p****t
发帖数: 11416 | 1 【 以下文字转载自 Internet 讨论区 】
【 原文由 piglet 所发表 】
转自yesky.com，高手们看看说得对么？
还有，有必要么？我的Norton Personal Fireware
一会儿又说自动block了什么NetBUS Trojan，是
不是就是这个NetBIOS在作怪？
关上可恶的后门-消除NetBIOS隐患 |
|
a**s
发帖数: 1398 | 2 Is there anyone who can find out the problem and give a solution?
Note: I was only notified that there are security problems on the target
machine running windows2000
c:\windows>nbtstat -a 203.195.136.156
NetBIOS Remote Machine Name Table
Name Type Status |
|
c**p
发帖数: 32 | 3 【 以下文字转载自 Windows 讨论区 】
发信人: calp (恨悟空不能唐僧), 信区: Windows
标 题: 问一个问题，关于domain controller & dns的
发信站: BBS 未名空间站 (Wed May 7 17:02:34 2008), 转信
我自己在局域网里面建立了一个domain controller，然后同时用这台机器作为dns服务器
跟这台机器相连的其他windows clients，把dns指向这台机器。但是在wins里面的选项
，如果diable netbios，那么机器的郁闷根本无法解析；但是如果将这个有关netbios
的设置设为default(use netbios setting from the dhcp server. if static ip
address is used or the dhcp server does not provide netbios setting, enable
netbios over tcp/ip),则域名可以正确被解析。不知道是什么道理。。 |
|
c**p
发帖数: 32 | 4 我自己在局域网里面建立了一个domain controller，然后同时用这台机器作为dns服务器
跟这台机器相连的其他windows clients，把dns指向这台机器。但是在wins里面的选项
，如果diable netbios，那么机器的郁闷根本无法解析；但是如果将这个有关netbios
的设置设为default(use netbios setting from the dhcp server. if static ip
address is used or the dhcp server does not provide netbios setting, enable
netbios over tcp/ip),则域名可以正确被解析。不知道是什么道理。。 |
|
w*******t
发帖数: 960 | 5 enable后可以连接，注册成功
但是不能访问服务器上的samba文件夹，其他的服务也不能访问，内网的ip都可以ping
用的PPTP，不知道换L2TP会不会有帮助
下面是网上找的sprint block端口的list
===========================================================
Here is a list of ports that Sprint block for inbound traffic.
TransPort routers use port 80 for web GUI management
TransPort routers use port 4000 for serial port access over TCP
• Sprint blocks certain known IP ports to keep unauthorized
traffic from entering the CDN
> 80 tcp http (web servers)
> icmp echo ... 阅读全帖 |
|
v****x
发帖数: 34 | 6 port 137 service and worm,
tcp netbios-ns NETBIOS Name Service
udp netbios-ns NETBIOS Name Service
tcp Chode [trojan] Chode
tcp Qaz [trojan] Qaz
udp Msinit [trojan] Msinit |
|
Z****e
发帖数: 2999 | 7 又想了想，既然都是Windows机器，可能是NetBIOS解析有问题，不是DNS解析
如果你的机器是active directory的一部分，照说NetBIOS解析应该由Domain
Controller负责，如果不是AD的一部分，是不是防火墙block了NetBIOS解析的端口 |
|
l*******e
发帖数: 3584 | 8 我就想共享一些照片什么的，
谁来给讲讲我哪里错了。
Preparing directories and users
Create directories for Samba to use with Windows
#mkdir samba
Now we need to create users to access this directiory
#useradd pcguest
Now create a password for this user
#smbpasswd -a pcguest
root@debian:~# smbpasswd -a pcguest
New SMB password:
Retype new SMB password:
Added user pcguest.
configure samba configuration file
... 阅读全帖 |
|
a***t
发帖数: 39 | 9
445 is Microsoft Directory Service, for sharing files on the network (NetBios
over TCP/IP). It's similar to the port 139 (NetBios Session) on the older
Windows versions. It usually should be ok, but if you see excessive
connections/scans from outside, try to turn it off. |
|
D********r
发帖数: 3238 | 10 你这是纯脆扯蛋.
hide IP多种方法可以实现,NetBios, SoCK5上想怎么改怎么改
现在很多流行安全软件比如Norton就可以直接帮助你隐藏网址. |
|
o****e
发帖数: 4946 | 11 how can i find out if the NetBIOS port is blocked or not? |
|
k****t
发帖数: 12697 | 12 VPN 了还要FORWARD? 再说学校的ROUTER 会让你MESS?
