[Snort-users] NETBIOS NT NULL session

Ian Macdonald secsnort at ...5528...
Tue Sep 3 06:52:02 EDT 2002


NT Null sessions are something that is used by MS operating systems to get
information about another server. It is a way to connect to a machine and
not authenticate (Null) then gather information from the machine. You can
use a null session to collect information about who is logged onto a
machine, what domain they are part of and some other stuff. I think you can
also make registry updates using Null sessions. You can restrict what
information can be viewed by null sessions by setting restrictanoymous in
the registry (doing a search on the web will bring up the exact location).
If you completely disable null sessions things will break but by making this
registry change you can limit the impact of the null sessions.

Ian
----- Original Message -----
From: "Tony Wong" <tony.wong at ...5535...>
To: <snort-users at lists.sourceforge.net>
Sent: Wednesday, August 28, 2002 3:29 PM
Subject: [Snort-users] NETBIOS NT NULL session


> Why am I getting these alerts to my NT Fileserver?
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by: Jabber - The world's fastest growing
> real-time communications platform! Don't just IM. Build it in!
> http://www.jabber.com/osdn/xim
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>





More information about the Snort-users mailing list