The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My work

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,308 other followers

Fake Internet Connectivity for your Lab (Tricking NCSI) – via: Canberra Premier Field Engineering

Posted by jpluimers on 2013/06/21

If you ever wondered why how in Windows – as of Vista – the NCIS (network connection status indicator) determines if you have a valid internet connection, it is pretty simple, as both these pages explain:

NCIS depends on the msftncis.com domain and is for supporting Network Awareness in applications.

The probing is done in this order:

  1. Download check:
    1. Do a DNS lookup for www.msftncsi.com
    2. Retreive the file http://www.msftncsi.com/ncsi.txt
    3. Check if the content of this file matches the text “Microsoft NCSI” (without quotes).
  2. DNS check:
    1. Do a DNS lookup for dns.msftncsi.com
    2. Check if the DNS lookup returns IPv4 address 131.107.255.255

Windows supports three outcomes:

  • If the download check succeeds, it assumes a valid internet connection.
  • If not, it does the DNS check. If it resolves, but returns a different address, then it assumes you have no valid internet connection.
  • If it resolves, then it assumes you need to logon to get internet access.

With the above knowledge, it is takes few steps to simulate Fake Internet Connectivity for your Lab (Tricking NCSI):

  1. Setup a server at IPv4 address 131.107.255.255 that does DHCP, DNS, WWW and can act as a default gateway
  2. Have the server serve DHCP so the DHCP clients have a default gateway and DNS pointing to the server
  3. Have the server serve DNS to the client for the msftncis.com domain
  4. Make the server resolve www.msftncsi.com to itself
  5. Make the server serve WWW and serve http://www.msftncsi.com/ncsi.txt
  6. Make the server resolve dns.msftncsi.com as 131.107.255.255

–jeroen

via: Fake Internet Connectivity for your Lab (Tricking NCSI) – Canberra Premier Field Engineering: Team Blog – Site Home – MSDN Blogs.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: