nanog mailing list archives
Re: port 139 scans?
From: James Cronin <james () unfortu net>
Date: Wed, 13 Feb 2002 11:48:54 +0000
Port 139's the netbios port. Is the source address in NTL's 80.0.0.0/13 allocation? They're using those IPs for their broadband always on cable modem customers. So it's either some idiot script kiddies running port scanners themselves or unfirewalled fools who've had their Windows boxes hacked. J. x
Is anyone else seing lots of packets being thrown at port 139? We're getting 5 or 6 packets a sec, mostly from 80.0.0.0/8 (and all tcp syn's). -- Internet Vision Internet Consultancy Tel: 020 7589 4500 60 Albert Court & Web development Fax: 020 7589 4522 Prince Consort Road vision () ivision co uk London SW7 2BE http://www.ivision.co.uk/
Current thread:
- port 139 scans? Jasper Wallace (Feb 13)
- Re: port 139 scans? Stephen J. Wilcox (Feb 13)
- Re: port 139 scans? Jasper Wallace (Feb 13)
- Re: port 139 scans? James Cronin (Feb 13)
- <Possible follow-ups>
- RE: port 139 scans? Steve Smith (Feb 13)
- Re: port 139 scans? Stephen J. Wilcox (Feb 13)