Host Announcements

[FallenZer0]

Good Morning:

Let's say I've a group of computers, say Windows XP Professional and a Hub to connect them. I give all the PC's Static Private IP's. There are no DHCP, DNS, WINS or any other servers in my network. The Computer Browser Service is Enabled on all of them.

The Computer Browser Service: AFAIK, it's primary responsibility is to list up-to-date list of computers in a network. That's all I know.

My questions are:

1].Host Announcements. What are these? Where can I find the format/structure of how these announcements look? To whom these announcements are directed to?

2]. Who is providing me the list of up-to-date computers on my network?

3]. Let's say, I disable the computer browser service. Does it mean when I use My Network Places, I will not be able to get a list of up-to-date computers on my network?

Thankyou & Have A Great Day.

[phishphreek]

It really depends on how your network is setup. Are you just in a peer to peer environment? Or are you running a domain?

The computer browser service is used to keep track of the computers on the network.
This service is not necessary. It is sometimes useful so you can see the computers in the "network neighborhood". But you will be able to communicate with them just fine via tcp/ip, without netbios. Keep in mind that some programs and services rely on NETBIOS and disabling NETBIOS will cause certain programs to "break".

One computer is designated "Master Browser". In a domain enviornment, a domain controller will be the master browser. In a peer to peer environment, a XP or 2K box will normally be elected the master browser and it will mostly depend on which computer has been on the longest. However, sometimes I've seen a Windows 98 box be elected master broswser when it was on the longest. But most people have gone away from 98 so thats why I say 2K or XP. I don't beleive that a 95 box can become a master browser... but I'm not sure.

Some reading material for you:

http://www.windowsitlibrary.com/Content/155/05/3.html

http://www.microsoft.com/technet/pro.../ntbrowse.mspx

If you disable the Computer Browser in an environment and you are not running a dns server, you will not be able to lookup computers via NETBIOS. If you are in an environment with DNS it won't matter.

You can use this script to find the master browser in a peer to peer network.
http://techrepublic.com.com/5138-6240-728642.html

In a domain, use the tool "Browser Monitor". I beleive that it was only included with the NT 4.0 resource kit? Since in a 2K and Active Directory, your primary domain controller will be the master browser, but any domain contorller will hold info on the computers on the network.

If you were to disable the computer browser service and you still wanted to be able to communicate with them via host name, simply add the computer name and the ip address of that computer to the hosts file. If you were using DHCP, you could not do this because the addresses in the host file need to be static. The hosts file on 2K and XP is c:\winnt or windows\system32\drivers\etc

[FallenZer0]

Good Afternoon:

Thankyou phishphreek80 for 2 great links.

One of the link shows how to hide a computers resources by editing the Registry. Does that mean if someone uses the browser service they can still see my computer on the network?

Is it possible to stop Host Announcements going out to the Master Browser? Also, do you happen to know what is the time interval between the Host Announcements?

Thankyou For All Your Guidance.

[phishphreek]

If someone has the computer browser service enabled, then you can see their computer in the network browser. They won't be able to see computers that have this service shut off. However, its not hard to find PCs on a segment..

They can ping sweep the network using something like nmap or other freely available tools (you can even script it) and any machines that accept to ICMP echo/echo-reply will respond.

Or in some instances they can ping the broadcast address... if your network devices allow it.
If you have managed switches, you can block this... I think...
If you have a hub or unmanaged switch, I don't think you can block it.

Example:

C:\Documents and Settings\user>ping 192.168.1.255

Pinging 192.168.1.255 with 32 bytes of data:

Reply from 192.168.1.1: bytes=32 time=1ms TTL=255
Reply from 192.168.1.1: bytes=32 time=1ms TTL=255
Reply from 192.168.1.10: bytes=32 time=1ms TTL=60
Reply from 192.168.1.10: bytes=32 time=1ms TTL=60

Ping statistics for 192.168.1.255:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms

Not all devices will respond to a broadcast ping. In my example the devices that DID respond were a router (Cisco) and a network printer device (HP Jet Direct). My other hosts won't reply to broadcast pings. But I can still find them using a normal ping sweep, because I allow echo/echo-reply on my LAN but not over the WAN.

You said you are on a HUB, which by its nature will allow anyone to sniff any traffic going through it. As where a swich will only allow you to sniff traffic destined for the host running the sniffer. There are many ways to sniff through a switch too... so you still aren't safe using a switch.

You can stop host announcements going to the master browser by disabling the computer browser service.

Oh, as far as how often the browser requests a list of computers? I don't know. I've never really cared enough to find out. You can sniff your network and look for the broadcasts. They are fairly regular. But I'm not sure at which rate.

[FallenZer0]

Good Afternoon:

My Whole-Hearted *ThankYou* for taking your Time and Explaining about Computer Browser Services.

You are awesome. Have A Great Day.

[phishphreek]

You're welcome. I can't guarantee that I'm 100% correct... but that should be most of it.
I haven't looked into Computer Browser services for some time and I may have forgot some details.