many attempts to access port 137 from the Internet - are these vulnerability scans?

From: Jerry Dobner (jerry.dobner@gfinet.com)
Date: 11/28/02

Next message: dr.emailposter: "Re: All rules = No rules?"
Previous message: Cicero: "Suggestions for the best firewall appliances for a small business network please? (<50 users)"
Next in thread: Alan Guy: "Re: many attempts to access port 137 from the Internet - are these vulnerability scans?"
Reply: Alan Guy: "Re: many attempts to access port 137 from the Internet - are these vulnerability scans?"
Reply: John Elsbury: "Re: many attempts to access port 137 from the Internet - are these vulnerability scans?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: jerry.dobner@gfinet.com (Jerry Dobner)
Date: 28 Nov 2002 12:52:53 -0800

I get _MANY_ messages like these every day in my SonicWall log:

UDP packet dropped - Source:209.145.195.44, 1084, WAN -
Destination:X.X.X.X, 137, LAN
UDP packet dropped - Source:151.38.220.249, 15380, WAN -
Destination:X.X.X.X, 137, LAN

>From all different source IPs. Are these port scans by potential
attackers?

Next message: dr.emailposter: "Re: All rules = No rules?"
Previous message: Cicero: "Suggestions for the best firewall appliances for a small business network please? (<50 users)"
Next in thread: Alan Guy: "Re: many attempts to access port 137 from the Internet - are these vulnerability scans?"
Reply: Alan Guy: "Re: many attempts to access port 137 from the Internet - are these vulnerability scans?"
Reply: John Elsbury: "Re: many attempts to access port 137 from the Internet - are these vulnerability scans?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Re: pf and ftp from gateway
... # ephemeral port, so that the remote SIP proxy knows what session we belong ... pass in quick on $ext_if inet proto udp from any port bootps to ... pass out quick on $ext_if inet proto udp from $ext_if to any port bootps ... # allow lan requests from lan clients to exit EXT ...
(comp.unix.bsd.openbsd.misc)
active ftp
... Does anyone have a pf config for active ftp? ... # Redirect lan client FTP requests ... # to the ftp-proxy running on the firewall host (via inetd on port 8021) ... rdr on $int_if inet proto tcp from $int_if:network to any port www -> ...
(comp.unix.bsd.openbsd.misc)
Re: Remote desktop & Netgear router
... if you can connect to the PC from another PC using the "private LAN IP address" over your ... local LAN then Remote Desktop is obviously setup right and working. ... The issue then is the port forwarding on the router. ...
(microsoft.public.windowsxp.work_remotely)
pftpx failing on freebsd 5.4-stable
... I'm trying to get ftp working from my lan to the internet. ... # when being port scanned. ... pass in quick on $ext_if inet proto udp from $isp_dhcp_server port bootps to ...
(freebsd-net)
Re: Kazaa Block !
... >> security breach, but worse, it is a blatant abuse of work computers. ... >> If this is a home LAN, and these are your children, ground them first, ... >> block KaZaA from their computers, ... > goes over port 80. ...
(comp.security.firewalls)