Re: RE: Help w/ Port 137 Traffic

["Miha Vitorovic" <miha () nil si>]

> Not logging 137/udp is a good idea because it fills up the logs and does
> not add any significant information to them.

Hi all,

Reading this thread, I notice something funny. Everyone says that logging
blocked UDP 137 adds no useful information, and I understand where this is
coming from. Windows boxes are so noisy when it comes to netbios, that it
is best to just ignore it, or you'd have to worry about every misconfigured
firewall out there.

 But on the other hand, this whole thread began with:
"I noticed an unusual increase in the amount packets coming for port 137"
or something to that effect. Seems like some useful information can still
come from logging it. In light of that, what do you think? Log less or
more?

Regards,
---
  Miha Vitorovic
  Inženir v tehničnem področju
  Customer Support Engineer

   NIL Data Communications,  Einspielerjeva 6,  1000 Ljubljana,  Slovenia
   Phone +386 1 4746 500      Fax +386 1 4746 501     http://www.NIL.si

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards