[unisog] I may have spoken too soon (Windows message)

Arnold, Jamie harnold at binghamton.edu
Fri Oct 11 12:55:50 GMT 2002


Not Exchange, but certainly Outlook talking to Exchange.  Outlook uses 135.

-----Original Message-----
From: Gary Flynn [mailto:flynngn at jmu.edu] 
Sent: Thursday, October 10, 2002 8:27 PM
To: Rich Graves
Cc: unisog
Subject: Re: [unisog] I may have spoken too soon (Windows message)


Rich Graves wrote:

>On Thu, 10 Oct 2002, Clarke Morledge wrote:
>
>  
>
>>We've been getting both of these "diploma" and "poetry" messages, and 
>>like Martin, we block ports 137-139 at the firewall.
>>    
>>
We also block 445 and I was just informed someone received a message 
that sounds
like what others are seeing.

>
>Yes, they probe port 135, the Windows RPC portmapper, and get in on 
>another of the mysterious ports that the Windows kernel opens up by 
>default.
>
Does the connection to 135 open up the other port? Its only supposed to 
be a locator
for already listening services.

>
>Block UDP and TCP 135 too.
>
FYI.  think that will break Exchange.

>  
>





More information about the unisog mailing list