RE: source LAN port 137 dest 169.x

["Potter, Tim" <Tim.Potter () clarkconsulting com>]

HP JetDirect also uses the 169 range.  However, that is usually on port
9100 for printers.

-----Original Message-----
From: Kurt [mailto:kurtbuff () spro net] 
Sent: Tuesday, July 29, 2003 5:29 PM
To: security-basics () securityfocus com
Subject: RE: source LAN port 137 dest 169.x


The only thing that I'm familiar with that the 169.x.x.x range is used
for is the auto-config in MSFT machines that can't get a DHCP-assigned
address.

| -----Original Message-----
| From: Darren Gragg [mailto:admin () bsbks com]
| Sent: Tuesday, July 29, 2003 08:33
| To: security-basics () securityfocus com
| Subject: source LAN port 137 dest 169.x
|
|
| I am seeing some UDP packets showing up in my logs as being dropped 
| that have a source of 172 my local subnet with a port of 137 and a
| destination of
| a 169.xxx.xxx.xxx address with a port of 137.  what would
| that destination
| be telling me?  Any ideas?  Thanks very much in advance
|
| Darren Gragg
| Network Administrator
|
|


------------------------------------------------------------------------
---
------------------------------------------------------------------------
----



---------------------------------------------------------------------------
----------------------------------------------------------------------------