From: SMTP%"everhart@mail09.mitre.org" 23-JAN-1998 13:09:38.03 To: everhart@gce.com (everhart@gce.com) CC: Subj: FWD: FYI: netbios suffixes --===_tgate3_58699_96708975_=== Content-Type: text/plain; charset="us-ascii" ----- Forwarded message follows ----- Date: Thu, 22 Jan 98 21:05:32 -0500 Reply-To: Common Internet File System From: Paul Leach Subject: FYI: netbios suffixes To: FYI: Here's a list of NetBIOS name suffixes, most of which use 139 (some use NB datagrams, over 138). These are all the other protocols that a firewall admins would have to trust in order to be convinced to open up 139 to any host. This need not be a problem, if the firewall admin opens 139 only to servers that don't run any of these services. However, I'd bet quite a bit that if you started sending garbage over a NetBIOS session to all of these, for at least one of them you'd get a blue screen. > ---------- > --- > NetBIOS Suffixes (16th Character of the NetBIOS Name) > > Article ID: Q163409 > Creation Date: 10-FEB-1997 > Revision Date: 28-MAR-1997 > > The information in this article applies to: > > *Microsoft Windows NT Server versions 3.5, 3.51, 4.0 *Microsoft Windows NT > Workstation versions 3.5, 3.51, 4.0 > > > > > > SUMMARY > > > The NetBIOS naming convention allows for 16 characters in a NetBIOS name. > Microsoft, however, limits NetBIOS names to 15 characters and uses the > 16th character as a NetBIOS suffix. > > > > MORE INFORMATION > > > All NetBIOS names are 16 characters in length. A NetBIOS suffix is the > 16th character of the 16-character NetBIOS name. The NetBIOS suffix is > used by Microsoft Networking software to identify functionality installed > on the registered device. > > The following table lists the NetBIOS suffixes that are used by Microsoft > Windows NT. The suffixes are listed in hexadecimal format because many of > them are unprintable otherwise. > > > > Name Number(h) Type Usage > > > > 00 U Workstation Service > 01 U Messenger Service > <\\--__MSBROWSE__> 01 G Master Browser > 03 U Messenger Service > 06 U RAS Server Service > 1F U NetDDE Service > 20 U File Server Service > 21 U RAS Client Service > 22 U Microsoft Exchange Interchange(MSMail > Connector) > 23 U Microsoft Exchange Store > 24 U Microsoft Exchange Directory > 30 U Modem Sharing Server Service > 31 U Modem Sharing Client Service > 43 U SMS Administrators Remote Control > Tool > 44 U SMS Clients Remote Control > 45 U SMS Clients Remote Chat > 46 U SMS Clients Remote Transfer > 4C U DEC Pathworks TCPIP service on > Windows NT > 52 U DEC Pathworks TCPIP service on > Windows NT > 87 U Microsoft Exchange MTA > 6A U Microsoft Exchange IMC > BE U Network Monitor Agent > BF U Network Monitor Application > 03 U Messenger Service > 00 G Domain Name > 1B U Domain Master Browser > 1C G Domain Controllers > 1D U Master Browser > 1E G Browser Service Elections > 1C G IIS > 00 U IIS > [2B] U Lotus Notes Server Service > IRISMULTICAST [2F] G Lotus Notes > IRISNAMESERVER [33] G Lotus Notes > Forte_$ND800ZA [20] U DCA IrmaLan Gateway Server Service > > > > > NetBIOS name types describe the functionality of the registration. > > Unique (U): The name may have only one IP address assigned to it. On a > network device multiple occurrences of a single name may appear to be > registered. The suffix may be the only unique character in the name. > > Group (G): A normal group; the single name may exist with many IP > addresses. WINS responds to a name query on a group name with the limited > broadcast address (255.255.255.255). Because routers block the > transmission of these addresses, the Internet Group was designed to > service communications between subnets. > > Multihomed (M): The name is unique, but due to multiple network interfaces > on the same computer this configuration is necessary to permit the > registration. The maximum number of addresses is 25. > > Internet Group (I): This is a special configuration of the group name used > to manage Windows NT Domain names. > > Domain Name (D): New in Windows NT 4.0. > > For additional information, please see the following article in the > Microsoft Knowledge Base: > > > > ARTICLE-ID: Q119495 > TITLE : List of Names Registered with WINS Service > > ARTICLE-ID: Q154608 > TITLE : NETBIOS Node Status Query Returns First Instance of Unique > Name > > ARTICLE-ID: Q129603 > TITLE : Using Systems Management Server Remote Control over a RAS > Server > ---------------------------------------------------------------- Users Guide http://www.microsoft.com/sitebuilder/resource/mailfaq.asp contains important info including how to unsubscribe. Save time, search the archives at http://discuss.microsoft.com/archives/index.html ----- End of forwarded message ----- --===_tgate3_58699_96708975_===-- ================== RFC 822 Headers ================== Return-Path: everhart@mail09.mitre.org Received: by norlmn.gce.com (UCX X4.2-14, OpenVMS E7.1-1H1 Alpha); Fri, 23 Jan 1998 13:07:25 -0500 Received: from mbunix.mitre.org (mbunix.mitre.org [129.83.20.100]) by mercury.mv.net (8.8.8/mem-971025) with ESMTP id HAA04211 for ; Fri, 23 Jan 1998 07:32:29 -0500 (EST) Received: from TGATE3 (tgate3.mitre.org [129.83.20.27]) by mbunix.mitre.org (8.8.8/8.8.8/mitre.0) with ESMTP id HAA23993 for ; Fri, 23 Jan 1998 07:36:16 -0500 (EST) Received: from mail09.mitre.org (unverified [129.83.20.43]) by tgate3.mitre.org (EMWAC SMTPRS 0.83) with SMTP id ; Fri, 23 Jan 1998 07:35:49 -0500 Received: by mail09.mitre.org; (5.65v3.2/1.1.8.2/22Jun94-0628PM) id AA21568; Fri, 23 Jan 1998 07:35:45 -0500 Subject: FWD: FYI: netbios suffixes From: everhart@mail09.mitre.org (Glenn C. Everhart) To: everhart@gce.com (everhart@gce.com) Message-Id: <980123073544.31233@mail09.mitre.org.0> Date: Fri, 23 Jan 98 07:35:44 -0500 X-Mailer: MailWorks 2.0-4 Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===_tgate3_58699_96708975_==="