Netbios

I have a question, What is NETBIOS? I bought Zone Alarm Pro, and it's been saying that it has blocked a NETBIOS name from accessing my computer. It's been Happening quite frequently, like once every ten or so minutes. My uncle is teaching me stuff about security, and he said it's someone trying to hack my computer, but i thought i'd ask the wonderful people of AntiOnline :) Does it mean that someone is trying to access my hd or could it be someone just using an ip scanner? any help(info) would be much appreciated.

I found some basic information for you Hayn on netBIOS. You can check out some of these links to see what helps you the most.

Basic Info about netBIOS (definition/what it is)
More basic info on netBIOS
A more in-depth and technical overview of netBIOS
some fact and fiction about netBIOS

Hope these help. good luck.

Most likely is someone trying to access your hd, from what your firewall tells. But always block this port and U don't have to worry.

do a google > netbios basics or check the above mention links given by shagdevil

thankz ShagDevil, that helped a little. and phaza...i would block the port, but i have all the computers in my house on a network....(my uncle says it's needed for that)....is there any real risk of anything dangerous happening?...cuz just recently one of my computers desktops was defaced by someone using the handle "blue cipher." and that was while i had zone alarm running.....pleez continue to help....thank you very much.

You can set a password option on your NetBios. Anyone wanting to enter your computer will be prompted to enter a password. And one more thing, if you are using Win98,ME, then better update you system using Windows Update because there exists a vernablity with the password option.

I am getting frequent attempts to connect to NetBIOS too as are many people. I put a lot of it down to the virii out lately that try and spread via Windows shares

one example Bugbear-A

as long as these are being blocked I wouldn't get too worried, you could always disable NetBIOS over TCP/IP if you do not need to share files to Pre Windows 2000 hosts depending which OS you are running (think I am right in saying that, anyone feel free to correct me if I am wrong :) )

hope this is of some help

considering you have all of your computers (however many you have) all on a network that obviously has netBIOS sharing enabled for the purposes of sharing files on your LAN, the netBIOS accesses that your firewall is picking up could just be internal comm's between your computers that are networked

so long as you have netbios disabled in your actual internet connection, dialup, cable whatever youre using you should be ok, but if this computer is the one connected to the net keep the firewall on it

ive never used zonealarm firewall before but i have tiny personal on my box and i think there would be a way to block netBIOS on just the device that connects you to the WWW but still allow your LAN traffic through alright, a really great idea would be to have a linux box setup as a gateway with ipchains or something similar acting as a firewall to keep your LAN and the internet seperate, only drawback is if youre new to linux setting it up can be very painful

thanx guys/gurls...just fyi....i'm running windows 2000 Professional on 3 of my computers and windows 2000 Server on one of them. My uncle says that they are all connected to the server one. is it possible to network windows computers through a linux one??? cuz i don't really know anything about linux. oh yeah and all the computers are connected to the internet through roadrunner. What can i do to help secure my computers? should i find a more secure way of connecting them to my network? and if it is recomended to find another way, what should i do? thanx for the help, and keep up the good work!!! :D

You dont have to use port 139 for NetBios at all. Just change the port to use. This way it's more unlikely that hacking attempts will be made on your computer.

The reason being that most probably your ports were scanned using a port scanner and setting were set to find 139 ,FTP and telnet servers(i know i do) as hese are the best ways to start hacking.

Anyway, just change your port settings for NetBios.

Linux would be the way to go (as always is) because you wouldn't have to use netbios.

so XliMun....your telling me that you gain illegal acces to other people's computers(wich i assume is what you mean by hacking)? thanx for the help but don't break into any computer that is not your's or that you do not have permission to get into. While it may be fun... it is still illegal so don't do it. Just a word of advice ;)

*cough cough*

When did i say that i "break into" computers or that i claim to be a "hacker"?!

Yes, i did mention that i occasionally scan ranges for ports such as netbios, but i wouldn't consider that to be hacking by any stretch of the imagination!!, it is entirely LEGAL to do so. (even if they are indeed sharing files).

I don't know why you are accusing me of being a hacker. If i were i'd be more concerned with things like writing scripts (notice the WRITING scripts, i'm not a skiddie). ; )

so, um, yeah, iv'e lost interest.............

Well as the port 139 came in the discussion.Then if anyone connects to your 139 port then he can just blow up ur computer.Actually through port 139 one can directly access to ur processor and memory . Once anybody connected to ur 139 port he will just type a string of characters and that will use 100% memory of ur system and the system will reboot in 30 seconds.So my suggestion is u just close ur 139 port and if open be careful.

Quote:

---

"Well as the port 139 came in the discussion.Then if anyone connects to your 139 port then he can just blow up ur computer.Actually through port 139 one can directly access to ur processor and memory . Once anybody connected to ur 139 port he will just type a string of characters and that will use 100% memory of ur system and the system will reboot in 30 seconds.So my suggestion is u just close ur 139 port and if open be careful."

---

HUH??? How about some support on what you are atallking about here because I have NEVER heard of such a claim to be able to access memory, processor on 139... I know you can remote boot someone with the proper access. but... Have you watched hackers one too many times?
:rolleyes:

Quote:

---

Originally posted here by the_twister
Well as the port 139 came in the discussion.Then if anyone connects to your 139 port then he can just blow up ur computer.Actually through port 139 one can directly access to ur processor and memory . Once anybody connected to ur 139 port he will just type a string of characters and that will use 100% memory of ur system and the system will reboot in 30 seconds.So my suggestion is u just close ur 139 port and if open be careful.

---

Yea, I'd be interested in hearing how that one worked as well...

NetBIOS is probably the most easy way to 'hack' a machine - although I really don't think that gaining access through open shares is hacking at all, it's really just taking advantage of misconfigured machine setups.

Hey haynboi , tell you what it sounds that your Network Topology looks like many small companies's
=> A private Network (Where you required Netbios for Network Neighborhood facilities and other M$ win stuff...)
=> And something similar of what is called DMZ (A DMZ could be a Firewall on its own!).

I'll advice you to have a quick googling about DMZ and you should be able to build your network architecture on your own.
this url may help

http://nsupport.elronsoftware.com/su...1?OpenDocument

Provided you dedicated a hw (pc or whatever) I will advice you to use it as firewall and disabled every single ports and then open one by one those required for your external to DMZ flows.