RE: RE: Help w/ Port 137 Traffic

["Bill Royds" <broyds () rogers com>]

The netbios Name query/response packets are in the same format as DNS query/response packets, just on port 137 instead 
of 53 so you could use DNS tools connected to port 137 instead of SAMBA. This doesn't help with port 139 traffic 
although Ethereal has a good netbios dissector.

-----Original Message-----
From: firewall-wizards-admin () honor icsalabs com
[mailto:firewall-wizards-admin () honor icsalabs com]On Behalf Of Luca
Berra
Sent: Mon October 14 2002 02:50
To: firewall-wizards () honor icsalabs com
Subject: Re: [fw-wiz] RE: Help w/ Port 137 Traffic

<snip>

as a last note i am also getting many probes on port 137 and 139, but
they seem unrelated, i might try answering to netbios-ns lookups and see
what happens, if i find a smaller beast than samba to use, that is.


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards