wxp SP2 host responds to "nmblookup HOST" but not "nmblookup *"

[Andrew Bartlett]

On Tue, 2004-12-28 at 19:16 -0600, Christopher R. Hertel wrote:
> On Wed, Dec 29, 2004 at 10:14:12AM +1100, Andrew Bartlett wrote:
> > On Tue, 2004-12-28 at 14:33 -0800, David Wuertele wrote:
> > 
> > > I didn't realize the messenger service was handling this.  Or is it
> > > that some security logic is only turning on the "respond to wildcard"
> > > feature if it sees that the messenger service is running?
> > > 
> > > Dave
> > 
> > I'm pretty sure that's what happened.  Remember, SP2 was a compromise
> > between better security (which would mean not listening at all) and not
> > breaking applications people used.  While we may all find it
> > frustrating, I'm sure winpopup is actually used in some organisations
> > even in it's (frustrating) broadcast mode.
> 
> No, Winpopup is not in broadcast mode.  The names are all unique names and 
> the protocol is something like a mailslot protocol (though it isn't...  I 
> have some docs and some captures...).

I assure you, the winpopup wars I had on my network (before I disabled
messenger service on all my machines) were broadcast UDP packets, as
mailslot requests.  I almost got a program written to catch them, and
record host addresses.

I hoped they were just unicast sessions to smbd, as then my 'beartrap'
would have caught the bastards involved....

Andrew Bartlett

-- 
Andrew Bartlett <abartlet at samba.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20041229/c23d6f29/attachment.bin