0

I filtered captured packets like nbns, but NBNS packet format is confusing me.

Quoting Wireshark Wiki:

NetBIOS Name Service
    Transaction ID: 0xe17b
    Flags: 0x0110 (Name query)
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Name query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... ...1 .... = Broadcast: Broadcast packet
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 0
    Queries
        PSMTP.COM<00>: type NB, class IN
            Name: PSMTP.COM<00> (Workstation/Redirector)
            Type: NB
            Class: IN

What does type and class mean?

Is PSMTP.COM a NetBIOS-name? As it is not located in the same LAN as my PC, i think it is not. But if i filter NBNS packets as Source == *needed IP-adrress in the same LAN*, would this field in the packet be a NetBIOS-name?

1

You would need to check a bit more into it as Wireshark also presents you data from the other layers.

As for this the official RFC which is referenced from the WireShark Wiki probably has the information you want. Also the WireShark database for display filters for NetBIOS Name Service lists the flags themselves.

From the RFC:

 QUESTION_CLASS is defined as:
   Symbol      Value   Description:
   IN         0x0001   Internet class

 QUESTION_TYPE is defined as:
   Symbol      Value   Description:
   NB         0x0020   NetBIOS general Name Service Resource Record
   NBSTAT     0x0021   NetBIOS NODE STATUS Resource Record (See NODE
                       STATUS REQUEST)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.