Security Basics mailing list archives

Re: Listener on ports 137, 138, 139


From: David Corking <david.corking2 () dol net>
Date: Wed, 16 Oct 2002 23:25:29 -0500

On Tue, 15 Oct 2002, Rune Berntzen wrote:

When checking port activity using TCPView I notice that I have a =
listener on ports 137,138 and 139.

This is a windows networking client (aka smb/netbios aka nbt )

The Local Address seems  to be from a Class B network, 169.254.0.0, =

These are a range of default addresses a DHCP client assigns to an
interface when it cannot find a DHCP server.

The funny thing is that the LISTENING  entries are visible in TCPView =
even before I connect to my ADSL provider.

Anybody has an idea about what this can be.

Why does it seem funny to you?

I've never used TCPview.  Maybe you can see yourself with it?

Compare your own IP addresses with the ones the tool reports.  Does
the tool come with decent manuals? -- if not there are plenty that do



Current thread: