On Fri, 31 Mar 2000, Iljitsch van Beijnum wrote:
> On Fri, 31 Mar 2000, Fred Wright wrote:
>
> > > But the service on port 137 is *nbname*, so why would it be anything other
> > > than the netbios name??
>
> > The "service" is only meaningful as the *destination* port. What happens
> > here is that Windoze uses 137 as the *source* port. The destination port
> > is 53, since it's DNS.
>
> That only goes for TCP. Since this is UDP it is not just strange that a <
No, the philosophy of port numbering is pretty much the same for TCP and
UDP. In general, ephemeral ports are used on the client side, except for
certain symmetric protocols that use the same fixed port on both ends, and
oddball cases like BOOTP/DHCP (which uses two different fixed ports).
> 1024 port is used (it would be for TCP too) but also a problem: when a
> packet arrives at port 137 on the PC it can't readily tell if this is a
> reply to a request made _by_ the PC or a new request made _to_ the PC, due
> to the stateless nature of UDP.
Indeed. This is why you can't avoid timeouts without opening a small hole
in your firewall. However, I don't think this is too dangerous given
that:
1) It can be limited to ISP nameservers (in the absence if IP spoofing, at
least).
2) Samba is configured with "bind interfaces only", meaning that nmbd will
pay minimal attention to outside requests for port 137.
3) UDP's statelessness notwithstanding, NAT is stateful and won't forward
an incoming "request" to another machine unless there's a redirection
entry for it.
Fred Wright
--
To unsubscribe send "unsubscribe miami-talk-ml" to
"[EMAIL PROTECTED]". For help on list commands send "help" to
"[EMAIL PROTECTED]".
