University of Minnesota <Previous] [Home] [Next>



CIFS Security Issues

Open Border Policy

At the border, we drop:

  • Unrouted IP addresses
  • Outgoing packets with an outside source address
  • Incoming packets with an inside source address
  • Stupid ports (echo, chargen, etc.)
  • SunRPC
  • IPX/SPX, AppleTalk, NFS
  • NetBIOS (137, 138, 139)

At internal borders, we drop:

  • Directed broadcasts
  • Source routed packets
 
Of the NetBIOS packets dropped at the border, 99% are UDP/137.

Holes are punched in the filter when specifically requested.


In addition to providing an overview of our border policy, this slide points out an interesting thing about the IP implementation on (some?) Windows systems. When doing a reverse DNS lookup (IP address to name), these systems will first send an NetBIOS query to the IP address. This behavior suggests that the implementors were working under the assumption that the systems would be deployed on small, stable, local LANs.