LLMNR and NBT-NS Poisoning

R W@shiftyroot

•updated Aug 5, 2025•4•3•90

Detects potential LLMNR/NBT-NS poisoning by identifying a single host responding to a high number of distinct client IPs on UDP ports 137 (NBT-NS) or 5355 (LLMNR). This behavior is indicative of an attacker attempting to spoof name resolution to redirect traffic.