Re: UDP port 137

Bret McDanel (bretrehost.com)
Fri, 29 Jan 1999 12:11:30 -0500

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
• Next message: Vik Bajaj: "Re: The value of detecting neutralized threats. (was RE: IDS bla"
• Previous message: Vik Bajaj: "RE: 192.168.x.y ... ?"

---Reply on mail from EDS about UDP port 137

> My firewall has been alerting me to "possible port scans" on UPD for
> port 137.
> This seems to occur from a number of source addresses and domains on the
> internet, some resolve-able, some not. Does anyone know of a reason
> I should be concerned?
>
> John B.

That is WINS.. Windows DNS effectivly.. When I goto a windows nt based
web server, I see that it tries to figure out who I am based on a querry
via WINS.. I would warn you though, that WINS can give up information on
the system (like the netbios name, which may not always equal the DNS
name) so you may be wise to block that..

-- 
Bret McDanel                                    http://www.rehost.com
Realistic Technologies, Inc.                             973-514-1144
     These opinions are mine, and may not be the same as my employer

• Next message: Vik Bajaj: "Re: The value of detecting neutralized threats. (was RE: IDS bla"
• Previous message: Vik Bajaj: "RE: 192.168.x.y ... ?"

This archive was generated by hypermail 2.0b3 on Sat Jul 17 1999 - 07:18:08 CDT