Re: [fw-wiz] Help w/ Port 137 Traffic

From: Frederick M Avolio (fred@avolio.com)
Date: 10/13/02


To: "Mike McCandless" <michael@prismbiz.com>, <firewall-wizards@honor.icsalabs.com>
From: Frederick M Avolio <fred@avolio.com>
Date: Sun Oct 13 08:22:02 2002

At 11:31 PM 10/12/2002 -0400, Mike McCandless wrote:
>I have seen an increase in (unsolicited) traffic to port 137 at my
>firewall. ...

A quick google search turns up this
"There has been an increase in scanning for port 137 (Netbios SMB service).
This has two sources, an increase in awareness among script kiddies of the
ability to discover information about a target host using NBTSTAT and the
spread of an internet worm known as network.vbs. ..."

See the source at http://www.sans.org/newlook/resources/IDFAQ/port_137.htm

Fred
Avolio Consulting, Inc.
16228 Frederick Road, PO Box 609, Lisbon, MD 21765, US
+1 410-309-6910 (voice) +1 410-309-6911 (fax)
http://www.avolio.com/