>
> The lookup is not DNS ("domain") but netbios-ns. I don't know what the
> resolve order is for netbios-ns.
>
Maby you can deny outgoing packages using a packet filter.
Just deny every outgoing netbios packages that wan't to walk the
internet.
This is a good thing anyway...
Take a look at ipchains for 2.2.x kernels or ipfwadm for 2.0.x kernels.
Ries