Netbios name %m not always correct

[Christopher R. Hertel]

On Thu, Oct 23, 2003 at 12:34:07PM +0100, David Lee wrote:
> On Tue, 21 Oct 2003, Christopher R. Hertel wrote:
> 
> > [...]
> > An updated smbclient might do SMBsend and MS-RPC.
> > [...]
> 
> Indeed.
> 
> This brings us almost full circle.
> 
> Can anyone give me any pointers in the Samba 3.0.x source to a subroutine,
> which with some luck might already exist, that would take an IP number (or
> DNS hostname?) as an argument, and return a NetBIOS name?  Is there such a
> thing?

Not exactly.

NetBIOS names are addresses.  They represent communication endpoints: an 
application or service that is talking or listening on the "NetBIOS LAN".
As such, there is no one-to-one mapping between IPs and NetBIOS names.  A 
NetBIOS group name may be found on several IP addresses, and there may be 
several NetBIOS names registered at a given IP address.

There is a quick way to find what you want, though.  Send a "Node Status 
Query".  The nmblookup utility can do this when you use the "-S" or "-A" 
option.  The response will contain the list of all registered NetBIOS 
names.

> Note that this would be for a port 445 smbd, where the NetBIOS name
> probably isn't inherently available, but might be by other means... and
> here I speculate wildly... such as some sort of call to nmbd/WINS server.

Ummm... not quite.  Port 445 is SMB *without* NBT.  No NBT means no 
NetBIOS API and no NetBIOS names.  SMB on port 445 uses naked TCP 
transport.

You could use the DNS to reverse the IP to a DNS name, and then "guess" 
that the first label of the DNS name is the NetBIOS base name for the 
machine... but then you're back to NBT.

I'm not sure why you would want to reverse the name to a NetBIOS name if 
you are using port 445.

> Given that, I might be able to begin (subject to usual "find tiny gaps in
> the usual daily busy-ness" etc.) to look at possible reworking of
> "smbclient -M" in the coming weeks.

Okay, so here's the deal...

If you want to use the SMBsend, then you would be using port 138 which 
offers the NBT Datagram service.  In that case, if %m is not working for 
you, you do this:

  nmblookup -A <IP> | fgrep "<03>"

This will return zero, one, or two names, eg.:

  $ nmblookup -A 192.168.7.50 | fgrep "<03>"
        OMEGA           <03> -         B <ACTIVE> 
        CRH             <03> -         B <ACTIVE>

The <03> names represent the SMBsend-style Messenger Service.  Send to 
either of these.  Note that <IP> in the line above may be either the IP 
address or DNS name of the host you're trying to contact.

If no names are returned, the the host isn't listening for Messenger 
Service messages.  Even if the host *is* listening, the WinPopup 
application must be running or the message will not be displayed.

Anyway, all of that can be done easily in a script, which would bypass the 
problem of %m not always being correct.


If you want to do the RPC Messenger Service... Well, I don't know how that 
works.  Ick.  Sorry.  There should be enough documentation 'round the 'net 
to work it out.  There may be an Open Source tool, but I haven't found one 
yet.  I don't think that we (Samba) have implemented an RPC Message 
sender.


Really hoping that's useful...

Chris -)-----
"I'm the *Theory* guy." 

-- 
"Implementing CIFS - the Common Internet FileSystem" ISBN: 013047116X
Samba Team -- http://www.samba.org/     -)-----   Christopher R. Hertel
jCIFS Team -- http://jcifs.samba.org/   -)-----   ubiqx development, uninq.
ubiqx Team -- http://www.ubiqx.org/     -)-----   crh at ubiqx.mn.org
OnLineBook -- http://ubiqx.org/cifs/    -)-----   crh at ubiqx.org