RE: Listener on ports 137, 138, 139

["Gary Axten" <gary.axten () lineone net>]

Hi Rune,
The IP address range you list is reserved by Microsoft I believe for use in
a small peer to peer network. If an interface is configured for DHCP
(default) and does not receive a reply to the lease request it will
automatically use an address in this range.

This is default behaviour and there is nothing to worry about as long as
Norton is set to block traffic to those ports.

Further information here:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q310524

HTH

Regards

Gary

> -----Original Message-----
> From: Rune Berntzen [mailto:rbern8 () online no]
> Sent: 15 October 2002 18:27
> To: Security Basics
> Subject: Listener on ports 137, 138, 139
>
>
> Hi all,
>
> When checking port activity using TCPView I notice that I have a =
> listener on ports 137,138 and 139.
> The Local Address seems  to be from a Class B network, 169.254.0.0, =
> which I trace to something called=20
>
> BLACKHOLE-1.IANA.ORG
>
> using SmartWhois.
>
> The funny thing is that the LISTENING  entries are visible in TCPView =
> even before I connect to my ADSL provider.
>
> Anybody has an idea about what this can be.
>
> BTW, I am running Norton Internet Security 2001 with updatet virus =
> definitions.
>
> Thanks in advance,
> Rune