Re: Increase in port 137 scans

From: r00t (sta@woh.rr.com)
Date: 10/01/02


From: "r00t" <sta@woh.rr.com>
To: "Ferry van Steen" <ferry.van.steen@InfoPart.nl>, <security-basics@securityfocus.com>
Date: Tue, 1 Oct 2002 13:58:31 -0400

YES!

I have also noticed a huge increase. For the past 2 days or so my logs are
filling. Today alone I have had 60+ attempted connections to 137,udp,from
varying ips. Maybe I will take down the wall and sniff a few of these...

Why the sudden increase?

----- Original Message -----
From: "Ferry van Steen" <ferry.van.steen@InfoPart.nl>
To: <security-basics@securityfocus.com>
Sent: Monday, September 30, 2002 6:58 AM
Subject: Increase in port 137 scans

> Hey there,
>
> did anyone else notice a huge increase in port 137 scans (UDP)? Usually I
> had perhaps 1 a day of those. Now I've seen atleast 10 in the past 2 hours
> alone.
>
> Kind regards,
>
> Ferry van Steen
> InfoPart Automatisering B.V.
> Beeksestraat 24
> 4841 GC Prinsenbeek
> The Netherlands
> Phone: +31 (0)76 - 5 44 04 11
> Fax: +31 (0)76 - 5 41 83 51
> Mobile: +31 (0)6 - 28 46 47 45
> E-Mail (business): ferry.van.steen@infopart.nl
> E-Mail (private): freaky@bananateam.nl
> MSN Messenger: freaky@freaky2000.dyndns.org
> ICQ (UIN (seldom used)): 191458
>
>
>