2.1.1.2 SMB (NCACN_NP)
This protocol sequence specifies RPC directly over SMB. There are no intermediate protocols between RPC and SMB.
When these extensions are enabled over the SMB transport protocol, the network address used by the client MUST be an IPv4 or IPv6 address or a server name.<3>The server name MUST be a Unicode string that represents either a NetBIOS host name (see [MS-NBTE] section 2.2.1) or a fully qualified domain name (see [RFC1035] section 3.1 and [RFC2181] section 11).
The endpoint MUST be a named pipe name. The network address and endpoint are not transmitted on the network by these extensions but are used by lower-layer protocols to set up the connection.
RPC over SMB MUST use an endpoint mapper well-known endpoint of \pipe\epmapper.
RPC over SMB MUST use a protocol identifier of 0x0F instead of 0x10, as specified in [C706] Appendix I.<4>
The tower encoding for RPC over SMB MUST be the same as what is specified in [C706] Appendix L, for ncacn_ip_tcp. The port address MUST be the endpoint encoded into a NULL-terminated string in ASCII character format. The length of the string MUST be less than 0xFFFF bytes. For changes in how these extensions interpret the tower encoding see section 3.1.3.5.3.
When an application is creating a binding handle for RPC over named pipes, the application will provide a server name, endpoint, and credentials. The server name, endpoint, and credentials are provided to SMB ([MS-CIFS] section 3.4.4.1) to uniquely identify the named pipe (SMB session) which the RPC binding handle will use.
All PDUs sent over SMB MUST be sent as named pipe writes ([MS-CIFS] section 3.4.4.2), and PDUs to be received MUST be received as named pipe reads, as specified in [MS-CIFS] section 3.4.4.3. However, in the case of synchronous RPCs, an implementation of these extensions MAY require the Server Message Block (SMB) Protocol ([MS-SMB]) implementation to execute a transaction that encompasses the write of the last request PDU and the read of the first response PDU on the client. The last request PDU MUST be a bind, an alter_context, or the last fragment of a request. The first response PDU MUST be a bind_ack or bind_nak, an alter_context_response, or the first fragment of a response. The transaction over a write and read is as specified in [MS-CIFS].<5>