NT Null Sessions 1

[SgtB]

Well, I put up a snort sensor on our switch that has all our servers. I started logging NT Null Sessions all over the place. These are mainly directed at our domain controllers connection to the IPC$ share. There are others however that are attempting to connect to other shares on servers, and some client machines.
My understanding of a NULL session would be the source does not give a hostname or password when trying to connect. Correct? Either way, what do you think this traffic would mean? Again, about 90% of these packets are directed at domain controllers going to the IPC$ share, while the other 10% are connecting to seemingly random shares on other machines.

I'll see your DMCA and raise you a First Amendment.

http://www.anti-dmca.org

 

[SgtB]

Nevermind...
DC to DC conversations happen over null sessions. Disabling them would cripple a domain. Client to client null sessions? Domain authentication/printing perhaps?
You can restrict anonymous (null) authentication through the registry.

Just thought I'd relay my findings!

Baselining IDS is no fun! Too many false positives!

I'll see your DMCA and raise you a First Amendment.

http://www.anti-dmca.org