SCOUG-HELP Mailing List Archives

<< Previous Message << >> Next Message >>

Date:	Mon, 28 Oct 2002 12:39:43 PST7
From:	"Steven Levine" <steve53@earthlink.net >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: Compare firewall logs

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

In <3DBD9ECF.34E6@peterskye.com>, on 10/28/02
at 12:32 PM, Peter Skye said:

>My firewall shows that for the past week or so I've been inundated with
>UDP port 137 attempts, at the rate of about one per minute. They are
>coming from everywhere, not any particular IP or group of IP addresses.

It's probably some sort of hack attempt. Try a google for:

udp port 137

There's nothing definitive, but there are some definitions:

The answer (I think): Windows based machines that try to resolve your
hostname will do a NetBIOS node status request to port 137 (NetBIOS name
service port, see RFC 1001/1002). It has to do with the 'gethostbyaddr()'
sockets API function. Whereas a UNIX box might resolve via DNS and NIS,
Microsoft resolves via DNS and NetBIOS.

Steven

--
---------------------------------------------------------------------
"Steven Levine" MR2/ICE 2.35 #10183 Warp4/FP15/14.085_W4
www.scoug.com irc.webbnet.org #scoug (Wed 7pm PST)
---------------------------------------------------------------------

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 28 | October | 2002 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.