search

dellastreet / NBD-SparseImager

A disk imaging solution for creating partial, sparse, binary images of windows machines for forensic analysis.
2 stars 0 forks source link

broadcast on windows client doesn't get out on all interfaces #17

Closed dellastreet closed 14 years ago

dellastreet commented 14 years ago

Several reports on internet: MS windows will not send correct local adresses per interface but use the local adress of the first interface on packets on all the others.

To help things the right way would be to send to all interface broadcast addresses. This requires the ability to iterate these addresses, namely subnetmasks. these are stored in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Interfaces\

and

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Parameters\Tcpip\SubnetMask

supposedly software API's exist to make looking into it easier but these are probably not lightweight.

dellastreet commented 14 years ago

Quick solution would be to make it a commandline option.... but that would defeat the concept of zero configuration

dellastreet commented 14 years ago

Apperantly the above bug was causing my probs. This evening got it working for my XP laptop as well (booted a copy-on-write version of the remote block devide using qemu)