是直接用IP 还是NAME? 如果是用NAME 的话多半是NAME RESOLUTION 问题. NETBIOS 不
能BROADCAST NAME RESOLUTION ACROSS 两NETWORK |
|
k****t
发帖数: 12697 | 13 到了这步是已经通了. 你用了IP 还是NETBIOS NAME 还是 FULL QUALIFIED DOMAIN
NAME? 你用的NAME 跟SERVER CERT 不MATCH.
还有,台式机装的是SERVER 2008 吧? |
|
f*******5
发帖数: 10321 | 14 文件共享跟下边的口有关
* Microsoft file sharing SMB: User Datagram Protocol (UDP) ports from
135 through 139 and Transmission Control Protocol (TCP) ports from 135
through 139.
* Direct-hosted SMB traffic without a network basic input/output system
(NetBIOS): port 445 (TCP and UPD).
你也可以看看其他什么口开着
http://technet.microsoft.com/en-us/library/cc959833.aspx |
|
z**r
发帖数: 17771 | 15 install netbios over tcp/ip?
Manager,
192. |
|
|
f***s
发帖数: 257 | 17 samba配置文件如下：
[root@Pogoplug ~]# cat /etc/samba/smb.conf
[global]
workgroup = WORKGROUP
server string = ALARM
netbios name = ALARM
security = user
null passwords = yes
map to guest = bad user
load printers = no
printing = bsd
printcap name = /dev/null
disable spools = yes
log file = /var/log/samba/%m.log
max log size = 50
dns proxy = no
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_KEEPALIVE SO_RCVBUF=131072
SO_SNDBUF=131072 SO_KEEPALIVE
[External]
path = /media/Mobile_Disk
read only = no
public... 阅读全帖 |
|
sa
发帖数: 1384 | 18 sounds simple but actually complicated. you would need a crossover network
cable and some old netbios protocols
, |
|
z***s
发帖数: 3241 | 19 半个月前废了不少脑细胞，终于把E02用archlinux搞定了，samba挂了3块硬盘。
过了几天发现文件少了很多，原来不支持中文，只显示英文文件。等于白干，饱受打击。
刚才又打算研究研究，3块硬盘只有一块能用，另外两块只有名字，下面空的。
能用的是系统盘ext3。
年龄大了，当时怎么搞的都忘了。不记得是不是自动mount，但当时重启了多次也没有
问题啊。
感觉linux比较反人类，我只需要简单的功能，搞了之后再不去摸。不觉得钻研这有啥
乐趣。
人穷志短，看在花了钱的份上还想再试试。高人再指点一二吧。
现在pogo下面三个文件夹，usb跟以前一样正常工作，Hitachi和wd下面是空的。
btw，smb.conf里面WD是大写，我看见的怎么是wd。
[root@alarm /]# lsblk -f
NAME FSTYPE LABEL UUID MOUNTPOINT
sda
└─sda1 ext3 50df594d-2786-4088-8e46-d3df58ca06a0 /
sdb
└─sdb1 ... 阅读全帖 |
|
t**d
发帖数: 6474 | 20 你先试一下不用samba的时候你在内网下载pogoplug上硬盘的内容速度是多少（通过http://pogoplug.com/帐号找到你的硬盘上的大文件下载），这个应该是你的极限速度。samba我没有什么优化，我就是把dockstar的原先samba文件copy过来的。我的smb.conf文件内容如下：
guest account = root
map to guest = bad user
netbios name = nas
server string = nas
workgroup = workgroup
security = user
unix charset = UTF-8
display charset = UTF-8
use mmap = yes
os level = 1
[Seagate Backup_ Desk Mac]
comment = Seagate Backup+ Desk Mac
path = /opt/home/disk2t
browsable = yes
writable = no
guest ok = yes
printable = no
[Seaga... 阅读全帖 |
|
g***i
