From: "RB" <NoMail@NoSpam>
>> However, you are looking in the wrong place.
| Oh why the heck did they stick it up there for, that seems odd to me
| given all of those menus are usually explorer generic.
| Anyhow thank you !
| I am not so much still sold on trying to use Netbeui (which appears to be an earlier
| version of Netbios) but I still have been unable to get key information to help me
| in my decision. Two things specifically,
| 1. The poster Jack (MS, MVP-Networking) wrote
| { If you are worried that is a good idea.
| Adding NetBEUI as Sharing Protocol in WinXP:
|
http://www.ezlan.net/netbeui.html
| }
| I replied to him but he never answered. Did I misunderstand him or is he saying
| he things netbuei is a good thing still ?
| 2. Ok say I keep netbios and I disable the ports you guys told me about .
| I am concerned that if I disable them it will intefere with apps that might be
| using these ports. I did a search for a way to find out who is using what and
| I got the following results from netsat. I cut out all but the 3 ports spoke of.
| So what is going to happen with these apps if I block these ports ?
| ----------------------------------------------------
| netstats -a /b -n
| returned this
| Active Connections
| Proto Local Address Foreign Address State PID
| TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1368
| c:\windows\system32\WS2_32.dll
| C:\WINDOWS\system32\RPCRT4.dll
| c:\windows\system32\rpcss.dll
| C:\WINDOWS\system32\svchost.exe
| C:\WINDOWS\system32\ADVAPI32.dll
| [svchost.exe]
| TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
| [System]
| TCP [::]:135 [::]:0 LISTENING 1368
| -- unknown component(s) --
| toside.sys
| -- unknown component(s) --
| [svchost.exe]
| UDP 0.0.0.0:445 *:* 4
| [System]
| UDP 192.168.1.2:138 *:* 4
| [System]
| ============ALSO===
| Another question when I look in the ADVANCED->bindings that you just showed
| me how to view, I don't see any Netbios listed when I do have it Enabled in my TCP
| properties ? What is up with that ?
| And what is up with the MS TCP/IP ver 6 ? I have that in addition to the Internet
| TCP/IP ?
The fist 1024 TCP and UDP ports are the oldest and most standardized protocols. TCP/UDP
ports 135 ~ 139 and 445 are completely safe to blockon any FireWall Appliance and NAT
Routers. Blocking them will only enhance your security. Having them blocked will not
block some unknow application or content.
The LAN side of the NAT Router you have is your enclave. You can safely have all network
protocols at their default and move the security from each PC to that of the perimeter.
Blocking TCP/UDP ports 135 ~ 139 and 445 on the LAN/WAN barrier means you SOHO LAN is
safer on the Internet and all nodes on the LAN side can communicate fully without protocol
settng hinderence.
There are two levels of concern on your LAN side
wired
wireless
Unless somone has physical access to your CAT-5 Ethernet LAN, no one is going to be
tapping your LAN through the Ethernet topolgy.
Wireless is different. You have to take further steps. Like I mentioned,
* Use a strong PreShared authentication key
* WPA2
* USE AES encryption
* Choice to use MAC Authentication (You tell the Router what MAC addresses can use
WireLess and then thy are the only MAC addreses that can use WiFi on your SOHO LAN)
Then the Wireles has been secured as best you could.
Once you have done that, there is NO NEED to fuss with "NetBIOS over IP" for any nodes on
the LAN side.
To further enhance your security I suggested,
* Disable all remote management protocols to the Router
* Disable WAN ICMP and UDP traceroute capabilities.
BTW: Some advocate blocking TCP port 4567
http://en.wikipedia.org/wiki/TR-069
I block it on my FiOS Router.
--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV -
http://www.pctipp.ch/downloads/dl/35905.asp