[Dshield] udp/137 (netbios) scans

*Hobbit* hobbit at avian.org
Tue Oct 1 11:25:28 GMT 2002

You'll notice that most of your "scans" also use SOURCE port 137.

This is typical of a windoze box confused about whether to use DNS or
WINS to look up names, and more often than not they simply try a direct
netbios name query against whatever box they're trying to look up.
It's idiotic and highly unlikely to work across the open internet against
most firewalled perimeters, but overall quite harmless.

Suggest you just drop the stuff unnoticed, chalk it up to the typical
stupidity we've come to expect from Redmond, and move on.


More information about the list mailing list