nanog mailing list archives
Re: UDP port 137 Question
From: Henry Linneweh <linneweh () concentric net>
Date: Tue, 06 Jan 1998 23:15:21 -0800
port 139 is the OOB bug known as winnuke attack and can be patched, variations come through other ports as directed by Linux boxes at win95 users or MS users Henry R. Linneweh C. Jon Larsen wrote:
Is there any *valid* reason to see UDP traffic directed at a unix box's port 137 coming from IP sources across the internet ? The unix servers in question are most definitely *not* running samba, and there is absolutely no NT anywhere on this customer's network (that is seeing the incoming UDP traffic directed at an IP destination address on port 137). (A couple of 95 boxes scattered across an Ethernet comprise the Micro$oft part of the network). None of the 95 boxen are running any file or print serving (sharing) resources. I can't think of any valid reason to see this traffic, personally. Anybody out there that can present a scenario where I would expect to see these UDP packets coming back in ? netbios-ns 137/tcp nbns netbios-ns 137/udp nbns netbios-dgm 138/tcp nbdgm netbios-dgm 138/udp nbdgm netbios-ssn 139/tcp nbssn =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- C. Jon Larsen Email: jlarsen () ford ajtech com Systems Engineer Voice: +1.804.353.2800 x118 A&J Technologies http://www.ajtech.com PGP Key fingerprint: 8A 62 4C 6E 1E 3C CD 63 B3 16 1A 1B D2 61 EE 97 PGP Public key available at: http://ford.ajtech.com/CJL.txt =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-- ¢4i1å
Current thread:
- Re: UDP port 137 Question, (continued)
- Re: UDP port 137 Question Steve Carter (Jan 06)
- Re: UDP port 137 Question Melody Yoon (Jan 06)
- Re: UDP port 137 Question Bryce Ryan (Jan 06)
- Re: UDP port 137 Question Melody Yoon (Jan 06)
- Re: UDP port 137 Question Rick H. Wesson (Jan 06)
- Re: UDP port 137 Question DAVE NORDLUND (Jan 08)
- Re: UDP port 137 Question James Stephens (Jan 06)
- Re: UDP port 137 Question Bryce Ryan (Jan 06)
- Re: UDP port 137 Question DAVE NORDLUND (Jan 06)
- Re: UDP port 137 Question Eric Germann (Jan 06)
- Re: UDP port 137 Question DAVE NORDLUND (Jan 08)
- Re: UDP port 137 Question Eric Germann (Jan 06)
- Re: UDP port 137 Question Henry Linneweh (Jan 07)
- Re: UDP port 137 Question gary flynn (Jan 06)
- Re: UDP port 137 Question Joe Pruett (Jan 06)
- Message not available
- Re: UDP port 137 Question Jay R. Ashworth (Jan 06)
- Message not available
- Re: UDP port 137 Question Eric Germann (Jan 07)