Contents of /etc/services and other strange data in smb packets

Peter Samuelson peter at cadcamlab.org
Tue Aug 8 11:20:01 GMT 2000


[Panu Hällfors <panu.hallfors at viloke.fi>]
> While observing my network traffic to track down a source of strange
> packets hitting my firewall on my Linux Samba 2.0.7-3 (Debian) host,
> I came accross some strange NetBeui packets.

> Though I'm not 100% sure, I believe they originate from Samba.

Do you have other reasons to believe this, or just that Samba uses
NetBIOS?

Samba, as of 2.0.7, does not send or receive NetBEUI at all.  In fact,
I don't think most versions of Unix even support NetBEUI, though I
suppose you could do something with raw sockets.  (I'm a lousy sockets
programmer so I'm not sure about this.)

Samba will gain NetBEUI functionality at some future date.  It has been
written already.

> The data the packets (of length 65535) contain include
>   -services listing from /etc/services
>   -a fraction of a web page an other user on the same network was requesting
>   -names and paths of system libraries (eg. /lib/libnss_db.so.2)
>   -other strings, among others "passwd" and "shadow"
>   -listing of locale files
>   -etc...

Strange.  Very strange.

> Is this normal and is Samba doing this?

No!

Peter




More information about the samba-technical mailing list