Re: NETBIOS NT NULL session

["Ian Macdonald" <secsnort () dirk demon co uk>]

NT Null sessions are something that is used by MS operating systems to get
information about another server. It is a way to connect to a machine and
not authenticate (Null) then gather information from the machine. You can
use a null session to collect information about who is logged onto a
machine, what domain they are part of and some other stuff. I think you can
also make registry updates using Null sessions. You can restrict what
information can be viewed by null sessions by setting restrictanoymous in
the registry (doing a search on the web will bring up the exact location).
If you completely disable null sessions things will break but by making this
registry change you can limit the impact of the null sessions.

Ian
----- Original Message -----
From: "Tony Wong" <tony.wong () stanford edu>
To: <snort-users () lists sourceforge net>
Sent: Wednesday, August 28, 2002 3:29 PM
Subject: [Snort-users] NETBIOS NT NULL session


> Why am I getting these alerts to my NT Fileserver?
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by: Jabber - The world's fastest growing
> real-time communications platform! Don't just IM. Build it in!
> http://www.jabber.com/osdn/xim
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users