2

In our local domain environment, we use Sophos UTM to protect our network.

When I check the firewall logs, I can see that a huge number of packets dropped by the firewall are netbios-ns (UDP 137) broadcasts. Checking for more details reveals that these blocked packets were all generated by one of DCs.

My questions are:

  • How to deal with this?

  • Why are all generated by only one of our DNS servers and not the other two (we have 3 DNS servers)?

I would really like to know if it is safe to disable NetBIOS as DNS is supposed to serve the purpose.

Improve this question
1
  • Thanks guys for the information. However, I still can't figure out why only one DC is generating an overwhelming number of the NBNS broadcasts? (I'd say over 90% of all the logged NBNS broadcasts in the network). The Netbios settings on all 3 servers are identical (set to default). We don't use DHCP in our network. Thanks
    – R. Blueryan
    May 12, 2016 at 1:52

3 Answers 3

Reset to default
2

Generally it is a good idea to disable bot NBNS and LLMNR. This is due to the fact that both protocols perform name resolution through either broadcast (NBNS) or multicast (LLMNR) which is not safe.

For an attacker its possible to perform a MitM Attack using spoofed answers. When you have WPAD disabled there is a wider attack surface. WPAD is the Web Proxy Autodiscovery Protocol which is used by Chrome and Internet Explorer to automaticly receive a Proxy configuration. This can be used to MitM all web based traffic from Chrome and Internet Explorer users. When it comes to the Internet Explorer there is a particular critial problem. The Internet Explorer will send your credentials via NTLMv2 to the attacker if the WPAD service he is providing is aking for it. There is a well implemented tool to perform these attacks which is called Responder.

In a modern environment you can disable both without facing any problems. When you have mac clients you should also disable MDNS which is apples equivalent of LLMNR.

Improve this answer
1
  • Hi, do you have references that helps understanding the relation why client making LLMNR makes server running NetBIOS-ns towards the Internet? what's the purpose?
    – moutonjr
    Aug 10, 2021 at 13:56
1

Probably to prevent NBNS-Spoofing. Anybody can answer NBNS requests and the requesting host will accept any answer. This enables MitM attacks. You're right that DNS provides the same service more securely and unless you have some legacy systems in your network, it should be safe to disable NetBIOS.

In the worst case, having NBNS enabled can lead to a domain administrator account being compromised by an unauthenticated attacker (if the account is used improperly and has a weak password - nothing that hasn't been heard of before).

I assume that unlike the other two DCs one of your DCs is configured to use NBNS on top of DNS. As far as I know, clients mimic the behavior of the DCs in this case by default.

Improve this answer
0

You do not need to deal with anything. The behavior is normal for a firewall.

Any decent firewall should have rules to implicitly deny NetBIOS towards the internet. Not doing that can result in situations like the well known Wannacry attack.

Regarding the DNS servers, one of them may have additional roles installed (like client update services) that may use NetBIOS, but it should do that only within your network.

Completely disabling NetBIOS may be considered only after you checked that every service you use in your network does not require it.

Improve this answer
1
  • Unfortunately this is not how Wannacry works, although it's using NetBIOS. What's important here is that the flow exists, not especially that they are dropped or not. For examle in Wannacry, detecting these NetBIOS flows in the firewall could indicate propagation.
    – moutonjr
    Aug 10, 2021 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .