Odd traffic again...... internal --> 100.100.100.1 (137-udp)



Hello,
I have posted before about a windows box that sent traffic to
different ip's to port 137, and never really got a solution to it. We
have sinced wiped that box. Now we have a new box, built in a DMZ
(Freshh install, all patches applied) and just connected it to the
internal lan (behind fw). The box now sends UDP port 137 to
100.100.100.1. The permiter firewall blocks this, and that is where
it was noticed. I have started logging on my firewall to find out who
it was, and it is an internal box.

Cisco ACL:

Aug 24 12:28:42: %SEC-6-IPACCESSLOGP: list internal_out denied udp
x.x.x.x(49375) -> 100.100.100.1(137), 5 packets

Firewall Log:

eth4c0:i[78]: 192.168.x.x -> 100.100.100.1 (UDP) len=78 id=13167
UDP: 137 -> 137
eth4c0:I[78]: 192.168.x.x -> 100.100.100.1 (UDP) len=78 id=13167
UDP: 137 -> 137
eth1c0:o[78]: 192.168.x.x -> 100.100.100.1 (UDP) len=78 id=13167
UDP: 137 -> 137
eth1c0:O[78]: 68.163.87.34 -> 100.100.100.1 (UDP) len=78 id=13167
UDP: 49902 -> 137

I am now capturing the traffic again, though there is nothing in it.
Anyone ever seen this?

T

------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your security environment. Featuring 36 hands-on training courses and 10 conference tracks, networking opportunities with over 2,500 delegates from 40+ nations.

http://www.blackhat.com
------------------------------------------------------------------------------



Relevant Pages

  • Re: Easy RRAS VPN question
    ... When NAT-T is used port 1701 UDP ... to go through a firewall directly then port 1701 UDP needs to be open. ... >> accessed from the internet. ...
    (microsoft.public.windows.server.networking)
  • Re: Keyboard Maestro Calling Home... how to stop?
    ... ports like 22 to my ISP, 80, and 443 so it sends the UDP broadcast ... A tutorial on writing firewall rules is really beyond the ... add deny log ip from any to 127.0.0.0/8 ... look in the log and see what port ...
    (comp.sys.mac.apps)
  • Re: clients separated from DC by firewall
    ... firewall is preventing any longer. ... Note that Kerberos is UDP by default and LDAP is using both TCP and UDP; ... SSL may change port requirements, ...
    (microsoft.public.windows.server.security)
  • Re: clients separated from DC by firewall
    ... firewall is preventing any longer. ... Note that Kerberos is UDP by default and LDAP is using both TCP and UDP ... change port requirements, too. ...
    (microsoft.public.windows.server.security)
  • Re: Home firewall Hits
    ... Or do you have SNMP enabled on the Wireless router at all? ... >I use Kerio's tiny personal firewall and Windows ME. ... >Port 162 with a UDP message. ...
    (Security-Basics)