[unisog] I may have spoken too soon (Windows message)

Gary Flynn flynngn at jmu.edu
Fri Oct 11 00:27:25 GMT 2002


Rich Graves wrote:

>On Thu, 10 Oct 2002, Clarke Morledge wrote:
>
>  
>
>>We've been getting both of these "diploma" and "poetry" messages, and like
>>Martin, we block ports 137-139 at the firewall.
>>    
>>
We also block 445 and I was just informed someone received a message 
that sounds
like what others are seeing.

>
>Yes, they probe port 135, the Windows RPC portmapper, and get in on
>another of the mysterious ports that the Windows kernel opens up by
>default.
>
Does the connection to 135 open up the other port? Its only supposed to 
be a locator
for already listening services.

>
>Block UDP and TCP 135 too.
>
FYI.  think that will break Exchange.

>  
>





More information about the unisog mailing list