Aside from giving us something to use as a safe anchor for the usually-unneeded Microsoft Networking components, NetBEUI has the additional advantage of supporting the evolution of your system by providing safe local file and printer sharing at any time in the future. And, if you are already running a local network of computers you will gain immediate benefit from the use of the safe NetBEUI transport.

ALSO . . . The sample screen shots shown on this page will probably be different from what you see on your computer. They are intended only to help keep you synchronized with the instructions. You should NEVER install anything other than the NetBEUI transport protocol as explained below. If your system is operating without some of the services shown in my sample screen shots, you should consider yourself fortunate for getting by with less junk loaded! 

A Special Note for Network Gamers Many real-time local area network based games pre-date the Internet's IP protocol and have traditionally required the use of the IPX/SPX transport for inter-game communication. If you are currently using networked games over the IPX/SPX transport, or if you plan to in the future, you can — and probably should — substitute the IPX/SPX protocol for NetBEUI throughout this entire discussion. You will need IPX/SPX for your gaming and it can be seamlessly substituted for NetBEUI with little impact to your system's security.

Install the NetBEUI Protocol

To open the Network configuration dialog box. . . First open the Windows Control Panel (from the Start button choose "Settings" then "Control Panel"). Then open the Network configuration dialog box by double clicking on the Control Panel's "Network" icon (see the icon above/left). You should be presented with the following dialog box (the exact contents will differ):

With the Network dialog box open, scroll through the installed component listing (similar to what's shown above) to see whether your system already contains the NetBEUI transport. You'll see one or more lines starting with the transport icon and word "NetBEUI" as shown at the upper left of this paragraph.

Installing the NetBEUI Transport

Installing a protocol that's new to Windows will require copying some files from the master Windows CAB files. These may have been copied onto your system's hard drive (usually underneath the c:\windows directory), or they might only be located on your original Windows 9x CD-ROM. Since you've probably installed other software that resulted in a dialog box saying "Windows needs to copy some files ..." you probably know the drill. So, you'll need to do whatever you normally do to have this eventuality.

Begin by opening the Windows Networking configuration dialog box if it's not still open. (See the inset box above for details.)

With the Network properties dialog box open . . .
	Click the "Add ..." button just below the list of installed network components. This will present the following Network Component Type selection dialog box:
	Click the "Protocol" type once with the mouse to select it, then click that dialog's "Add..." button to the right. This will display the following Network Protocol selection dialog box:
	Click "Microsoft" on the left to select among the available Microsoft provided protocols, then scroll the list on the right down until the line with "NetBEUI" (as shown above) appears and click on it once to select it.
	Click the "OK" button at the bottom of this dialog to confirm your choice and dismiss this dialog box. (Note: It's better not to dismiss the main Network dialog box until we're finished since it will require a time-consuming reboot of Windows.)

Set Your Hardware Adapter Bindings After making sure that we have NetBEUI available to serve as our "unwanted services anchor" we're ready to establish the system's network component bindings.

Returning to the list of installed network components, scroll to the top and identify your system's installed hardware adapters. Each adapter is identified by a circuit-board like icon and name as depicted in the image to the left. Your particular adapters will probably differ from those shown. Dial-Up Networking users may only have a "Dial-Up Adapter" whereas Cable Modem and DSL users may only have a single entry for their "NIC" (Network Interface Card).

Changing Each Adapter's Bindings

Each adapter's transport bindings can be viewed and edited by clicking once on the adapter's name in the networking components list, then clicking the "Properties" button just below the list (or you can just double-click on the adapter name).

This will display the adapter properties dialog box. If the "bindings" tab is not currently in front, click the "bindings" tab once to bring it to the front:

The bindings list will contain one entry for each protocol currently installed in your system. You should at least find entries for the NetBEUI and TCP/IP protocols since TCP/IP is required to use the Internet (which you're using right now!) and you will have just installed the NetBEUI protocol if it wasn't already installed. Many systems also have IPX/SPX installed (for no reason).

One way to visualize this is to refer to the binding diagram below and imagine that each adapter is "looking up" to see the array of protocols which are available to it on the level just above. All available protocols are shown in the "Bindings" list for each adapter. The "checkmarks" at the beginning of each line show to which of the protocols this chosen adapter is currently bound.

As you'd expect, the adapter can be bound and unbound to and from each respective transport by clicking in the checkbox to toggle the checkmark on and off.

Establishing Optimal Adapter Bindings

Referring again to this network bindings diagram:

	Bind the TCP/IP transport only to adapter(s) that connect to the Internet. This is not strictly necessary, since there's really no harm in leaving TCP/IP bound to all hardware adapters (if you have more than one), but there's also no good reason to have your system cluttered with unnecessary bindings. NetBEUI — which was designed for local area networking — much more elegantly handles all local area networking needs with absolutely NO configuration. TCP/IP — which was designed for global networking — requires significant configuration.
	Bind the NetBEUI transport only to adapters that will be used for local area networking, if any. To keep NetBEUI from disappearing due to the Windows 9x network configuration bug, it must always be anchored to at least one adapter. So, if your system only has a single network adapter be sure to bind NetBEUI to it. But if you have a choice of adapters and one or more are not used to connect to the Internet, you can bind NetBEUI to those and unbind it from any others.
	Unbind all other unneeded network transports (like IPX/SPX in the example above) from ALL network adapters. This will release the unneeded and unused transports along with any services which are bound only to them.

Here are some example scenarios to demonstrate the application of these guidelines:

 Users who connect to the Internet through a Dial-Up Adapter, and who do not also have a local area networking adapter will simply want to leave TCP/IP and NetBEUI bound to their Dial-Up adapter while unbinding anything else (like the IPX/SPX transport protocol.)

 Users who connect to the Internet through a Cable Modem or DSL connection will have a Network Adapter of some sort installed. This adapter should be bound to TCP/IP and NetBEUI and unbound from anything else (like the IPX/SPX transport protocol.) If the system also has a Dial-Up Adapter it can be unbound from the NetBEUI transport since the network interface card will serve as NetBEUI's anchor.

 Users with local area networks who want all of their machines to have access to the Internet should bind TCP/IP and NetBEUI to their network adapters and unbind anything else. And within that network, machines which do not need (or should not have) Internet access (such as, perhaps, a young child's computer) should only have NetBEUI bound to the network interface since that machine would have no need for the Internet's TCP/IP transport.

Set Your Network Transport Bindings With the hardware adapter bindings optimized, we're ready to move up to the next level. Here we'll establish the optimum bindings between each network transport protocol and the network services above them ...

Changing Each Protocol's Bindings

As with adapter bindings, the bindings for each transport protocol (or transport/adapter pair) can be viewed and edited by clicking once on the protocol's name in the networking components list, then clicking the "Properties" button just below the list (or you can just double-click on the adapter name).

This will display the transport protocol properties dialog box. If the "bindings" tab is not currently in front, click the "bindings" tab once to bring it to the front:

TCP/IP Dial-Up Information: When the TCP/IP Properties dialog box for a Dial-Up Adapter is opened, an information dialog box may appear explaining that you may want to be editing the TCP/IP properties for a particular dial-up connection, rather than these properties which will apply to all dial-up connections. Network service bindings can not be set on an individual dial-up connection basis. Therefore, we do want to be editing these. Dismiss the dialog by pressing "OK", then proceed. . .

As when we edited the hardware adapter bindings, "Checkmarks" at the beginning of each line show to which of the system services this chosen transport protocol (or protocol/adapter pairing) is currently bound. And, of course, the service may be bound and unbound by clicking the checkbox to toggle the checkmark on and off.

Establishing Optimal Protocol Bindings

Referring again to our very familiar network bindings diagram:

	Unbind ALL network services from EVERY instance of the TCP/IP protocol! This is the THE SINGLE MOST IMPORTANT INSTRUCTION on this entire website! If you do NOTHING ELSE, examine every line beginning with "TCP/IP" and remove all of the checkmarks from the services listed on the bindings tab! (Note that when you click "OK" after unbinding everything, Windows will think you're nuts and will warn you that you "have not selected any drivers to bind with." Just click "NO" to proceed.) After a reboot, the information-leaking port 139 will finally be closed . . . but ONLY IF every service is unbound from every instance of the TCP/IP protocol. If ANY one of the services remains bound to ANY instance of the TCP/IP protocol (i.e. TCP/IP for ANY adapter), then unsafe NetBIOS services will be available for ALL hardware adapters! The one unfortunate exception to this advice applies to a FEW users of the @Home network! Some unfortunate @Home users may find that they are unable to reconnect to the Internet without the presence of Microsoft's NetBIOS. A handful of @Home's DHCP servers actually depend upon the customer's NetBIOS name leakage in order to identify the customer on their network! This is NOT true for most @Home users, but it is for some. Since the Client for Microsoft Networks can be easily "rebound" to the TCP/IP transport used by your @Home LAN adapter, my advice is for all @Home users to first follow this advice to unbind everything. If you find that you're cut off from your network do two things: 1. Rebind just the Client for Microsoft Networks to the TCP/IP transport to re-enable Microsoft's NetBIOS protocol — and your Internet connection. Then: 2. Write an angry letter to your @Home provider complaining about their requirement for the presence of the "insecure NetBIOS for DHCP Host Name Resolution" and urge them to upgrade their equipment to use "DHCP Options" (which provides for Host Name Resolution in a much more secure fashion.) NOTE: The exact content of your services listing will probably be different from the one shown above. It is fine if your system does not show any of the "services" lines shown above and also if it contains items not shown. There is no need to add them just to have them listed.
	Bind ALL network services to at least one of the NetBEUI transport instances. Binding the network services to the NetBEUI transport protocol will keep the services from disappearing from the network components listing (in case you need to rebind them in the future) and will also prepare your system for completely safe local area network file and/or printer sharing either now or in the future.
	Unbind ALL network services from any other unused transport protocols. If your system has any other transport protocols installed — like an unneeded IPX/SPX transport — you can unbind all of the services from every instance of those unneeded protocols. Since they won't be bound to anything they will quietly disappear from the components list after the next system reboot.

Wrapping it all up . . .

After setting the bindings for each category, be sure to press that level's "OK" button to confirm and save the new settings and return to the main Network configuration dialog. When all of the changes have been made in each category, click "OK" to close the main Network configuration dialog.

After the system restarts you will have disciplined
the system for NetBIOS-Safe Internet access!

DO IT NOW!

Concluding Comments If you follow the guidelines given above — then REBOOT — your system will be secured against NetBIOS information leakage, it will finally stop advertising its presence across the Internet to every passing scanner, and Microsoft's "never meant for global networking" insecure file and printer sharing NetBIOS technology will be kept safely within your own computer and local network.

	Completely close your system to all NetBIOS name and resource sharing leakage, and firmly shut the three NetBIOS "scanner bait" ports 137, 138, and 139.
	Cost nothing to implement, other than the time taken to read and understand these pages, and do not depend upon any external software.
	Present a single, uniform, solution that is likely to be appropriate for everyone to use in every situation (with the slight exception of some @Home users.)
	Will not in any way disturb your current Windows or network logon procedures and will not disrupt your dial-up networking or other stored passwords.
	Do not rely upon any "hacking tricks" or undocumented procedures. No warranties will be voided and no one can refuse to support your system on the grounds that you've done something "strange" to it. (You haven't.)
	Can be completely and easily reversed. If you don't like any outcome of following these simple instructions, simply bind everything to everything once again and restart your computer.
	Create a solid foundation for establishing a secure local area network — today or tomorrow. If you have read and understood this page and the one which precedes it, you will now have a solid understanding of the theoretical and practical aspects of network component binding.
	Return CONTROL of a significant and important aspect of your personal computing experience — your computer's networking — back to YOU where it always belonged!

Although I'm a BIG fan of Personal Firewall products, as you'll see on page 7, "Personal Firewalls", the tremendous power of these straightforward "component unbinding" techniques has allowed you to disable an unwanted and unneeded capability from your system. This solution is superior to depending upon some other product or technology to "suppress" that unwanted capability. That's an important distinction in the realm of robust security.

AND, if neutering your system's networking is not possible because you do still need to share files across the Internet then full security will require the suppression of unwanted networking capabilities. The following two pages, "Evil Port Monitors" and "Personal Firewalls" detail your options and discuss pitfalls.

To continue, please see: Evil Port Monitors