NetBIOS info

[bugtraq () NETWORKICE COM (Robert Graham)]

I've added a couple of pages worth of text to my firewall forensics document
in order to discuss the NetBIOS stuff.
http://www.robertgraham.com/pubs/firewall-seen.html#netbios

Some recent questions on this list that I've tried to address in the above
document are:

Q: I've seen a lot more lately.
A: Over the past year, Windows products that do reverse lookups have become
more popular. Also, you may have misconfigured your DNS.

Q: What is the exact specifics of the packets (length, etc.)?
A: I've put a complete packet dump into the doc.

Q: But my site doesn't run any form of NetBIOS or Windows...
A: ...but it has IP addresses, which is all the Windows clients care about.
In any event, it's not a TCP/IP thing, it's a Windows thing.

Q: ...Internet Explorer...
A: I believe that Internet Explorer doesn't do reverse queries; it's
something else.

Q: ...bandwidth...
A: Actually, less than the DNS queries that usually precede the NetBIOS
queries.

In any event, if you are seeing a lot of these queries, you should
immediately suspect your DNS servers. Windoze only sends the NetBIOS packet
if the DNS fails. In other words, the "cause" of a lot of NetBIOS traffic is
faulty DNS. See the section:
http://www.robertgraham.com/pubs/firewall-seen.html#10.6

Robert Graham