RE: Listener on ports 137, 138, 139

[Matt Schaelling <mschaelling () cricketcommunications com>]

The class B network that you see is the default network that M$ uses if no
other address is available.  It would make sense that the computer would be
listening for NetBios broadcasts even before a "real" ip address is
assisgned.

It is normal behavior for all M$ based computers.

Matt

-----Original Message-----
From: Rune Berntzen [mailto:rbern8 () online no]
Sent: Tuesday, October 15, 2002 11:27 AM
To: Security Basics
Subject: Listener on ports 137, 138, 139


Hi all,

When checking port activity using TCPView I notice that I have a =
listener on ports 137,138 and 139.
The Local Address seems  to be from a Class B network, 169.254.0.0, =
which I trace to something called=20

BLACKHOLE-1.IANA.ORG

using SmartWhois.

The funny thing is that the LISTENING  entries are visible in TCPView =
even before I connect to my ADSL provider.

Anybody has an idea about what this can be.

BTW, I am running Norton Internet Security 2001 with updatet virus =
definitions.

Thanks in advance,
Rune