University of Minnesota <Previous] [Home] [Next>



CIFS at the U

CIFS Management

There is almost no central management of CIFS networking at the UofM.
  • We started blocking NBT service ports in August, 1998.
  • We have a central NetBIOS name server, but it's not very popular (esp. since we started blocking UDP/137).
  • Directed broadcasts are disabled on all routers to prevent smurf behavior. As a side effect, it is no longer easy to harvest NetBIOS names.

ULAs are free to set up their own NT domains, servers, NetBIOS names, etc.


During the presentation I was asked how blocking NBT at the border could prevent Back Orifice installation. The correct answer to the question is that desktop systems are, in general, less likely to be managed by trained adminstrators. The University's Network Security Architect was concerned about the ease of installing Back Orifice (and the like) on unprotected SMB shares.

Using a tool such as nmblookup (provided with Samba) you can send NetBIOS queries to entire broadcast subnets. The replies will tell you which IP addresses are running NetBIOS over TCP. You can then harvest NetBIOS names by sending Adapter Status queries.