OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: UDP137 connection attempts v1.1
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: UDP137 connection attempts v1.1

  • To: NTBUGTRAQLISTSERV.NTBUGTRAQ.COM
  • Subject: Re: UDP137 connection attempts v1.1
  • From: Russ <Russ.CooperRC.ON.CA>
  • Date: Wed, 25 Nov 1998 13:39:38 -0500
  • Approved-By: Russ.CooperRC.ON.CA
  • Reply-To: Russ <Russ.CooperRC.ON.CA>
  • Sender: Windows NT BugTraq Mailing List <NTBUGTRAQLISTSERV.NTBUGTRAQ.COM>
Ok, revision 1.1...;-]

"Enable DNS for Windows Resolution", and "h-nodes" or NodeType, have NOTHING
TO DO WITH IT...;-]

Both pertain, seemingly, only to forward resolutions (i.e. name -> IP).

Enable DNS for Windows Resolution determines whether NetBIOS names will have
domain names added to them and be sent to a DNS server for lookup.

NodeType determines whether or not to even try a DNS lookup for a NetBIOS
name.

The only thing that appears to use a unicast NetBIOS Adapter Status Query is
Winsock gethostbyaddr(), or an inverse lookup of an IP -> name, and this
action is not affected by either of the two factors above.

Unfortunately, no nice flow diagrams exist in TechNet to explain the
difference between gethostbyaddr() and gethostbyname().

The radical approach of removing the Name Space Provider should still be
effective.

One would think, however, that there would be equivalent mechanisms for
controlling these two functions independently since many of the controls on
gethostbyname() don't affect gethostbyaddr().

Cheers,
Russ - NTBugtraq moderator