From owner-freebsd-security  Thu Oct 29 09:49:38 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id JAA21542
          for freebsd-security-outgoing; Thu, 29 Oct 1998 09:49:38 -0800 (PST)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from phoenix.volant.org (phoenix.volant.org [205.179.79.193])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id JAA21535
          for <security@freebsd.org>; Thu, 29 Oct 1998 09:49:34 -0800 (PST)
          (envelope-from patl@phoenix.volant.org)
From: patl@phoenix.volant.org
Received: from asimov.phoenix.volant.org ([205.179.79.65])
	by phoenix.volant.org with smtp (Exim 1.92 #8)
	id 0zYwCP-0002WF-00; Thu, 29 Oct 1998 09:49:29 -0800
Received: from localhost by asimov.phoenix.volant.org (SMI-8.6/SMI-SVR4)
	id JAA13028; Thu, 29 Oct 1998 09:49:20 -0800
Date: Thu, 29 Oct 1998 09:49:19 -0800 (PST)
Reply-To: patl@phoenix.volant.org
Subject: Re: Cause of NetBIOS-NS requests from outside
To: Thomas Stromberg <ventrex@UNDER.suspicion.org>
cc: security@FreeBSD.ORG
In-Reply-To: <Pine.BSF.4.05.9810291208130.5445-100000@under.suspicion.org>
Message-ID: <ML-3.3.909683359.9882.patl@asimov>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

> If you enable "Windows resolution through DNS" in NT (there is a similar
> setting in Windows95/98), every TCP access that machine ever makes sends a
> NetBIOS-ns (137) packet to try to find out its Windows equivalent name to
> store in its cache.

Finally, an explanation that fits observed behavour.  (The broadcast
theories don't fit the packets I've actually observed; which are all
directed explicitly to my primary server.)

Does it still do this if the "Client for Microsoft Networks" is disabled?


Thanks,
-Pat

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message