NetBios and Net Send

4thhorseman · November 18th, 2009, 10:12 AM

Hi everybody,

I have a problem receiving Net Send messages.

I want to 'intercept' and message using NetBios API. Has anybody an idea how this can be done?

Greets

dparsons · November 18th, 2009, 11:05 AM

AFAIK there is no built in functionality in the framework to do this which means you are going to have to do a p/invoke to work with the actual Win32 API.

This site has most (all?) of the C# and VB.NET signatures necessary to do p/invoke with the Win32 apis
http://www.pinvoke.net/default.aspx/netapi32/

An example
http://www.csharphelp.com/archives2/archive440.html

hth
-Doug

4thhorseman · November 19th, 2009, 10:04 AM

Hi Doug,

thank you for your reply.

I know how to include the API but the API has 322 functions and I do not know the function that accepts or reads or does what so ever with net send message I want to catch.

Has anybody any idea? I found a functions called:

296 127 0000EDE4 NetpNetBiosReceive
297 128 00016370 NetpNetBiosReset
298 129 0000F56C NetpNetBiosSend

But I do not know what exactly they do. Has anybody ever used any of these functions?

dparsons · November 19th, 2009, 10:16 AM

To send messages you will need to import:
http://www.pinvoke.net/default.aspx/...sageBufferSend

To intercept, now that might be a bit tricky. AFAIK the ability to read incoming Net Send messages is handled by the Messenger Service. You could turn this service off and then write your own service that would monitor the Net Send ports and then do what you need to do from there.

hth
-Doug

4thhorseman · November 21st, 2009, 11:21 AM

Hey Doug,

thanks again for replying.

I read something about a HttpListener class written in C#. Can I assign a different port than 80? I am thinking about the messanger port which is about 135.

dparsons · November 23rd, 2009, 09:19 AM

Unless you are doing something Web Based I would not use an HTTP Listener. Before we go any further let me ask you some questions:

-When you say "intercept" do you mean you are trying to read all NETSend messages going over a network or just the ones coming to your machine?

-Do you have Admin access to the machine that you want to read NetSend messages from?

4thhorseman · November 23rd, 2009, 01:57 PM

I want to read a net send message from only one other computer in the same network.

Yes I have administrator rights on the machine.

dparsons · November 23rd, 2009, 02:02 PM

Sounds like you need to look into using Sockets. This link should help you: http://www.switchonthecode.com/tutor...ded-tcp-server

hth.
-Doug

4thhorseman · November 23rd, 2009, 02:45 PM

I read about sockets, but I believe that using a socket-server needs a socket client to connect to.

I cannot write a client socket app on the machine that sends the net send message.

dparsons · November 23rd, 2009, 02:53 PM

I could be wrong, but I am pretty sure if you bind a TCP Listener to the port you are interested in you could get a handle on the Network Stream coming across the port on the target machine.

-hth.
Doug