Service Advertising Protocol (SAP)

The Service Advertising Protocol (SAP) allows service-providing nodes -- such as file servers, print servers, gateway servers, and application servers -- to advertise their services and addresses. SAP makes the process of adding and removing services on an internetwork dynamic. As servers are booted up, they advertise their services using SAP; when they are brought down, they use SAP to indicate that their services will no longer be available.

SAP broadcasts

Through SAP, clients on the network can determine what services are available on the network and obtain the internetwork address of the nodes (servers) where they can access those services. This is an important function, because a workstation cannot initiate a session with a service provider without first having that server's address.

A gateway server, for instance, will broadcast a SAP packet every 60 seconds (the period defined for all servers advertising with SAP) onto the network segment to which it is connected. The SAP agent in each router on that segment copies the information contained in the SAP packet into an internal table called the server information table. Because the SAP agent in each router keeps up-to-date information on available servers, a client wanting to locate the gateway server can access a nearby router for the correct IPX address.

SAP packet structure

Like RIP, SAP uses IPX and a medium-access protocol for its transport. Figure 4-6 illustrates the structure of a SAP packet.

Figure 4-6 SAP Packet Structure

A SAP packet contains the following fields:

Operation

Specifies the operation that the packet is performing.

Service type

Specifies the type of service offered by the server.

Server name

Specifies the name of the broadcasting server.

Network address

Specifies the network number of the broadcasting server.

Node address

Specifies the node number of the broadcasting server.

Socket address

Specifies the socket number of the service provider.

Hops to server

Specifies the number of hops to the broadcasting server.

The ``Operation'' field can specify the following operations:

a workstation request for the name and address of the nearest server of a certain type

a general request, by a router, for the names and addresses of either all the servers or all the servers of a certain type on the internetwork

a response to either a "Get Nearest Server" request or a general request

periodic broadcasts by servers and routers

changed server information broadcasts

There can be one or more sets of fields following the ``Operation'' field. If the packet contains information about more than one server, it will contain more than one set of fields (n sets of fields). Each SAP packet can contain information about up to seven servers.

Network Access Protection Design Guide

Updated: October 6, 2008

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

Network Access Protection (NAP) is one of the most anticipated features of the Windows Server� 2008 operating system. NAP is a new platform that allows network administrators to define specific levels of network access based on a client�s identity, the groups to which the client belongs, and the degree to which the client complies with corporate governance policy. If a client is not compliant, NAP provides a mechanism for automatically bringing the client into compliance (a process known as remediation) and then dynamically increasing its level of network access. NAP is supported by Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista�, and Windows� XP with Service Pack 3 (SP3). NAP includes an application programming interface that developers and vendors can use to integrate their products and leverage this health state validation, access enforcement, and ongoing compliance evaluation. For more information about the NAP API, see Network Access Protection (http://go.microsoft.com/fwlink/?LinkId=128423).

The following are key NAP concepts:

NAP Agent. A service included with Windows Server 2008, Windows Vista, and Windows XP with SP3 that collects and manages health information for NAP client computers.
NAP client computer. A computer that has the NAP Agent service installed and running, and is providing its health status to NAP server computers.
NAP-capable computer. A computer that has the NAP Agent service installed and running and is capable of providing its health status to NAP server computers. NAP-capable computers include computers running Windows Server 2008, Windows Vista, and Windows XP with SP3.
Non-NAP-capable computer. A computer that cannot provide its health status to NAP server components. A computer that has NAP agent installed but not running is also considered non-NAP-capable.
Compliant computer. A computer that meets the NAP health requirements that you have defined for your network. Only NAP client computers can be compliant.
Noncompliant computer. A computer that does not meet the NAP health requirements that you have defined for your network. Only NAP client computers can be noncompliant.
Health status. Information about a NAP client computer that NAP uses to allow or restrict access to a network. Health is defined by a client computer's configuration state. Some common measurements of health include the operational status of Windows Firewall, the update status of antivirus signatures, and the installation status of security updates. A NAP client computer provides health status by sending a message called a statement of health (SoH).
NAP health policy server. A NAP health policy server is a computer running Windows Server 2008 with the Network Policy Server (NPS) role service installed and configured for NAP. The NAP health policy server uses NPS policies and settings to evaluate the health of NAP client computers when they request access to the network, or when their health state changes. Based on the results of this evaluation, the NAP health policy server instructs whether NAP client computers will be granted full or restricted access to the network.