Re: Match specific netbios flag?

[Jorge Davila <davila@nicaraguaopensource.com>]

May you must try something different instead of iptables.

For loggin the connection/disconnection is enough the configuration of the 
loggin in the smb configuration file.

If you really want monitoring may you want use Nagios.

Hope this help,

Jorge Dávila.

On Thu, 17 May 2007 07:00:58 +0800
  "k bah" <kbah@linuxmail.org> wrote:
> 
> Hi,
> 
> I'm using kernel 2.6.17, iptables 1.3.5.
> 
> Is there a way to match specific netbios ns flags? I did not find any on 
>the iptables man page.
> 
> I'm trying to log it like this:
> 
> -A INPUT -s 10.1.1.15 -i eth1 -p udp -m string --string "elease" --algo bm 
>--to 65535 -j LOG --log-prefix "received release from 015"
> 
> where 10.1.1.1 is the machine with iptables, the internal net router. 
>10.1.1.15 is Windows XP.
> 
> I would like to match it with a flag, not a string, to be more secure 
>(netbios ns flag 0x3010)
> 
> the packet captured with wireshark is:
> -------------
> ...
> 11164 11877.336283 10.1.1.15              10.1.1.255            NBNS 
>    Release NB HT015<20>
> ...
> NetBIOS Name Service
>    Transaction ID: 0x808f
>    Flags: 0x3010 (Release)
>        0... .... .... .... = Response: Message is a query
>        .011 0... .... .... = Opcode: Release (6)
>        .... ..0. .... .... = Truncated: Message is not truncated
>        .... ...0 .... .... = Recursion desired: Don't do query recursively
>        .... .... ...1 .... = Broadcast: Broadcast packet
>    Questions: 1
>    Answer RRs: 0
>    Authority RRs: 0
>    Additional RRs: 1
>    Queries
>        HT015<20>: type NB, class IN
>            Name: HT015<20> (Server service)
>            Type: NB
>            Class: IN
>    Additional records
>        HT015<20>: type NB, class IN
>            Name: HT015<20> (Server service)
>            Type: NB
>            Class: IN
>            Time to live: 0 time
>            Data length: 6
>            Flags: 0x0 (B-node, unique)
>                0... .... .... .... = Unique name
>                .00. .... .... .... = B-node
>            Addr: 10.1.1.15
> -------------
> 
> I want to know when that host went offline by turning the computer off, or 
>because of some physical failure, as a broken cable, or disconnected cable 
>on the switch.
> 
> thanks,
> 
> kbah
> 
> =
> ERP - Accounting Software, SQL Edition
> SQL, fully customizable free SDK.
> http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=ea7c49bd3fe7f7a95586c9ff6c085471
> 
> 
> -- 
> Powered by Outblaze
> 
> 

Jorge Isaac Davila Lopez
Nicaragua Open Source
davila@nicaraguaopensource.com