Well let's see first a bit of background - yes most common is broadcast but not specifically required to be such.
Broadcast. The computer will send out a broadcast to all computers on its local network to have the computer with the requested namesend back a confirmation with its IP address. B-node is the default node method for non-WINS clients.
Hybrid node. The computer will first query the WINS Server for the mapping, then if not successful, will use (up to) 3 b-node broadcasts. By inserting the IP address of the WINS Server in the computer's network properties, it defaults to H-node.
To alter which node your computer uses, you will need to make the proper changes in the DHCP Server. You will be prompted to give a value for thenode you wish to use.
Now most commonly the 56k would have "use DHCP" in the WINS tab of the dial up TCP/IP adaptor and nothing entered in the wins lookup value.
If however you have some local network setup or such where your controlling the DHCP then you would need to reset the node factor there. If the DHCP is from your ISP - which is most common then they would make the node change, or you might want to check with them about it.
The other way to reset things would be to uninstall and reinstall the dialup networking which would set it to the default B and then if it adjusts to H after connecting to the ISP then the control factor is coming from there.
I don't see a connection to a possible attack, but then that would depend on what you mean by alert and if it was outgoing or incoming generated.
Hope that helps
ps if you don't have a network running and your only connection is the 56k then you could also eliminate the netbios and ipx/spx protocols since they dontserve any purpose, tcp/ip is all you would need.
