Re: Lots netbios scans (udp 137)

[ben () ION AS UTEXAS EDU (Ben Laws)]

Russell Fulton wrote:
> HI,
>         Over the last few days I have seen four or five 'short' scans
> of udp 137 ports in various parts of our /16 network address space.
>
> These scans seem to start at a address 1 in a random class C and then
> probe in an ascending sequence -- sometimes stopping short of the
> address 254.  Three packets to each address and around 5 - 7 seconds
> between addresses, suggests that this is something using standard
> netbios calls. Since we block 137 on our DMZ I have not been able to
> observe a what happens when a machine responds.
>
> I am wondering if this is a new worm working through open shares, it
> certainly looks similiar to the report from Bryce Alexander at
>
> http://www.sans.org/y2k/honeypot_catch.htm.
>
> If it is then it looks as if it is being very sucessful.  The scans I
> logged came from all over the world.

Howdy Russell,

Here I've been observing similar scansm, although
over a smaller address space.  They always originate
from a Windows box (determined by `nmap -sS -O
target`), and I've seen them come from all over as
well.  Best to ensure you don't have any open shares
on your Windows systems --

Ben Laws
Hobby-Eberly Telescope
UT McDonald Observatory