发帖数: 4272 | 21 所有的设备都挂到linksys上自然是最简单的。但我这的问题是linksys十天半月的就抽
风，wifi连不上了，需要命令行里把interface重新down/up一下。
这样的话就需要有另一个路由器的网，用来telnet进linksys。所以我就保留了两个路
由器上的wifi。但总有设备不经意间连到第一个wifi上，所以我就再想办法让第二个子
网里的samba server在第一个子网里也是discoverable. 这应该跟netbios有关，但不
了解。
貌似最合理的方案是linksys既保留一个ip，都又不负责分配ip，所有设备都由modem上
的router分配ip. linksys只提供ethernet的接入. |
|
S*A
发帖数: 7142 | 22
这个需要治理。我用 TPLINK WDR3600 跑 Openwrt 从来不需要 restart
wifi。Up time 非常长。
你也可以在 linksys 里面写个脚本自动重新启动 wifi。
的话就需要有另一个路由器的网，用来telnet进linksys。所以我就保留了两个路
netbios 不能过网关的，除非你特别作了手脚。
这个就是我开始说的，那个 IP 是本来就可以用的，就是没有 DHCP
而已。 |
|
|
c*******e
发帖数: 5818 | 24 再谢谢你，你很列害，我最早查的说就是这个问题，我也改了这个，但没解决，所以我
就到处查，网上的建议很多，到现在没一个管用的。
就先这样吧，还能对付用。
：这个是域名解析有问题。ping hostname应该是不通的。
：试试这个吧： Enabling NetBios Over TCP in Windows |
|
y*****n
发帖数: 48 | 25 1) Which of the following Windows NT files contains a static mapping
of IP addresses to NetBios computer names?
LMHOSTS
IPCONFIG
HOSTS
ETC
2) You have installed a new Microsoft Exchange Server and would like
to migrate the old Exchange Server databases files to your new
Exchange Server. Which of the following files would you have to
copy?(Choose all that apply.)
DIR.EDB
PUB.EDB
EXC.EDB
PRIV.EDB
EMD |
|
L******t
发帖数: 1985 | 26 我这里指的互通是指Windows局域网络本身特有的工作组/域一级的互通。TCP/IP当然可以
支持互通，但和Windows中网络邻居的性质是不同的。并且TCP本身只是传输层协议，即便
能支持Windows网络邻居，也是在上层另有扩展。有人说从Win2K起Windows放弃NetBEUI，
采用了NWLink NetBIOS协议，是否如此可以试一下。
局
，
本 |
|
l***t
发帖数: 10 | 27 Pls install NetBios protocol for both and make sure you have different names
for them. |
|
q**u
发帖数: 12289 | 28 The fact that he can ping the server on another subnet means there is at least
one gateway device (likely a router) between his computer and the server. In
other words, the server is not on the same ethernet segment as the client PC.
Otherwise, the server would not be accessable to him using TCP/IP.
Browsing in "Microsoft Network" requires NetBIOS broadcast, which is generally
not forwarded by a router. That is why he wants to turn the router into a
switch, which does forward these broadcasts |
|
c****e
发帖数: 1453 | 29 control panel->network->wireless network connection->install netbios |
|
E********t
发帖数: 2447 | 30 谢谢回答。可是找不到wireless network connection，或者你指的是wireless network
connection wizard? 点进去也没看见install netbios
edition.家里装的cable,我接了个wireless
联起
and
台，
别处
上就 |
|
c******r
发帖数: 59 | 31 我的电脑用vista; 由于一些问题(包括上网),重装了系统(还是vista). 可还是上不了
网.Gateway总是空白. 现将一些参数列于下,希望大家能帮忙看看,指教一二.
