Re: Increase in port 137 scans

From: r00t (sta@woh.rr.com)
Date: 10/01/02 

From: "r00t" <sta@woh.rr.com>
To: "Ferry van Steen" <ferry.van.steen@InfoPart.nl>, <security-basics@securityfocus.com>
Date: Tue, 1 Oct 2002 13:58:31 -0400

YES!

I have also noticed a huge increase. For the past 2 days or so my logs are
filling. Today alone I have had 60+ attempted connections to 137,udp,from
varying ips. Maybe I will take down the wall and sniff a few of these...

Why the sudden increase?

----- Original Message -----
From: "Ferry van Steen" <ferry.van.steen@InfoPart.nl>
To: <security-basics@securityfocus.com>
Sent: Monday, September 30, 2002 6:58 AM
Subject: Increase in port 137 scans

> Hey there,
>
> did anyone else notice a huge increase in port 137 scans (UDP)? Usually I
> had perhaps 1 a day of those. Now I've seen atleast 10 in the past 2 hours
> alone.
>
> Kind regards,
>
> Ferry van Steen
> InfoPart Automatisering B.V.
> Beeksestraat 24
> 4841 GC Prinsenbeek
> The Netherlands
> Phone: +31 (0)76 - 5 44 04 11
> Fax: +31 (0)76 - 5 41 83 51
> Mobile: +31 (0)6 - 28 46 47 45
> E-Mail (business): ferry.van.steen@infopart.nl
> E-Mail (private): freaky@bananateam.nl
> MSN Messenger: freaky@freaky2000.dyndns.org
> ICQ (UIN (seldom used)): 191458
>
>
>

Relevant Pages

  • Re: at times the draper
    ... port. ... Perry, still handling, treats almost victoriously, as the ... far from the division let alone the infrastructure. ...
    (sci.crypt)
  • Re: local ports (Mozilla Calendar)
    ... > Unless you are referring to Sunbird... ... which is the stand alone ... > calendar project... ... I do not think there is a port for it yet. ...
    (freebsd-questions)
  • Re: [PATCH 2/2] UIO: Documentation for UIO ioport info handling
    ... interrupt, it's your modules task to determine the irq number during ... Simply leave it alone. ... +Fill in the number of the first port of this region. ... +framework to set up sysfs files for this region. ...
    (Linux-Kernel)
  • RE: Increase in port 137 scans
    ... Holy cow! ... Could this be some kind of probe by ... Increase in port 137 scans ... Today alone I have had 60+ attempted connections to ...
    (Security-Basics)
  • Re: Close Port 113 - Observation
    ... The recommendation is: Leave Port 113 alone. ... is listening to it, it's closed, end of story. ...
    (comp.security.firewalls)