protocols(IGPs) to exchange routing information among routers within an autonomousnetwork (i.e., a group of nodes controlled by a single administrativeauthority). One of the most common IGPs is the Routing InformationProtocol (RIP), which uses a vector distance algorithm to determine optimumroutes. The RIP implementations used in IP and IPX are based upon the XNSRIP developed by Xerox Corporation's Palo Alto Research Center (PARC).
 

• NetBEUI is not routable. NBF does support a simple form of routing known as Token ring Source Routing, offered only on Token Ring networks. However, source routing is not actually implemented at the OSI Network Layer.
• TCP/IP packets are routeable by third-party routers that use RIP, IGPs such as Cisco Systems' Interior Gateway Routing Protocol (IGRP), or IETF's Open Shortest Path First (OSPF) protocol, even though Windows NT itself does not understand these protocols. However, if MPR is installed, Windows NT uses RIP. You may configure Windows NT as a static TCP/IP router by checking the Enable IP Routing check box in Control Panel. Dynamic routing must be implemented with third party routers.
• Windows NT cannot act as an IPX router, but IPX provides full inter network routing support. NWLink uses Routing Information Protocol over IPX (RIPX) to implement route and router discovery services used by SPX and NBIPX. When NWLink loads, it sends out a RIPX request for a network number to be used for addressing at the IPX level. NetWare servers respond with a RIP packet containing the network number of the local network. If there is no RIPX response, NWLink uses 0 for the network number and indicates that the IPX packet is for the local subnet.

Name Registration and Resolution Requirements

Name resolution requirements impact the simplicity of client configurationand network administration. The methods of name registration andresolution impact the amount of broadcast or multicast activity present onthe network, discussed later in the section on network traffic.

NetBIOS Name Registration

All transport drivers must register NetBIOS names to ensure that eachname is unique.

NetBIOS Name Resolution

Application Layer names (NetBIOS and Sockets host names) must ultimatelyresolve to Data Link Layer (MAC) addresses. Transport drivers that donot process NetBIOS names natively have an intermediate name resolutionstep at the Network Layer, where the NetBIOS names resolve to thetransport's native address format.
 

• NBF uses NetBIOS names natively, then resolves them to MAC addresses.
• In TCP/IP, NetBT resolves NetBIOS names to IP addresses, which then resolve to MAC addresses via ARP cache or broadcast.
• In NWLink, NBIPX resolves NetBIOS names to IPX addresses. IPX addresses contain the MAC address as the host ID, so IPX requires no further resolution.

Sockets Host Name Resolution

For Windows Sockets applications, TCP/IP resolves host names to IPaddresses, which then resolve to MAC addresses.

Network Traffic

The method of name registration and resolution often impacts the amount ofbroadcast or multicast (limited broadcast) activity present on the network.Broadcast and multicast activity uses network bandwidth on the localsegment and on all bridged segments, and consumes processing cycles onevery network station the same protocol. Protocols with a high level ofbroadcast or multicast activity are not generally well suited for largenetworks.

Name Registration Broadcasts

NetBIOS names must be registered to ensure that each name is unique.All transport drivers use broadcast, with one exception. In TCP/IP,WINS clients send directed name registration request to the WINS server.Non WINS clients may use WINS proxy agent for name resolution, but relyon broadcast for name registration. The MS DOS WINS clients senddirected name resolution requests to the WINS server, but rely onbroadcast for name registration.

Name Resolution Broadcasts

Name resolution may be accomplished by broadcast, cached mappings,lookup in a local mapping file or query a name service.
 

• NBF does not cache NetBIOS names that have already been resolved to MAC addresses. NBF also does not use a mapping file or name service. Therefore, NBF will generate multicast activity each time a link to another station is re established.
• TCP/IP in Windows NT 3.5 provides many options for name resolution, resulting in few broadcasts if configured properly. For NetBIOS name resolution, TCP/IP can use cache, LMHOSTS lookup, WINS query, broadcast, DNS query and HOSTS lookup. For host name resolution, TCP/IP can use all of these methods except cache. Regardless of the method used for resolving NetBIOS and host names, IP must resolve IP addresses to MAC addresses. This final resolution stage is accomplished by ARP cache or ARP broadcast.
• NWLink uses broadcast to resolve names to addresses. However, NWLink reduces name resolution broadcast activity by caching NetBIOS name to IPX address mappings. NWLink does not use an address mapping file or name service. A future version may implement a name service similar to WINS or DNS.

