Re: source LAN port 137 dest 169.x

["David Nichols" <dnichols () amci com>]

Are you running DHCP and is the dest. address 169.254.xxx.xxx?  This is
Windows default addressing scheme if a computer can't contact a DHCP server.
Of course, that doesn't explain why 172.xxx.xxx.xxx is trying to talk to
169.xxx.xxx.xxx, but it would explain where the dest. IP address is coming
from.

David Nichols
Network Admin

----- Original Message -----
From: "Darren Gragg" <admin () bsbks com>
To: <security-basics () securityfocus com>
Sent: Tuesday, July 29, 2003 11:33 AM
Subject: source LAN port 137 dest 169.x


I am seeing some UDP packets showing up in my logs as being dropped that
have a source of 172 my local subnet with a port of 137 and a destination of
a 169.xxx.xxx.xxx address with a port of 137.  what would that destination
be telling me?  Any ideas?  Thanks very much in advance

Darren Gragg
Network Administrator


---------------------------------------------------------------------------
----------------------------------------------------------------------------




---------------------------------------------------------------------------
----------------------------------------------------------------------------