我的LAN设置为 "Automatically detect settings"
TCP/IPv4 和 TCP/IPv6 均为 automatic configuration; DNS 也为automatic;
Gateway 为 automatic metric
DHCP: Enable
Autoconfiguration IPv4: normal
IPv4 Subnet Mask: normal
IPv4 Default Gateway: (空白, 无参数)
IPv4 DNS Server: (空白, 无参数)
IPv4 WINS Server: (空白, 无参数)
NetBIOS over TCPIP: Enable
Link-Local IPv6 Address: fe80:35eb:c8c3:c50f:400a%8
IPv4 Default Gateway: (空白, 无参数)
IPv6 DNS Se |
|
T*****e
发帖数: 361 | 32 下面是输出。没有见到8080啊。
C:\>netstat -a
Active Connections
Proto Local Address Foreign Address State
TCP mydesktop:epmap mydesktop:0 LISTENING
TCP mydesktop:microsoft-ds mydesktop:0 LISTENING
TCP mydesktop:1028 mydesktop:0 LISTENING
TCP mydesktop:1035 localhost:1036 ESTABLISHED
TCP mydesktop:1036 localhost:1035 ESTABLISHED
TCP mydesktop:netbios-ssn mydesktop:0 LISTENING
|
|
s*c
发帖数: 3 | 33 1.不知楼主的139如何绑定 到loop口？ 我试验的好像只要在一个口上禁用netbios
over tcp.所有的nic都被禁用了。
2. ssh forward samba 我觉得犯不上吧。
除非你samba上放的明文的东西 担心被偷。 本身samba访问的验证是不传输明文密码
的。
3.不知道楼主说的混乱和攻击频繁是什么意思？
3.1我觉得可以用一些 集中式管理的病毒软件。就算给普通用户local admin 的权
限。他也无法disable病毒程序。我们以前用trend,感觉对木马杀的一般。但用户卸载
是需要通过server端。
3.2 我们以前是有个audit的程序。三个月 就要运行一下。生成一个报表自动
upload. 如果你没通过audit,比如硬盘没有加密。某些软件没有安装 病毒库没有更新
。 上次运行杀毒太久。 那么你的manager就会被mail通知到。 和KPI挂钩的. 大家
都不敢马虎。 关于一些软件无法audit的。比如laotop要锁在桌子上。桌面上没有任
何泄密的资料等等。这些需要你的同事给你签名。
3.3至于攻击。如果是内部的攻击。可以在一些 |
|
l*******e
发帖数: 3584 | 34 I did search and tried, but looks like none of them work.
At the beginning, I still can see the Samba share folder from PC vista,
but after I change the smb.conf, it is totally out of service.
Here it is:
[global]
workgroup = workgroup_liu
netbios name = debianserver
server string = %h server (Samba %v)
log file = /var/log/samba/log.%m
max log size = 1000
syslog = 0
load printers =no
[SAMBA]
path=/home/pcguest
read only = no
browseable=yes
writeable=yes
public = yes
valid users = pcguest
admin u... 阅读全帖 |
|
l*******e
发帖数: 3584 | 35 It is under sudo condition
When I checked all the step I did before, I noticed that I did restart
samba one just I installed it with the conf like this
[global]
workgroup = debian
netbios name = debianserver
server string = %h server (Samba %v)
log file = /var/log/samba/log.%m
max log size = 1000
syslog = 0
[SAMBA]
path=/samba
browseable=yes
writeable=yes
valid users = pcguest
admin users = debain
Fellow is what I got when I run restart.
root@debian:~# /etc/init.d/samba resta... 阅读全帖 |
|
D****N
发帖数: 430 | 36 139/tcp and 139/udp are for NETBIOS Session Service,
you can disable your file/printer sharing in Network Properties
to make sure the port is closed, however I'm not sure if
that will make a telnet session impossible. The incoming
connections are usually not intrusions but better be careful. |
|
a***t
发帖数: 39 | 37
This is a service on Win2k/NT. It doesn't have anything to do with MSN IM or
SMTP. It allows you to send the message to some or all users in the local
domain, thru NetBios. Windows also uses it for something like a warning window
from the domain controller. By the way, some spam uses this technology too,
for example, the diplomat spam I saw before. |
|
h****e
发帖数: 204 | 38 want to mapping a driver outside firewall directly through NetBios
using NAT. is this way kind of safe? |
|
a**s
发帖数: 1398 | 39
I got it. Disable the printer the file sharing service. |
|
i******e
发帖数: 410 | 40 1)install personal firewall
2) stop messenger service
3) if you don't share your resource, delete NetBios protocol
4) set password for your admin
quite a lot virus can attack you directly, close everythign that u don't need |
|
m*******u
发帖数: 25 | 41 我把这个问题再顶起来吧 因为我遇到同样的问题，但我的xp是professional的，也连
不到，不仅共享文件看不到，连XP电脑都看不到，但XP可以看到7的电脑。
肯定的是workgroup的名字一样的
而且我还发现个奇怪的问题，试图将network and sharing centre里高级设置的 turn
on file and printer sharing 打开，但是无法保存设置，回头一看还是turn off的，
是不是和这个有关阿
我装了360的实时监控防火墙，不知道和这个有没有关系
在网上找了很多，说进computer management里的services里 将相关tcp/ip netbios
helper, ssdp discovery, server都打开，也都打开了，但还是无法保存turn on file
and printer sharing.
急死了，找了好多，弄了好久了，快绝望了，大家一定要帮帮忙。 |
|
m*******e
发帖数: 310 | 42 port 139 is used by NetBIOS over TCP/IP. Possible
risk is DoS attacking. But it was fixed in WIN2K SP1.
You can turn it off in "WINS" tab of the "
Advanced TCP/IP Settings" dialog box
if you don't need to enable file/printer
sharing on that interface. |
|
B*******e
发帖数: 3882 | 43 1.Disable simple file share in winXP
"
To turn Simple File Sharing on or off in Windows XP Professional:
Double-click My Computer on the desktop.
On the Tools menu, click Folder Options.
Click the View tab, and then click to select the Use Simple File Sharing (Re
commended) check box to enable Simple File Sharing (click to clear this chec
k box to disable this feature).
"
2. Install NetBIOS
Control panel:
in winXP, right click "Network Bridge", "properties", "General", install,pro
tocol, install |
|
a**s
发帖数: 1398 | 44
Disabling File And Printer sharing is not a good solution. |
|
xp
发帖数: 16 | 45 check your WINS configration, use dynamic WINS registration.
use netBIOS ... |
|
t*******k
发帖数: 20 | 46 Can't connect with usb cable.
If you have a hub, then you can run Netbios protocol to connect
the two computer by plugging the ethernet cables to the hub.
If your computers have infra red wireless port, it works as well. |
|
y****t
发帖数: 10233 | 47 你的netbios 没设好.
\\another-computer
it
accessible"，连自己都看不到。可我的账号也是administror呀。另外一台desktop |
|
c******r
发帖数: 59 | 48 我的电脑用vista; 由于一些问题(包括上网),重装了系统(还是vista). 可还是上不了
网.Gateway总是空白. 现将一些参数列于下,希望大家能帮忙看看,指教一二.
我的LAN设置为 "Automatically detect settings"
TCP/IPv4 和 TCP/IPv6 均为 automatic configuration; DNS 也为automatic;
Gateway 为 automatic metric
DHCP: Enable
Autoconfiguration IPv4: normal
IPv4 Subnet Mask: normal
IPv4 Default Gateway: (空白, 无参数)
IPv4 DNS Server: (空白, 无参数)
IPv4 WINS Server: (空白, 无参数)
NetBIOS over TCPIP: Enable
Link-Local IPv6 Address: fe80:35eb:c8c3:c50f:400a%8
IPv4 Default Gateway: (空白, 无参数)
IPv6 DNS Se |
|
f*w
发帖数: 13 | 49 HP Vista的系统，一直很正常，直到三天前突然无法上网了，是netgear的路由器。
始终显示访问仅本地。连接同一个路由器的mac air,用xp的tp都可以上网.
用网线连接路由器也没用，连iphone的tethering也没有用。
手动设置过ip,把ipv6的钩也去掉了，
除了重装系统，还有其他什么好办法？
ipconfig /all 显示如下
Windows IP 配置
主机名 . . . . . . . . . . . . . :
主 DNS 后缀 . . . . . . . . . . . :
节点类型 . . . . . . . . . . . . : 混合
IP 路由已启用 . . . . . . . . . . : 否
WINS 代理已启用 . . . . . . . . . : 否
无线局域网适配器 无线网络连接:
连接特定的 DNS 后缀 . . . . . . . :
&... 阅读全帖 |
|
w*******y
发帖数: 60932 | 50 Link:
http://itunes.apple.com/us/app/scany-network-port-scanner/id328
Link:
http://happymagenta.com
*** FEATURES ***
- Scan both LAN and the Internet
- Scan any IP address or network range
- Bonjour hostnames lookup
- Windows hostnames lookup (NetBIOS, Samba)
- Device names lookup (UPnP, SSDP, DLNA)
- Country of origin detection of the network owner
- Network range and AS number lookup
- MAC address and hardware vendor lookup
- Wake on LAN or Wi-Fi (by MAC address)
- Wake over the Internet (usin... 阅读全帖 |
|
