Re: Disable netbios through registry

[chort <chort () amaunetsgothique com>]

On Fri, 2003-09-05 at 12:45, J. Oquendo wrote:
> http://www.petri.co.il/disable_netbios_in_w2kxp.htm
>
> Also check out the NSA's guide to securing W2K
> http://www.antioffline.com/deviation/w2000/
>
> -------------------
> Wonder if there is any way to disable netbios thru registry for Windows
> 2K/XP? especially ports 135 and 445. Thanks in advance for any inputs.
>
> regards,
> Keng Leng
> -------------------

I could be very wrong, but I believe that CIFS (SMB) on port 445 is
actually directly on top of TCP/IP, not NetBIOS.  The pre-Win2K
implementations of SMB relied on NetBT which required NetBIOS.

Port 135 is actually the DCE endpoint mapper for DCOM (MS RPC)
137 is NetBIOS Name Resolution
138 and 139 are NetBT traffic (datagram, and session respectively)
445 replaces NetBT with SMB (called CIFS now) directly on top of TCP/IP.

Again, I could be wrong, but that's my understanding.

To close port 135, disable the endpoint mapper.  To close 445 you would
have to unbind Microsoft File & Print sharing I think.

-- 
Brian Keefer


---------------------------------------------------------------------------
Captus Networks 
Are you prepared for the next Sobig & Blaster? 
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans 
 - Precisely Define and Implement Network Security 
 - Automatically Control P2P, IM and Spam Traffic 
FIND OUT NOW -  FREE Vulnerability Assessment Toolkit 
http://www.captusnetworks.com/ads/42.htm
----------------------------------------------------------------------------