More Odd DNS Records: NIMLOC - SANS Internet Storm Center --> Internet Storm Center Sign In Sign Up Handler on Duty: Xavier Mertens Threat Level: green previous Click HERE to learn more about classes Johannes is teaching for SANS More Odd DNS Records: NIMLOC Published : 2026-07-07. Last Updated : 2026-07-07 18:09:04 UTC by Johannes Ullrich (Version: 1) 0 comment(s) Yesterday, I talked about NAPTR records and how they are related to RCS. But there is another "odd" record that shows up in my DNS logs. This one isn't new, but I don't think I ever covered it: NIMLOC. At least that is what Zeek calls it. But let's see what it is all about. At first, it looks like NIMLOC records are no longer used. Google's AI overview explains: "A NIMLOC (Nimrod Locator) DNS record is an obsolete resource record type (Type 32) originally designed for the Nimrod routing architecture to map names to network locators. Because Nimrod was an experimental protocol, NIMLOC records are considered historic and are not used in modern, standard network operations." While I do have one or the other odd IOT device in my network, I doubt any of them speak "Nimrod". On the other hand, the queries originate from my macOS systems. This turns out to be an older standard, replaced by a newer (but still old) standard, with the newer standard becoming obsolete before the even older standard is phased out. DNS defines several resource record types. The official list is maintained by IANA [1] and I am including a sample below:   TYPE Value Meaning References A 1 IPv4 Address RFC1035 NS 2 Name Server RFC1035 PTR 12 Domain Name Pointer RFC1035 MX 15 Mail Server RFC1035 TXT 16 Text String RFC1035 AAAA 28 IPv6 Address RFC3596 NIMLOC 32 Nimrod Locator (no RFC) SRV 33 Server Selection RFC2782 NAPTR 35 Naming Authority Pointer RFC3403 There is a range of unassigned RR types, so one would think that it is not necessary to reuse RR Types. But this is exactly what happened here. RR Type 32 was originally assigned for the old NetBIOS over TCP/UDP (RFC 1002, [2]). This actually became one of the few Internet Standards (STD 19). RR Type 32 is assigned ot "NB" (NetBIOS General Name Service) and 33 to "NBSTAT", the NetBIOS Node Status. If you search for it in the RFC, look for the hex values 0x0020 and 0x0021 (took me a while to find them). NetBIOS is long gone, and modern Windows networks use DNS and SMB over TCP, eliminating the NetBIOS layer. But macOS is still holding on to it and broadcasting name announcements on port 137 using these records. Zeek (which I used to collect the logs), translates RR Type 32 to "NIMLOC", which conforms to the current IANA assignment for this type. But in reality, you are probably going to see NetBIOS and not the never-quite-implemented Nimrod routing scheme. [1] https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4 [2] https://www.rfc-editor.org/info/rfc1002/ -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter | Keywords: 0 comment(s) Click HERE to learn more about classes Johannes is teaching for SANS previous Comments Login here to join the discussion. Top of page × Diary Archives Homepage Diaries Podcasts Jobs Data TCP/UDP Port Activity Port Trends SSH/Telnet Scanning Activity Weblogs Domains Threat Feeds Activity Threat Feeds Map Useful InfoSec Links Presentations & Papers Research Papers API Tools DShield Sensor DNS Looking Glass Honeypot (RPi/AWS) InfoSec Glossary Contact Us Contact Us About Us Handlers About Us Slack Channel Mastodon Bluesky X © 2026 SANS™ Internet Storm Center Developers: We have an API for you!   Link To Us About Us Handlers Privacy Policy

📌 来源: SANS ISC | 📅 2026-07-07