Thu Jun 23 00:45:34 GMT 2005
167.... To 192.168.1.100 - which is the router's internal IP for my web
I checked the router's logs and there is no outgoing relevant traffic,
just incoming. I blocked port 137 on the router and my firewall stopped
receiving these attacks.
1. Does anyone experienced a similar case?
2. Do I lose anything by blocking port 137?
By the way, My ISP resolved the CodeRed exploits as a few other lazy
ISPs did, by blocking incoming traffic on port 80. So one day I found
clean logs and was very happy that the warm went to sleep, but than
realized that there is no access to my site as well, and had to find a
way around by using another port.
Zeev Shilor, PM
Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:
More information about the list