The NIS netgroup map is actually very nice, because there is a "netgroup.byhost" map that the filer consults. This map is keyed by hostname (actually "hostname.*"). The data in the entry is all the netgroups that the host belongs to. Try it sometime if you use NIS negroups.
Yes, but this map is not implemented in NIS+ :( So the filer ends up niscat'ing the whole netgroup file from the NIS+ server. We had to go with local /etc/netgroup files to avoid this.
/Brian/