WINS isn't working correctly and I think somebody is trying to exploit a security hole...

[Erik Corry]

Jeff Wiegley <jeff at la.usweb.com> wrote:
> 
> Things seemed to be working up until a couple of days ago and then things
> started getting screwy. It seemed like our servers were no longer providing
> WINS resolutions and we thought this might be because one of our employees
> accidentally setup a WINS server which was winning master elections and thus
> our real servers weren't.  What I found when looking at log.nmb is something
> more scary possibly.  It looks as though somebody outside of our networks
> is attempting to be the domain master.

I would guess that someone has put a machine on your net that
is incorrectly set up with the address you are seeing in the 
log files. Since the broadcast addresses are set up wrong,
communication is going to be difficult between this machine
and the others, and it might think it is master browser because
all the Samba machines missed the election that went on over
the wrong addresses.

Another possibility is netbeui-only machines. I have had some
trouble with these. Because they don't understand TCP/IP they
can't see the Samba master browser, so they start elections,
which are usually won by some NT or W95 machine that understands
both Netbeui and TCP/IP. Great confusion occurs. This is an
especially common problem if you are using the WORKGROUP workgroup
because then an unconfigured W95 machine will cause the problem.

-- 
Erik Corry