wxp SP2 host responds to "nmblookup HOST" but not "nmblookup *"

[Christopher R. Hertel]

Hang on...  The WinPopup program itself can send a message to the 
workgroup.

I'll take a look.  :)

Chris -)-----

On Wed, Dec 29, 2004 at 12:25:49PM +1100, Andrew Bartlett wrote:
> On Tue, 2004-12-28 at 19:16 -0600, Christopher R. Hertel wrote:
> > On Wed, Dec 29, 2004 at 10:14:12AM +1100, Andrew Bartlett wrote:
> > > On Tue, 2004-12-28 at 14:33 -0800, David Wuertele wrote:
> > > 
> > > > I didn't realize the messenger service was handling this.  Or is it
> > > > that some security logic is only turning on the "respond to wildcard"
> > > > feature if it sees that the messenger service is running?
> > > > 
> > > > Dave
> > > 
> > > I'm pretty sure that's what happened.  Remember, SP2 was a compromise
> > > between better security (which would mean not listening at all) and not
> > > breaking applications people used.  While we may all find it
> > > frustrating, I'm sure winpopup is actually used in some organisations
> > > even in it's (frustrating) broadcast mode.
> > 
> > No, Winpopup is not in broadcast mode.  The names are all unique names and 
> > the protocol is something like a mailslot protocol (though it isn't...  I 
> > have some docs and some captures...).
> 
> I assure you, the winpopup wars I had on my network (before I disabled
> messenger service on all my machines) were broadcast UDP packets, as
> mailslot requests.  I almost got a program written to catch them, and
> record host addresses.
> 
> I hoped they were just unicast sessions to smbd, as then my 'beartrap'
> would have caught the bastards involved....
> 
> Andrew Bartlett
> 
> -- 
> Andrew Bartlett <abartlet at samba.org>



-- 
"Implementing CIFS - the Common Internet FileSystem" ISBN: 013047116X
Samba Team -- http://www.samba.org/     -)-----   Christopher R. Hertel
jCIFS Team -- http://jcifs.samba.org/   -)-----   ubiqx development, uninq.
ubiqx Team -- http://www.ubiqx.org/     -)-----   crh at ubiqx.mn.org
OnLineBook -- http://ubiqx.org/cifs/    -)-----   crh at ubiqx.org