Internet Accessible NetBIOS Name Services (2024)

NetBIOS-over-TCP/IP (NBT) implements all of these services.

NetBIOS names are used to identify network devices over TCP/IP (Windows). The name must be a unique on a network, limited to 16 characters where 15 characters are used for the device name and the 16th character is reserved for identifying the type of service running or name record type. Short names are automatically and transparently padded to 16 characters.

NetBIOS-over-TCP/IP (NBT) can implement a central repository, or Name Service, that records all name registrations. An application that wants to register a name would contact the name server and enquire whether the name is already registered, using a "Name Query" packet. The name server returns a negative response if the name is not already in the database, indicating that it is available. The Name Service, as specified in RFCs 1001 and 1002, is called NetBIOS Naming Service or NBNS. Microsoft WINDS is an implementation of NBNS.

To start a session or to send a datagram to a particular host rather than to broadcast the datagram, NBT will have to determine the IP address of the host with a given NetBIOS name, this is done by broadcasting a "Name Query" packet, and /or sending it to the NetBIOS name server. The response will have the IP address of the host with that name.

The packet formats of the Name Service are identical to DNS. The key differences are the addition of NetBIOS "Node Status" query, dynamic registration and conflict marking packets. They are encapsulated in UDP.

Datagram mode is "connectionless". NetBIOS datagrams are sent over UDP. A datagram is sent with a "Direct Unique" or "Direct Group" packet if it's being sent to a particular NetBIOS name, or a "Broadcast" packet if it's being sent to all NetBIOS names on the network.

Session mode lets two computers establish a connection for a "conversation", thus allowing larger messages to be handled, and provides error detection and recovery. Sessions are established by exchanging packets. The computer establishing the session attempts to make a connection to port 139/TCP on the computer with which the session is to be established. If the connection is made, the computer establishing the session then sends a "Session Request" packet with the NetBIOS names of the application establishing the session and the NetBIOS name to which the session is to be established, over the connection. The computer with which the session is to be established will respond with a "Positive Session Response" indicating that a session can be established or a "Negative Session Response" indicating that no session can be established. Data is transmitted during an established session by Session Message packets.

TCP handles flow control and retransmission of all session service packets, and the dividing of the data stream over which the packets are transmitted into IP datagrams small enough to fit in link-layer packets. Sessions are closed by closing the TCP connection.

The Server Message Block (SMB) is the transport protocol used by Windows for a variety of purposes, such as file sharing, printer sharing and access to remote Windows services. Older versions of SMB uses port 139/UDP to communicate over NetBIOS. Newer versions of SMB use port 445/TCP, Using TCP allows SMB to communicate over the internet. In May 2017, the WannaCry ransomware cryptoworm used SMB version 1 and port 445/TCP to propagate.

Verification

To establish if a host has an Internet accessible service, simple utility programs or tools included with the standard Linux/Ubuntu distribution can be utilised. The test should not be run on the host itself or from the local network, instead it should be run from a different node on the Internet.

nmblookup - (used to lookup NetBIOS names)

To confirm an Internet accessible NetBIOS service, the 'nmblockup' program can be utilised.

The program is used to query NetBIOS names and map them to IP addresses in a network using NetBIOS over TCP/IP queries. The options allow the name queries to be directed at a particular IP broadcast area or to a particular machine. All queries are done over UDP.

Insert the IP address of the host you wish to check for an Internet accessible NetBIOS service when invoking the 'nmblockup' program together with the options as included in the following example.

$ nmblookup -A xxx.xxx.xxx.xxx

An Internet accessible NetBIOS service will return information similar to that as shown below:

$ nmblookup -A xxx.xxx.xxx.xxx

Looking up status of xxx.xxx.xxx.xxx

WIN-0AQG7FLQSLB<00> - B <ACTIVE>

WORKGROUP<00> - <GROUP>B <ACTIVE>

WIN-QAQG7FLQSLB<20> - B <ACTIVE>

MAC Address = 48-DF-57-01-2A-2D

Options

-A :Interpret name as an IP address and do a node status query on this address.

Otherwise, nmblookup will timeout:

Look up status of xxx.xxx.xxx.xxx.
No reply from xxx.xxx.xxx.xxx

Solution

If the NetBIOS-over-TCP/IP service is not required, disable it or deinstall it.

If the NetBIOS-over-TCP/IP service is required, restrict access to trusted clients or specific IP addresses.

For security reasons, consideration should be given to blocking access to the follow ports on the firewall:-