Hello and welcome to the Wednesday, July 8th, 2006 edition of the Sands Internet Storm Center's Stormcast. My name is Johannes Ulrich,

recording today from Jacksonville, Florida. And this episode is brought you by the Sands.edu graduate certificate program in cloud security.

Well, in diaries today, I wrote up about yet another odd DNS record.

Yesterday, I talked about these N.A. pointer records.

Well, today it's NIMLock, which is something that I saw in my Sikh locks for quite a while,

but never really sort of, you know, rode up really what it's about. So definitely wanted to

take care of that. And this is, I don't know, it's not a mistake that Sikh makes you're calling

it Nimlock. It's actually

the correct way to label it. I would have probably labeled it as net bias. So what's going on here

is there is a DNS type of 32 and that type has been defined twice. It was originally defined for the good old net bias name lookups,

the port 137 lookups. Well, that protocol, of course, got sort of obsoleted and now it's no longer

being used. And then there was this other protocol Nimrod. It's sort of a routing

protocol. And well, that's also obsolete, but it's newer than the NetBies protocol and the

official IANA list of DNS type, types assigns Type 32 to NIMLOC.

So that's what SEAC is using,

even though what you're actually looking at,

if you're seeing these records,

is net bias traffic on Port 137.

And that sort of also distinguishes it

from the usual DNS traffic.

Seek still writes it to its DNS logs,

and that's why you may come across this record.

...