Re: Firewall rule closed ALL but Port UDP 137 open

From:
Date: 10/30/02 

Date: Wed, 30 Oct 2002 02:27:30 -0700

"Markus Dubois" <Markus.Dubois@gmx.ch> wrote in message
news:186d15f6.0210300045.77aeba03@posting.google.com...
> Hi,
>
> on my home internet PC (Win98 Shared internet access, firewalled with
> Norton Internet Security 2002) a nmap scan shows port udp 137 open.
> Even if i make a rule on top with
> block all any any
>
> Very odd situation. There is nothing open according to my
> firewall-rule but nmap shows this open port......
>
> Why?
>
> Regards
>
> Markus

Uh, if you're scanning YOURSELF, it will probably show that open because you
have norton antivirus using that port as a sort of email proxy with which to
scan inbound emails. It's normal. If an internet-based scan shows it open,
that's different.
Uh, oops, that's netbios over tcp/ip. You're sharing the internet, so it's
gonna look open.

Relevant Pages

  • Re: IPTables F*&%-up part 3
    ... > nmap 67.117.74.180 ... go through the firewall script and comment out the ... > you have a more accurate image of what anyone on the Internet can see ... > nmap will list the open ports on the firewall. ...
    (comp.os.linux.security)
  • Re: nmap inconsistent results - via intermedite router?
    ... When I run an nmap from my home machine to the internet machine, ... Try 'netstat -tupan' on that internet system. ... From your home system, run tcpdump, and attempt to connect to that port ...
    (comp.security.firewalls)
  • Re: why ports 111, 113 and 772 are open?
    ... Do you have a single machine with some internet ... connection or are you behind a NAT box? ... From which machine do you nmap? ...
    (Debian-User)
  • Firewall rule closed ALL but Port UDP 137 open
    ... on my home internet PC (Win98 Shared internet access, ... Norton Internet Security 2002) a nmap scan shows port udp 137 open. ... firewall-rule but nmap shows this open port...... ...
    (comp.security.firewalls)
  • Re: Open ports?
    ... to work out how one knows whether a port is open on the local network ... only or actually open to the internet ... Also nmap shows lots: ...
    (comp.sys.mac.system)