[unisog] I may have spoken too soon (Windows message)

Arnold, Jamie harnold at binghamton.edu
Fri Oct 11 12:55:50 GMT 2002

Not Exchange, but certainly Outlook talking to Exchange.  Outlook uses 135.

-----Original Message-----
From: Gary Flynn [mailto:flynngn at jmu.edu] 
Sent: Thursday, October 10, 2002 8:27 PM
To: Rich Graves
Cc: unisog
Subject: Re: [unisog] I may have spoken too soon (Windows message)

Rich Graves wrote:

>On Thu, 10 Oct 2002, Clarke Morledge wrote:
>>We've been getting both of these "diploma" and "poetry" messages, and 
>>like Martin, we block ports 137-139 at the firewall.
We also block 445 and I was just informed someone received a message 
that sounds
like what others are seeing.

>Yes, they probe port 135, the Windows RPC portmapper, and get in on 
>another of the mysterious ports that the Windows kernel opens up by 
Does the connection to 135 open up the other port? Its only supposed to 
be a locator
for already listening services.

>Block UDP and TCP 135 too.
FYI.  think that will break Exchange.


More information about the unisog mailing list