Router Broadcasts

NetBEUI is not routable, and therefore has no impact on routerbroadcasts. Dynamic IP and IPX routers maintain routing tables byissuing a RIP broadcast on every port at regular intervals. IPbroadcasts every 30 seconds; IPX, every 60 seconds. All NetWare fileservers are inherently routers, and therefore issue RIP broadcasts. IPRIP allows for active or passive participants. Active participantsissue RIP broadcasts; passive or silent participants only listen. IProuters are active whereas IP hosts are typically passive.Unfortunately, IP RIP does not communicate with IPX RIP, resulting inredundant RIP broadcasts on networks running both IP and IPX.

SAP Broadcasts

IPX servers use the Service Advertising Protocol (SAP) to automaticallynotify other IPX nodes of their presence and the services they provide.IPX servers, but not routers, issue SAP broadcasts every 60 seconds.Clients use SAP to determine what network resources are available.These SAP broadcasts may cause congestion on networks with numerousservices, especially over WAN links. NWLink does not issue SAPbroadcasts.

To address this problem on NetWare, Novell implemented SAP filters andthe NetWare Link Service Protocol (NLSP) in its Multiprotocol Router(MPR) with NetWare 4.x. NLSP couples OSPF-based route information withNovell's SAP functions, substantially reducing the overhead trafficcommonly generated by RIP and SAP.

DHCP Broadcasts

DHCP will greatly simply IP client configuration. However, DHCP willslightly increase network traffic. DHCP accomplishes clientconfiguration negotiation through broadcast. Once the client acceptsthe IP address offered by the DHCP server, all activity is by directedpackets. Since DHCP servers act autonomously, there is no replicationtraffic between DHCP servers.

WINS Replication

WINS can significantly reduce name query broadcasts. However, WINS willintroduce network traffic for replication among multiple WINS servers.If configured properly, this replication traffic will be minimal and thenet effect will be reduced network traffic.

Network Status Reporting
 

• NBF does not provide any information about the state of the network.
• TCP/IP routers use ICMP to notify the source that errors have been encountered, such as Destination Unreachable, Source Quench, etc.
• IPX does not provide any information about the state of the network. IPX has no internet control management protocol, such as TCP/IP's ICMP. An IPX router has no way to indicate to a sending station that a destination is unreachable, that it should decrease its transmission rate, etc.

Memory Requirements

Network administrators generally desire a small memory footprint,especially on clients. Protocol memory requirements are typically acharacteristic of the transport driver implementation rather than theprotocol itself.
 

• NBF has relatively small memory usage.
• TCP/IP and IPX have similar memory usage requirements, but require more than NBF.

Performance

Protocol performance is typically dependent upon the efficiency and tuningof the transport driver implementation rather than the protocol itself.
 

• NBF is tuned for small LAN communication, and therefore is very fast. Its performance across WANs is poor.
• TCP/IP is not as fast as NBF on small LANs. The TCP/IP driver in Windows NT 3.1 was significantly slower than NBF on a local area network. However, the re designed TCP/IP in Windows NT 3.5 is only slightly slower than NBF.
• NWLink is not as fast as NBF on small LANs. The NWLink driver in Windows NT 3.1 was significantly slower than NBF on a local area network. However, the re designed NWLink in Windows NT 3.5 is only slightly slower than NBF.
• IPX/SPX protocols have some significant performance limitations in a routed (wide-area) network, which is why Novell has been modifying them with "packet burst" and "SPX II" changes.
• IPX is only slightly faster than TCP/IP for file and print operations, and only slightly slower than TCP/IP for application services.

Application Programming Support
 

• NBF enables NetBIOS, Named Pipes, Mailslot, NetDDE, RPC over NetBIOS, and RPC over Named Pipes programming using NBFP. NBF does not support Sockets or RPC over Sockets programming.
• TCP/IP enables Sockets and RPC over Sockets application programming over TCP and UDP. TCP/IP also enables NetBIOS, Named Pipes, Mailslot, NetDDE, RPC over NetBIOS and RPC over Named Pipes programming over NBT.
• IPX enables Sockets and RPC over Sockets application programming over SPX and IPX. IPX also enables NetBIOS, Named Pipes, Mailslot, NetDDE, RPC over NetBIOS and RPC over Named Pipes programming over NBIPX. IPX supports Socket IDs for use by Sockets applications and other applications that use IPX directly. This direct hosting capability allows IPX to realize performance advantages for small I/O by bypassing NBIPX and calling IPX directly.
   

     API                    TCP/IP          NWLink          NBF   --------------------   -------------   -------------   ---   NetBIOS                Yes (NBT)       Yes (NBIPX)     Yes   Named Pipes            Yes (NBT)       Yes (NBIPX)     Yes   Mailslot               Yes (NBT)       Yes (NBIPX)     Yes   NetDDE                 Yes (NBT)       Yes (NBIPX)     Yes   Sockets                Yes (TCP/UDP)   Yes (SPX/IPX)   No   RPC over NetBIOS       Yes (NBT)       Yes (NBIPX)     Yes   RPC over Named Pipes   Yes (NBT)       Yes (NBIPX)     Yes   RPC over Sockets       Yes (TCP/UDP)   Yes (SPX/IPX)   No						

Other Considerations

Users who wish to connect to the global Internet must obtain a network IDfrom InterNIC. The supply of unallocated IP addresses on the globalInternet is rapidly declining. In an effort to address this problem theInternet Engineering Task Force (IETF) has formed IP Version 4 AddressLifetime Estimation (IPv4 ALE) working group to determine how much longerIPv4 can last. The IETF is also developing IP Version 6 (IPv6), also knownas IP Next Generation (IPng), to replace the current IPv4. IPng increasesthe IPv4 addresses from four bytes (32 bits) to sixteen bytes (128 bits).However, there is much controversy over IPng.

Characteristic             TCP/IP           NWLink           NBFIndustry Acceptance        Most popular,    Primary protocol Limited to IBMand Experience             especially in    in PC networks   &amp; Microsoft PC                           non PC networks                   networks---------------------------------------------------------------------------Open vs. Proprietary       Open             Proprietary      Proprietary,Specification                                                but published</H3>Interoperability           Available on     Available on     Limited to IBM                           nearly every     many platforms   &amp; Microsoft PC                           platform                          networks---------------------------------------------------------------------------Simplicity of Client       Can be           Simple           SimpleConfiguration              difficultSimplicity of              Can be           Simple           SimpleAdministration             difficultNetwork Segmentation:   ------------------------------------------------------------------------   Differentiates          Yes              No               No   Between Networks   ------------------------------------------------------------------------   Hierarchy of Subnets    Yes              Yes              No   within Networks---------------------------------------------------------------------------Routing Capabilities       Native           Native           NoName Resolution Requirements:   ------------------------------------------------------------------------   Application Layer to    Resolves host    Resolves         Uses NetBIOS   Network Layer           or NetBIOS name  NetBIOS name     names natively                           to  IP address   to IPX address   ------------------------------------------------------------------------   Network Layer to        Resolves IP      IPX address      Resolves   Data Link Layer         address to MAC   contains MAC     NetBIOS name                           address          address          to MAC address---------------------------------------------------------------------------Network Traffic:   ------------------------------------------------------------------------   NetBIOS Name            WINS, Broadcast  Broadcast        Broadcast   Registration   ------------------------------------------------------------------------   NetBIOS Name            Cache, WINS,     Cache,           Multicast   Resolution              WINS Proxy,      Broadcast                           LMHOSTS,                           Broadcast,                           HOSTS, DNS   ------------------------------------------------------------------------   Router Broadcasts       Dynamic routers  Dynamic routers  N/A                           issue RIP        &amp; NetWare file                           broadcasts       servers issue                           every 30         RIP broadcasts                           seconds          every 60 seconds   ------------------------------------------------------------------------   SAP Broadcasts          N/A              IPX servers      N/A                                            issue SAP                                            broadcasts every                                            60 seconds.   ------------------------------------------------------------------------   DHCP Broadcasts         Client IP        N/A              N/A                           configuration                           negotiated via                           broadcast.   ------------------------------------------------------------------------   WINS Replication        Replication      N/A              N/A                           traffic when                           using multiple                           WINS servers---------------------------------------------------------------------------Network Status Reporting   Yes              No               NoPerformance:   ------------------------------------------------------------------------   Small LANs              Fast             Fast             Fastest   ------------------------------------------------------------------------   File and Print          Fast             Fastest          Fast   Operations   ------------------------------------------------------------------------   Application Services    Fastest          Fast             Fast---------------------------------------------------------------------------				

 

• Windows NT 3.5 Concepts and Planning Guide, Chapter 2
• Windows NT Server TCP/IP
• Windows NT Server Solutions for NetWare Networks
• Novell IPX Router Specification, Novell part number 107-000029-001
• IBM LAN Technical Reference, IBM Publications, 39F9353, SC30-3383-03
• Internetworking with TCP/IP, Volumes I and II, by Douglas E. Comer