Snort mailing list archives
Re: NETBIOS NT NULL session
From: "Ian Macdonald" <secsnort () dirk demon co uk>
Date: Tue, 3 Sep 2002 09:50:51 -0400
NT Null sessions are something that is used by MS operating systems to get information about another server. It is a way to connect to a machine and not authenticate (Null) then gather information from the machine. You can use a null session to collect information about who is logged onto a machine, what domain they are part of and some other stuff. I think you can also make registry updates using Null sessions. You can restrict what information can be viewed by null sessions by setting restrictanoymous in the registry (doing a search on the web will bring up the exact location). If you completely disable null sessions things will break but by making this registry change you can limit the impact of the null sessions. Ian ----- Original Message ----- From: "Tony Wong" <tony.wong () stanford edu> To: <snort-users () lists sourceforge net> Sent: Wednesday, August 28, 2002 3:29 PM Subject: [Snort-users] NETBIOS NT NULL session
Why am I getting these alerts to my NT Fileserver? ------------------------------------------------------- This sf.net email is sponsored by: Jabber - The world's fastest growing real-time communications platform! Don't just IM. Build it in! http://www.jabber.com/osdn/xim _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- NETBIOS NT NULL session Tony Wong (Aug 28)
- Re: NETBIOS NT NULL session Ian Macdonald (Sep 03)