Windows Forum

Ask something
Discussion Locked

Annoying NetBios!

0 helpful
21 replies

by ebla

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
How could I send a message to an IP, which I have banned by means of my firewall because it is constantly attempting unsolicited access to my UDP 137 Port and S. Ports 1035 ? 1039 (NetBios name)? It is annoying! I have Windows 98 well updated, CableModem Broadband (LAN) and McAfee Firewall and VirusScan Online (Security Center). Moreover, is there some way to block NetBios without losing my Internet ability and features of LAN?s? Thanks from Chile, the Finis Terrae!

21 replies

by ebla

In an TechRepublic article related to my question I read: Block ports used for Windows shares at your network perimeter. Block the NetBIOS ports commonly used by Windows shares at your network perimeter using either your external router or perimeterfirewall. The ports that should be blocked are 137-139 TCP and 137-139 UDP, and 445 TCP and 445 UDP. HOW COULD I MATERIALIZE THIS ADVICE?

by ebla

Thanks for the link, but my interest is set starting my question: How could I send a message to an IP annoying me trying to sneak? Obviously I have everything blocked through the configuration of my firewall, but anyhow I would like to bark to the potential intruder. Kind regards. Ebla.

by joseph moore

Ok, DKlippert's answer was correct, in pointing you to GRC.COM.
GRC has an online port tester, to determine if NetBIOS is open on your system.

Now, if you want to know how to lock down a Windows computer, so it does NOT accept inbound NetBIOS connections on an Internet-facing adapter, then read this rant on GRC:
http://grc.com/su-bondage.htm
That article will explain about network bindings in Windows, and what you want to unbind and why. It then has two links at the bottom of the page, one for Win9x line, and the other for NT/2K/XP. Just take the appropriate link for instructions on how to stop your machine from accepting any NetBios talk on its Internet adapter.
Now, you can do this on your Internet-side adapter, but leave any other network cards alone. So that way, the Internet NIC does NOT accept inbound NetBios, but a 2nd NIC that is for your internal LAN only WILL take NetBios traffic (thereby allowing file sharing within your LAN).

Now, this could be all moot. You sayyou have a firewall. Why not configure the firewall to BLOCK all inbound NetBios traffic???

hope this helps

by joseph moore

And something else you can do is do a WHOIS lookup on the attacking IP address to see the ISP information. There will be contact information for the ISP that you can use to report this attacker.
A lot of ISPs list an abuse e-mail address that people like you can send e-mails about what and when the attacker IP address is doing against your server.
A tool I use to do WHOIS lookups is SamSpade. You can get it at www.samspade.org

hope this helps

by ebla

Thank you very much for your attention, but my interest is set starting my question: How could I send a message to an IP annoying me trying to sneak? Obviously I have everything blocked through the configuration of my firewall, but anyhow I would like to bark to the potential intruder. Kind regards. Ebla.

by ebla

My firewall configuration assures my safety but my ISP neither acts by its own nor allowd me to bark to the potential intruder (we are great for broadband in public LAN but still indians in regard of mutual respect). Therefore I insist in the start of my question: How could I send a message to an IP annoying me trying to sneak? Kindly, Ebla.

by joseph moore

Again, I will mention that you can do a WHOIS lookup on the attacker IP. In that information you can obtain is the ISP the attacker is using.
Most ISPs will list Technical contacts, which include names, postal addresses, and e-mail addresses.

For example, doing a WHOIS lookup on techrepublic.com gives you the following info:

Registrant:
CNET Networks, Inc. (TECHREPUBLIC5-DOM)
150 Chestnut Street
San Francisco
CA,94111
US

Domain Name: TECHREPUBLIC.COM

Administrative Contact:
Domain Contact, CNET Administrative (AD417) domain-admin@CNET.COM
CNET: The Computer Network
150 Chestnut Street
San Francisco, California 94105
US
(415) 364-8900
Technical Contact: System Administration, Network and (HC165) hostmaster@CNET.COM
CNET Networks
235 Second Street
San Francisco, CA 94105
US
(415) 344-2000

Record expires on 16-Jul-2006.
Record created on 16-Jul-2001.
Database last updated on 30-Oct-2002 16:30:21 EST.

by joseph moore

So, this info contains 2 e-mail addresses that could be used if an attack was recorded coming from a techrepublic.com machine.

You can do a search from this web site:
http://ww1.arin.net/whois/
Just plug the IP address of your attacker in the box, click Submit, and it will come back with info for the ISP that has that IP address assigned to them. From there, you can get contact info for the attacker's ISP.
And you can then contact the ISP.

Another way to get this info is to use the SamSpade tool, from www.samspade.org

by joseph moore

And if you still are having problems, just post the IP address of your attacker here. We can look it up for you.

by ebla

Dear J. More, you are grand trying to help me. Is there some way to do TO the intruder IP straightly the same that it is doing to me? Your links gave me just vague hint telling me that the half of the refered IP points to the range Latin America-Caribbean, what I obviously know by heart. Kind regards. Ebla.

by joseph moore

Hello again.
First off, yes, you "could" retaliate to the attacker IP. It is very easy to get tools that will scan the attacker IPs machine.
There are other tools that will attempt to connect to the attacker machine.
There are tools that will tryand flood the attacker machine with so much data, their system can crash.
There are tools to do a denial of service attack against the attacker.
There are tools for "hacking" the attacker system.

But I am not gonna tell you how. You don't want to go down these roads. You don't want to do that.

Since you have done the WHOIS lookups, you must have the ISP the attacker uses. Contact them now, and have THEM deal with the attacker. This is how it works. YOu don't attack THEM; you let their ISP deal with them.

I realize it is frustrating. For example, I have been online tonight for about 10 minutes. So far, my firewall has blocked 3 different connection attempts by people I don't know! This happens all the time.
You can report this to the attackers ISP. There are other places also. www.dshield.org is another place you can report these attacks to.

But don't become a cyber vigilante.

by ebla

Dear Joseph: before to go for advice to TechRepublic I had asked thousand times to my ISP to act properly against the intruder, but they "cannot" do anything. I know that I could report to the HacherWatch org. by my firewall service, but I guess it is more of the same. I give up for now. Thank you very much anyway. Kind regards from Ebla.

by joseph moore

I am not saying you should contact your ISP, because they really can't do anything.
I am saying, contact the ATTACKER'S ISP. That is why I have suggested you do the WHOIS lookups on the attackers IP address.
You must contact the attackers ISP. THEY are the ones who can help you.
Not your ISP.

Joe

by ebla

Sorry dear Joseph, the intruder's ISP is my ISP too. Kindly, Ebla.

This discussion is closed to new replies.