Re: Port 139 scans

[vern () ee lbl gov]

> I am particularly concerned over this issue of these broadcasts
> originating from Concentric.net

I don't think they particularly are.  Here at lbl.gov (128.3/16), we're
getting scanned from cmu.edu (128.2/16).  nersc.gov (128.55/16) is getting
scanned from ucsd.edu (128.54/16).  So it could well be that the ones being
scanned from concentric.net are simply those with nearby address blocks,
and it's just one small part of rampant scanning from all over the place.

By the way, we identified a couple instances of the virus that Ken Lindahl
mentioned in his earlier post.

                Vern