North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: UDP port 137 Question
One interesting thing MS does is an extension of the resolver libraries. For example, if I do a netstat -a to show all the connections on my server, it will try and resolve the IP back to a name (reverse lookup via in-addr.arpa). However, the extension is: If it can't resolve it via DNS, it will attempt to look it up using NetBIOS name resolution lookups. If its a Windoze environment (95, NT), the client will return its host name. My guess on this one: Their hitting an NT webserver configured to log names, not IP addresses, in the log file and the client machines don't have IN-ADDR.ARPA entries. Two other thoughts: 1) Keep IN-ADDR.ARPA up to date 2) Microsoft Internet Information Server only logs IP addresses, not names given the historical slowness of reverse lookups and sloppy maintenance. I never understood why forward and reverse maps were decoupled in DNS, although I'm sure a good reason exists. Process Software Purveyor logs by name (or did) and I'm not sure about Netscape's servers now. My $0.02 Eric At 02:24 PM 1/7/98 +0000, Paul Thornton wrote: > >I noticed similar port 137 hits a while back, and after a bit of >investigating discovered that every time a colleague visited a web site >(using Netscape, incidentally) the server sent a port 137 request back to >the client PC. > >Initially I thought this was a "helpful" MS extension in their server, but >have since seen port 137 hits from their nameservers as well. This probably >points to some interesting name lookups going on at there end, which results >in a NetBIOS name lookup being sent back. Somewhere I have the address of >the server in question - I'll dig it out if there is interest. If nothing >else, their hit count will go up ;-) > >Paul > >-- >Paul Thornton, Network Engineer, London Internet Exchange Ltd. >Tel: 07000 783797 Mobile: +44 467 372205 > ============================================================================ ==== Eric Germann Computer and Communications Technologies [email protected] Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider
|